> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# Create Action Approval Rule

POST https://%7Baccount-domain%7D.console.eon.io/api/v1/projects/{projectId}/action-approvals/rules
Content-Type: application/json

Creates an action approval rule.

Reference: https://docs.eon.io/api/api-reference/access-management/action-approvals/action-approval-rules/create-action-approval-rule

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Path parameters

- `projectId` (string, required) — ID of the project the action approval rule is in. You can get your project ID from the [API Credentials](https://console.eon.io/global-management/api-credentials) page in your global management console.

### Body (application/json)

This endpoint expects a CreateActionApprovalRuleRequest.

- `operation` (enum, required) — Action that requires approval under the rule.
  - Allowed values: `ADD_RESTORE_ACCOUNT`, `CREATE_BACKUP_POLICY`, `RESTORE_RESOURCE`, `UPDATE_BACKUP_POLICY`, `DELETE_BACKUP_POLICY`
- `approvalWindowHours` (integer, required) — Number of hours the request stays open for approval. If the approvals aren't received before the end of the window, the request expires.
- `executionWindowHours` (integer, required) — Number of hours after approval the requester can execute the action. If the requester doesn't execute before the end of the window, the request expires.
- `requiredApprovals` (integer, optional, default: 1) — Number of approvals required before the action can be executed.
- `description` (string, optional) — Description explaining the purpose of the rule.
- `resourceSelector` (ActionApprovalRuleResourceSelector, optional) — Selector determining which resources the rule applies to.
- `approverIdpId` (string, optional) — Eon-assigned ID of the identity provider the approver's SAML group belongs to. Used in combination with `approverProviderGroupId`.
- `approverProviderGroupId` (string, optional) — Identity-provider-assigned ID of the approver group. Used in combination with `approverIdpId`.
- `exemptApiCredentials` (boolean, optional) — Whether API clients bypass the rule or are bound by it. When `true`, API clients bypass the rule and don't require approval to perform the action. When `false`, API clients are bound like any other user and must get the required approvals.

## Response

### 201

Action approval rule created.

- `actionApprovalRule` (ActionApprovalRule, required) — Created action approval rule.

## Errors

### 400 Bad Request Error

Invalid action approval rule configuration.

- `error` (string, optional)

## Types

### ActionApprovalRuleResourceSelector

Configuration that determines which entities the action approval rule applies to. If the rule applies to backup policies, `CONDITIONAL` selection is unavailable.

- `resourceSelectionMode` (enum, required) — Mode that determines how entities are selected for action approval. To protect all entities for the operation, set to `ALL`. To protect only specific entities, set to `NONE` and provide IDs in `resourceInclusionOverride`. To dynamically select matching cloud resources or snapshots, set to `CONDITIONAL` and provide conditions in `expression`.
  - Allowed values: `ALL`, `NONE`, `CONDITIONAL`
- `resourceInclusionOverride` (list of string, optional) — IDs of entities to protect, regardless of resource selection mode. When resource selection mode is `NONE`, only these resources are protected.
- `resourceExclusionOverride` (list of string, optional) — IDs of entities to exclude from protection, regardless of resource selection mode. When resource selection mode is `ALL`, all entities except these are protected.
- `expression` (ActionApprovalRuleExpression, optional) — Condition selecting the entities the rule applies to. Required when resource selection mode is `CONDITIONAL`. Ignored when resource selection mode is `ALL` or `NONE`. Can be combined with `resourceInclusionOverride` and `resourceExclusionOverride`.

### ActionApprovalRule

Rule that determines the approval requirements for a sensitive action.

