> This page is for API.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.eon.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.eon.io/_mcp/server.

# List Action Approval Rules

POST https://%7Baccount-domain%7D.console.eon.io/api/v1/projects/{projectId}/action-approvals/rules/list
Content-Type: application/json

Retrieves a list of action approval rules for the specified project.

Reference: https://docs.eon.io/api/api-reference/access-management/action-approvals/action-approval-rules/list-action-approval-rules

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Request

### Path parameters

- `projectId` (string, required) — ID of the project whose action approval rules you want to retrieve. You can get your project ID from the [API Credentials](https://console.eon.io/global-management/api-credentials) page in your global management console.

### Query parameters

- `pageToken` (string, optional) — Cursor that points to the first record of the next page of results. Get this value from the previous response. To preserve the results in the same order, use the same sorting and filters in the first request as all subsequent requests.
- `pageSize` (integer, optional, default: 50) — Maximum number of items to return in the response.

### Body (application/json)

This endpoint expects a ListActionApprovalRulesRequest.

- `filters` (ListActionApprovalRulesRequestFilters, optional) — Filter conditions. If omitted, no filtering is applied.

## Response

### 200

Action approval rules retrieved.

- `actionApprovalRules` (list of ActionApprovalRule, required) — List of action approval rules.
- `totalCount` (integer, required) — Total number of action approval rules that matched the filter options.
- `nextPageToken` (string, optional) — Cursor that points to the first record of the next page of results. Pass this value in the next request.

## Errors

### 400 Bad Request Error

Invalid pagination parameters or operation filter.

- `error` (string, optional)

## Types

### ListActionApprovalRulesRequestFilters

Filter conditions. If omitted, no filtering is applied.

- `operation` (enum, optional) — Action that requires approval under the rule.
  - Allowed values: `ADD_RESTORE_ACCOUNT`, `CREATE_BACKUP_POLICY`, `RESTORE_RESOURCE`, `UPDATE_BACKUP_POLICY`, `DELETE_BACKUP_POLICY`

### ActionApprovalRule

Rule that determines the approval requirements for a sensitive action.

- `id` (string, required) — ID of the action approval rule.
- `projectId` (string, required) — ID of the project the action approval rule is in.
- `operation` (enum, required) — Action that requires approval under the rule.
  - Allowed values: `ADD_RESTORE_ACCOUNT`, `CREATE_BACKUP_POLICY`, `RESTORE_RESOURCE`, `UPDATE_BACKUP_POLICY`, `DELETE_BACKUP_POLICY`
- `requiredApprovals` (integer, required) — Number of approvals required before the action can be executed.
- `approvalWindowHours` (integer, required) — Number of hours the request stays open for approval before expiring.
- `executionWindowHours` (integer, required) — Number of hours after approval the approved action can be executed.
- `description` (string, optional) — Description explaining the purpose of the rule.
- `resourceSelector` (ActionApprovalRuleResourceSelector, optional) — Resource selector determining which resources the rule applies to.
- `approverIdpId` (string, optional, nullable) — Eon-assigned ID of the SAML identity provider the approver group belongs to. Used in combination with `approverProviderGroupId`.
- `approverProviderGroupId` (string, optional, nullable) — Identity-provider-assigned ID of the approver group. Used in combination with `approverIdpId`.
- `exemptApiCredentials` (boolean, optional) — Whether API clients bypass the rule or are bound by it. When `true`, API clients bypass the rule and don't require approval to perform the action. When `false`, API clients are bound like any other user and must get the required approvals.

### ActionApprovalRuleResourceSelector

Configuration that determines which entities the action approval rule applies to. If the rule applies to backup policies, `CONDITIONAL` selection is unavailable.

- `resourceSelectionMode` (enum, required) — Mode that determines how entities are selected for action approval. To protect all entities for the operation, set to `ALL`. To protect only specific entities, set to `NONE` and provide IDs in `resourceInclusionOverride`. To dynamically select matching cloud resources or snapshots, set to `CONDITIONAL` and provide conditions in `expression`.
  - Allowed values: `ALL`, `NONE`, `CONDITIONAL`
- `resourceInclusionOverride` (list of string, optional) — IDs of entities to protect, regardless of resource selection mode. When resource selection mode is `NONE`, only these resources are protected.
- `resourceExclusionOverride` (list of string, optional) — IDs of entities to exclude from protection, regardless of resource selection mode. When resource selection mode is `ALL`, all entities except these are protected.
- `expression` (ActionApprovalRuleExpression, optional) — Condition selecting the entities the rule applies to. Required when resource selection mode is `CONDITIONAL`. Ignored when resource selection mode is `ALL` or `NONE`. Can be combined with `resourceInclusionOverride` and `resourceExclusionOverride`.

