> For the complete documentation index, see [llms.txt](https://docs.defguard.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.defguard.net/2.1/for-developers/rest-api/core/acl/create-an-acl-rule.md).

# Create an ACL rule

```json
{"openapi":"3.1.0","info":{"title":"defguard Core API","version":"2.1.0"},"tags":[{"name":"ACL","description":"Access Control Lists (ACL)."}],"security":[{"cookie":[]},{"api_token":[]}],"components":{"securitySchemes":{"cookie":{"type":"apiKey","in":"cookie","name":"defguard_session"},"api_token":{"type":"http","scheme":"bearer"}},"schemas":{"EditAclRule":{"type":"object","description":"An ACL rule, as accepted when creating or updating one.","required":["name","all_locations","locations","enabled","allow_all_users","deny_all_users","allow_all_groups","deny_all_groups","allow_all_network_devices","deny_all_network_devices","allowed_users","denied_users","allowed_groups","denied_groups","allowed_network_devices","denied_network_devices","use_manual_destination_settings","addresses","ports","protocols","any_address","any_port","any_protocol","aliases","destinations"],"properties":{"addresses":{"type":"string"},"aliases":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"all_locations":{"type":"boolean"},"allow_all_groups":{"type":"boolean"},"allow_all_network_devices":{"type":"boolean"},"allow_all_users":{"type":"boolean"},"allowed_groups":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"allowed_network_devices":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"allowed_users":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"any_address":{"type":"boolean"},"any_port":{"type":"boolean"},"any_protocol":{"type":"boolean"},"denied_groups":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"denied_network_devices":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"denied_users":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"deny_all_groups":{"type":"boolean"},"deny_all_network_devices":{"type":"boolean"},"deny_all_users":{"type":"boolean"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"enabled":{"type":"boolean"},"expires":{"type":["string","null"],"format":"date-time"},"locations":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"name":{"type":"string"},"ports":{"type":"string"},"protocols":{"type":"array","items":{"$ref":"#/components/schemas/i32"}},"use_manual_destination_settings":{"type":"boolean"}}},"i64":{"type":"integer","format":"int64"},"i32":{"type":"integer","format":"int32"},"ApiAclRule":{"type":"object","description":"An ACL rule. All relations represented as arrays of IDs.","required":["id","state","name","modified_at","modified_by","all_locations","locations","enabled","allow_all_users","deny_all_users","allow_all_groups","deny_all_groups","allow_all_network_devices","deny_all_network_devices","allowed_users","denied_users","allowed_groups","denied_groups","allowed_network_devices","denied_network_devices","use_manual_destination_settings","addresses","ports","protocols","any_address","any_port","any_protocol","aliases","destinations"],"properties":{"addresses":{"type":"string"},"aliases":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"all_locations":{"type":"boolean"},"allow_all_groups":{"type":"boolean"},"allow_all_network_devices":{"type":"boolean"},"allow_all_users":{"type":"boolean"},"allowed_groups":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"allowed_network_devices":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"allowed_users":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"any_address":{"type":"boolean"},"any_port":{"type":"boolean"},"any_protocol":{"type":"boolean"},"denied_groups":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"denied_network_devices":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"denied_users":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"deny_all_groups":{"type":"boolean"},"deny_all_network_devices":{"type":"boolean"},"deny_all_users":{"type":"boolean"},"destinations":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"enabled":{"type":"boolean"},"expires":{"type":["string","null"],"format":"date-time"},"id":{"$ref":"#/components/schemas/i64"},"locations":{"type":"array","items":{"$ref":"#/components/schemas/i64"}},"modified_at":{"type":"string","format":"date-time"},"modified_by":{"type":"string"},"name":{"type":"string"},"parent_id":{"oneOf":[{"type":"null"},{"$ref":"#/components/schemas/i64"}]},"ports":{"type":"string"},"protocols":{"type":"array","items":{"$ref":"#/components/schemas/i32"}},"state":{"$ref":"#/components/schemas/RuleState"},"use_manual_destination_settings":{"type":"boolean"}}},"RuleState":{"type":"string","description":"ACL rule can be in one of the following states:\n- New: the rule has been created and not yet applied\n- Modified: the rule has been modified and not yet applied\n- Deleted: the rule has been marked for deletion but not yed removed\n- Applied: the rule was applied\n- Expired: the rule is past it's expiration date\n\nApplied state does NOT guarantee that all locations have received the rule\nand performed appropriate operations, only that the next time configuration\nis being sent it will include this rule.","enum":["New","Modified","Deleted","Applied","Expired"]},"ApiErrorResponse":{"type":"object","description":"Body returned with error responses.","required":["msg"],"properties":{"code":{"type":["string","null"],"description":"Machine-readable error code, returned for selected errors."},"msg":{"type":"string","description":"Human-readable error message."}}}}},"paths":{"/api/v1/acl/rule":{"post":{"tags":["ACL"],"summary":"Create an ACL rule","operationId":"create_acl_rule","requestBody":{"description":"The rule starts working after `PUT /api/v1/acl/rule/apply`.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EditAclRule"}}},"required":true},"responses":{"201":{"description":"ACL rule created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiAclRule"}}}},"400":{"description":"Cannot use a modified alias in an ACL rule.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"401":{"description":"Session is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"403":{"description":"Requires admin privileges and an active enterprise license.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"422":{"description":"Invalid addresses, ports or protocols.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"500":{"description":"Unable to create ACL rule.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}}}}}}}
```