- `id` (string, required) — ID of the action approval rule.
- `projectId` (string, required) — ID of the project the action approval rule is in.
- `operation` (enum, required) — Action that requires approval under the rule.
  - Allowed values: `ADD_RESTORE_ACCOUNT`, `CREATE_BACKUP_POLICY`, `RESTORE_RESOURCE`, `UPDATE_BACKUP_POLICY`, `DELETE_BACKUP_POLICY`
- `requiredApprovals` (integer, required) — Number of approvals required before the action can be executed.
- `approvalWindowHours` (integer, required) — Number of hours the request stays open for approval before expiring.
- `executionWindowHours` (integer, required) — Number of hours after approval the approved action can be executed.
- `description` (string, optional) — Description explaining the purpose of the rule.
- `resourceSelector` (ActionApprovalRuleResourceSelector, optional) — Resource selector determining which resources the rule applies to.
- `approverIdpId` (string, optional, nullable) — Eon-assigned ID of the SAML identity provider the approver group belongs to. Used in combination with `approverProviderGroupId`.
- `approverProviderGroupId` (string, optional, nullable) — Identity-provider-assigned ID of the approver group. Used in combination with `approverIdpId`.
- `exemptApiCredentials` (boolean, optional) — Whether API clients bypass the rule or are bound by it. When `true`, API clients bypass the rule and don't require approval to perform the action. When `false`, API clients are bound like any other user and must get the required approvals.

### ActionApprovalRuleExpression

Conditional expression used to determine which resources are targeted by an action approval rule. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions.

- `group` (ActionApprovalRuleGroupCondition, optional) — Group of expressions evaluated using the logical operator specified in `operator`. Each operand can be either a single expression or a nested `group`.
- `resourceType` (ResourceTypeCondition, optional)
- `dataClasses` (DataClassesCondition, optional)
- `environment` (EnvironmentCondition, optional)
- `apps` (AppsCondition, optional)
- `sensitivityAnnotations` (SensitivityAnnotationsCondition, optional)
- `securityScanConclusion` (SecurityScanConclusionCondition, optional) — Security-scan conclusion condition. Valid only for snapshot-targeted operations.
- `cloudProvider` (CloudProviderCondition, optional)
- `accountId` (AccountIdCondition, optional)
- `sourceRegion` (RegionCondition, optional)
- `vpc` (VpcCondition, optional)
- `subnets` (SubnetsCondition, optional)
- `resourceGroupName` (ResourceGroupNameCondition, optional)
- `encryptionType` (EncryptionTypeCondition, optional)
- `resourceName` (ResourceNameCondition, optional)
- `resourceId` (ResourceIdCondition, optional)
- `tagKeys` (TagKeysCondition, optional)
- `tagKeyValues` (TagKeyValuesCondition, optional)

### ActionApprovalRuleGroupCondition

Group of expressions evaluated using the logical operator specified in `operator`. Each operand can be either a single expression or a nested `group`.

- `operator` (enum, required) — Logical operator used to combine the operands.
  - Allowed values: `AND`, `OR`, `UNSPECIFIED`
- `operands` (list of ActionApprovalRuleExpression, required) — List of expressions to evaluate using the logical operator specified in `operator`. Each item in the list can be either a single expression or a nested `group` expression.

### ResourceTypeCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceTypes` (list of enum, required) — Resource types to evaluate. `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses.
  - Allowed values: `AWS_EC2`, `AWS_RDS`, `AWS_S3`, `AWS_EFS`, `AWS_FSX`, `AWS_EKS_NAMESPACE`, `AWS_DYNAMO_DB`, `AZURE_VIRTUAL_MACHINE`, `AZURE_FILE_SHARE`, `AZURE_STORAGE_ACCOUNT`, `AZURE_DISK`, `AZURE_SQL_DATABASE`, `AZURE_SQL_MANAGED_INSTANCE`, `AZURE_SQL_VIRTUAL_MACHINE`, `AZURE_MYSQL`, `AZURE_POSTGRESQL`, `AZURE_COSMOSDB_MONGODB`, `AZURE_COSMOSDB_NOSQL`, `ATLAS_MONGODB_CLUSTER`, `GCP_COMPUTE_ENGINE_INSTANCE`, `GCP_CLOUD_SQL_INSTANCE`, `GCP_CLOUD_STORAGE_BUCKET`, `RESOURCE_TYPE_UNSPECIFIED`

### DataClassesCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `dataClasses` (list of string, required) — Data classes to evaluate.

### EnvironmentCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `environments` (list of enum, required) — Environments to evaluate.
  - Allowed values: `PROD`, `PROD_INTERNAL`, `STAGE`, `ENVIRONMENT_UNSPECIFIED`

### AppsCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `apps` (list of string, required) — Apps to evaluate.

### SensitivityAnnotationsCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `sensitivityAnnotations` (list of enum, required) — Sensitivity levels to evaluate.
  - Allowed values: `PUBLIC`, `INTERNAL`, `CONFIDENTIAL`, `HIGH_RISK_CONFIDENTIAL`

### SecurityScanConclusionCondition

Security-scan conclusion condition. Valid only for snapshot-targeted operations.

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `securityScanConclusions` (list of enum, required) — Security scan conclusions to evaluate.
  - Allowed values: `CLEAN`, `HIGH_CHANCE_FOR_RANSOMWARE`, `DATA_ANOMALY_DETECTED`, `MALWARE_DETECTED`, `AI_DATA_RISK_DETECTED`, `DATA_EXPOSURE_RISK_DETECTED`, `VULNERABLE_APPLICATION_DETECTED`

### CloudProviderCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `cloudProviders` (list of enum, required) — Cloud providers to evaluate.
  - Allowed values: `AWS`, `AZURE`, `GCP`, `MONGO_ATLAS`, `PROVIDER_UNSPECIFIED`

### AccountIdCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `accountIds` (list of string, required) — Cloud-provider-assigned account IDs to evaluate.

### RegionCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `regions` (list of string, required) — Source regions to evaluate.

### VpcCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `vpcs` (list of string, required) — Cloud-provider-assigned VPC IDs to evaluate.

### SubnetsCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `subnets` (list of string, required) — Cloud-provider-assigned subnet IDs to evaluate.

### ResourceGroupNameCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceGroupNames` (list of string, required) — Resource group names to evaluate.

### EncryptionTypeCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `encryptionTypes` (list of enum, required) — Encryption types to evaluate.
  - Allowed values: `ENCRYPTION_TYPE_UNSPECIFIED`, `UNENCRYPTED`, `PROVIDER_MANAGED_KEY`, `CUSTOMER_MANAGED_KEY`

### ResourceNameCondition

- `operator` (enum, required) — Operator that evaluates string values. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `CONTAINS`, `NOT_CONTAINS`, `STARTS_WITH`, `NOT_STARTS_WITH`, `ENDS_WITH`, `NOT_ENDS_WITH`, `UNSPECIFIED`
- `resourceNames` (list of string, required) — Resource names to evaluate.

### ResourceIdCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceIds` (list of string, required) — Cloud-provider-assigned resource IDs to evaluate.

### TagKeysCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `tagKeys` (list of string, required) — Tag keys to evaluate.

### TagKeyValuesCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `tagKeyValues` (list of TagKeyValue, required) — Tag key-value pairs to evaluate.

### TagKeyValue

- `key` (string, required) — Tag key.
- `value` (string, optional) — Tag value.

## Examples

**Request**

```json
{
  "operation": "DELETE_BACKUP_POLICY",
  "approvalWindowHours": 1,
  "executionWindowHours": 1
}
```

