Create Action Approval Rule

curl -X POST https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "operation": "DELETE_BACKUP_POLICY",
  "approvalWindowHours": 1,
  "executionWindowHours": 1
}'

{
  "actionApprovalRule": {
    "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a30",
    "projectId": "7b1d4f2a-3c5e-4a6b-8d9e-1f2a3b4c5d6e",
    "operation": "DELETE_BACKUP_POLICY",
    "requiredApprovals": 2,
    "approvalWindowHours": 24,
    "executionWindowHours": 4,
    "description": "Require approval before deleting backup policies.",
    "resourceSelector": {
      "resourceSelectionMode": "CONDITIONAL",
      "resourceInclusionOverride": [
        "string"
      ],
      "resourceExclusionOverride": [
        "string"
      ],
      "expression": {
        "group": {
          "operator": "AND",
          "operands": [
            {
              "resourceType": {
                "operator": "IN",
                "resourceTypes": [
                  "AWS_EC2",
                  "AWS_RDS"
                ]
              }
            },
            {
              "environment": {
                "operator": "IN",
                "environments": [
                  "PROD",
                  "PROD_INTERNAL"
                ]
              }
            }
          ]
        },
        "resourceType": {
          "operator": "IN",
          "resourceTypes": [
            "AWS_EC2",
            "AWS_RDS"
          ]
        },
        "dataClasses": {
          "operator": "CONTAINS_ANY_OF",
          "dataClasses": [
            "PII",
            "PHI"
          ]
        },
        "environment": {
          "operator": "IN",
          "environments": [
            "PROD",
            "PROD_INTERNAL"
          ]
        },
        "apps": {
          "operator": "CONTAINS_ANY_OF",
          "apps": [
            "PostgreSQL",
            "MySQL"
          ]
        },
        "sensitivityAnnotations": {
          "operator": "IN",
          "sensitivityAnnotations": [
            "CONFIDENTIAL",
            "HIGH_RISK_CONFIDENTIAL"
          ]
        },
        "securityScanConclusion": {
          "operator": "CONTAINS_ANY_OF",
          "securityScanConclusions": [
            "MALWARE_DETECTED",
            "DATA_ANOMALY_DETECTED"
          ]
        },
        "cloudProvider": {
          "operator": "IN",
          "cloudProviders": [
            "AWS",
            "AZURE"
          ]
        },
        "accountId": {
          "operator": "IN",
          "accountIds": [
            "123456789012"
          ]
        },
        "sourceRegion": {
          "operator": "IN",
          "regions": [
            "us-east-1",
            "us-west-2"
          ]
        },
        "vpc": {
          "operator": "IN",
          "vpcs": [
            "vpc-387d190d",
            "vpc-0e2a61a6"
          ]
        },
        "subnets": {
          "operator": "CONTAINS_ANY_OF",
          "subnets": [
            "subnet-aa2c166e",
            "subnet-eb71c3a2"
          ]
        },
        "resourceGroupName": {
          "operator": "IN",
          "resourceGroupNames": [
            "prod-rg"
          ]
        },
        "encryptionType": {
          "operator": "CONTAINS_ANY_OF",
          "encryptionTypes": [
            "CUSTOMER_MANAGED_KEY"
          ]
        },
        "resourceName": {
          "operator": "CONTAINS",
          "resourceNames": [
            "db-server"
          ]
        },
        "resourceId": {
          "operator": "IN",
          "resourceIds": [
            "i-0b0f5b5ef75b1c009"
          ]
        },
        "tagKeys": {
          "operator": "CONTAINS_ANY_OF",
          "tagKeys": [
            "environment",
            "app"
          ]
        },
        "tagKeyValues": {
          "operator": "CONTAINS_ANY_OF",
          "tagKeyValues": [
            {
              "key": "environment",
              "value": "staging"
            }
          ]
        }
      }
    },
    "approverIdpId": "018f3b3f-4818-7c31-a0d7-2e02f2f83a31",
    "approverProviderGroupId": "platform-admins",
    "exemptApiCredentials": false
  }
}

Creates an action approval rule.

Authentication

AuthorizationBearer

Bearer authentication of the form Bearer <token>, where token is your auth token.

Path parameters

projectIdstringRequiredformat: "uuid"

ID of the project the action approval rule is in. You can get your project ID from the API Credentials page in your global management console.

Request

This endpoint expects an object.

operationenumRequired

Action that requires approval under the rule.

Allowed values:

approvalWindowHoursintegerRequired1-168

Number of hours the request stays open for approval. If the approvals aren't received before the end of the window, the request expires.

executionWindowHoursintegerRequired1-168

Number of hours after approval the requester can execute the action. If the requester doesn't execute before the end of the window, the request expires.

requiredApprovalsintegerOptional>=1Defaults to 1

Number of approvals required before the action can be executed.

descriptionstringOptional

Description explaining the purpose of the rule.

resourceSelectorobjectOptional

Selector determining which resources the rule applies to.

approverIdpIdstringOptionalformat: "uuid"

Eon-assigned ID of the identity provider the approver’s SAML group belongs to. Used in combination with approverProviderGroupId.

approverProviderGroupIdstringOptional

Identity-provider-assigned ID of the approver group. Used in combination with approverIdpId.

exemptApiCredentialsbooleanOptional

Whether API clients bypass the rule or are bound by it.

When true, API clients bypass the rule and don’t require approval to perform the action. When false, API clients are bound like any other user and must get the required approvals.

Response

Action approval rule created.

actionApprovalRuleobject

Created action approval rule.

Errors

400

Bad Request Error