**Response**

```json
{
  "actionApprovalRule": {
    "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a30",
    "projectId": "7b1d4f2a-3c5e-4a6b-8d9e-1f2a3b4c5d6e",
    "operation": "DELETE_BACKUP_POLICY",
    "requiredApprovals": 2,
    "approvalWindowHours": 24,
    "executionWindowHours": 4,
    "description": "Require approval before deleting backup policies.",
    "resourceSelector": {
      "resourceSelectionMode": "CONDITIONAL",
      "resourceInclusionOverride": [
        "string"
      ],
      "resourceExclusionOverride": [
        "string"
      ],
      "expression": {
        "group": {
          "operator": "AND",
          "operands": [
            {
              "resourceType": {
                "operator": "IN",
                "resourceTypes": [
                  "AWS_EC2",
                  "AWS_RDS"
                ]
              }
            },
            {
              "environment": {
                "operator": "IN",
                "environments": [
                  "PROD",
                  "PROD_INTERNAL"
                ]
              }
            }
          ]
        },
        "resourceType": {
          "operator": "IN",
          "resourceTypes": [
            "AWS_EC2",
            "AWS_RDS"
          ]
        },
        "dataClasses": {
          "operator": "CONTAINS_ANY_OF",
          "dataClasses": [
            "PII",
            "PHI"
          ]
        },
        "environment": {
          "operator": "IN",
          "environments": [
            "PROD",
            "PROD_INTERNAL"
          ]
        },
        "apps": {
          "operator": "CONTAINS_ANY_OF",
          "apps": [
            "PostgreSQL",
            "MySQL"
          ]
        },
        "sensitivityAnnotations": {
          "operator": "IN",
          "sensitivityAnnotations": [
            "CONFIDENTIAL",
            "HIGH_RISK_CONFIDENTIAL"
          ]
        },
        "securityScanConclusion": {
          "operator": "CONTAINS_ANY_OF",
          "securityScanConclusions": [
            "MALWARE_DETECTED",
            "DATA_ANOMALY_DETECTED"
          ]
        },
        "cloudProvider": {
          "operator": "IN",
          "cloudProviders": [
            "AWS",
            "AZURE"
          ]
        },
        "accountId": {
          "operator": "IN",
          "accountIds": [
            "123456789012"
          ]
        },
        "sourceRegion": {
          "operator": "IN",
          "regions": [
            "us-east-1",
            "us-west-2"
          ]
        },
        "vpc": {
          "operator": "IN",
          "vpcs": [
            "vpc-387d190d",
            "vpc-0e2a61a6"
          ]
        },
        "subnets": {
          "operator": "CONTAINS_ANY_OF",
          "subnets": [
            "subnet-aa2c166e",
            "subnet-eb71c3a2"
          ]
        },
        "resourceGroupName": {
          "operator": "IN",
          "resourceGroupNames": [
            "prod-rg"
          ]
        },
        "encryptionType": {
          "operator": "CONTAINS_ANY_OF",
          "encryptionTypes": [
            "CUSTOMER_MANAGED_KEY"
          ]
        },
        "resourceName": {
          "operator": "CONTAINS",
          "resourceNames": [
            "db-server"
          ]
        },
        "resourceId": {
          "operator": "IN",
          "resourceIds": [
            "i-0b0f5b5ef75b1c009"
          ]
        },
        "tagKeys": {
          "operator": "CONTAINS_ANY_OF",
          "tagKeys": [
            "environment",
            "app"
          ]
        },
        "tagKeyValues": {
          "operator": "CONTAINS_ANY_OF",
          "tagKeyValues": [
            {
              "key": "environment",
              "value": "staging"
            }
          ]
        }
      }
    },
    "approverIdpId": "018f3b3f-4818-7c31-a0d7-2e02f2f83a31",
    "approverProviderGroupId": "platform-admins",
    "exemptApiCredentials": false
  }
}
```

**SDK Code**

```python
import requests

url = "https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules"

payload = {
    "operation": "DELETE_BACKUP_POLICY",
    "approvalWindowHours": 1,
    "executionWindowHours": 1
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"operation":"DELETE_BACKUP_POLICY","approvalWindowHours":1,"executionWindowHours":1}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"operation\": \"DELETE_BACKUP_POLICY\",\n  \"approvalWindowHours\": 1,\n  \"executionWindowHours\": 1\n}")
  .asString();
```