### ActionApprovalRuleExpression

Conditional expression used to determine which resources are targeted by an action approval rule. Only one of the expressions below can be used. For multiple conditions using `AND` or `OR` logic, group expressions with `group`. You can nest multiple groups to create more complex expressions.

- `group` (ActionApprovalRuleGroupCondition, optional) — Group of expressions evaluated using the logical operator specified in `operator`. Each operand can be either a single expression or a nested `group`.
- `resourceType` (ResourceTypeCondition, optional)
- `dataClasses` (DataClassesCondition, optional)
- `environment` (EnvironmentCondition, optional)
- `apps` (AppsCondition, optional)
- `sensitivityAnnotations` (SensitivityAnnotationsCondition, optional)
- `securityScanConclusion` (SecurityScanConclusionCondition, optional) — Security-scan conclusion condition. Valid only for snapshot-targeted operations.
- `cloudProvider` (CloudProviderCondition, optional)
- `accountId` (AccountIdCondition, optional)
- `sourceRegion` (RegionCondition, optional)
- `vpc` (VpcCondition, optional)
- `subnets` (SubnetsCondition, optional)
- `resourceGroupName` (ResourceGroupNameCondition, optional)
- `encryptionType` (EncryptionTypeCondition, optional)
- `resourceName` (ResourceNameCondition, optional)
- `resourceId` (ResourceIdCondition, optional)
- `tagKeys` (TagKeysCondition, optional)
- `tagKeyValues` (TagKeyValuesCondition, optional)

### ActionApprovalRuleGroupCondition

Group of expressions evaluated using the logical operator specified in `operator`. Each operand can be either a single expression or a nested `group`.

- `operator` (enum, required) — Logical operator used to combine the operands.
  - Allowed values: `AND`, `OR`, `UNSPECIFIED`
- `operands` (list of ActionApprovalRuleExpression, required) — List of expressions to evaluate using the logical operator specified in `operator`. Each item in the list can be either a single expression or a nested `group` expression.

### ResourceTypeCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceTypes` (list of enum, required) — Resource types to evaluate. `RESOURCE_TYPE_UNSPECIFIED` is supported only in responses.
  - Allowed values: `AWS_EC2`, `AWS_RDS`, `AWS_S3`, `AWS_EFS`, `AWS_FSX`, `AWS_EKS_NAMESPACE`, `AWS_DYNAMO_DB`, `AZURE_VIRTUAL_MACHINE`, `AZURE_FILE_SHARE`, `AZURE_STORAGE_ACCOUNT`, `AZURE_DISK`, `AZURE_SQL_DATABASE`, `AZURE_SQL_MANAGED_INSTANCE`, `AZURE_SQL_VIRTUAL_MACHINE`, `AZURE_MYSQL`, `AZURE_POSTGRESQL`, `AZURE_COSMOSDB_MONGODB`, `AZURE_COSMOSDB_NOSQL`, `ATLAS_MONGODB_CLUSTER`, `GCP_COMPUTE_ENGINE_INSTANCE`, `GCP_CLOUD_SQL_INSTANCE`, `GCP_CLOUD_STORAGE_BUCKET`, `RESOURCE_TYPE_UNSPECIFIED`

### DataClassesCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `dataClasses` (list of string, required) — Data classes to evaluate.

### EnvironmentCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `environments` (list of enum, required) — Environments to evaluate.
  - Allowed values: `PROD`, `PROD_INTERNAL`, `STAGE`, `ENVIRONMENT_UNSPECIFIED`

### AppsCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `apps` (list of string, required) — Apps to evaluate.

### SensitivityAnnotationsCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `sensitivityAnnotations` (list of enum, required) — Sensitivity levels to evaluate.
  - Allowed values: `PUBLIC`, `INTERNAL`, `CONFIDENTIAL`, `HIGH_RISK_CONFIDENTIAL`

### SecurityScanConclusionCondition

Security-scan conclusion condition. Valid only for snapshot-targeted operations.

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `securityScanConclusions` (list of enum, required) — Security scan conclusions to evaluate.
  - Allowed values: `CLEAN`, `HIGH_CHANCE_FOR_RANSOMWARE`, `DATA_ANOMALY_DETECTED`, `MALWARE_DETECTED`, `AI_DATA_RISK_DETECTED`, `DATA_EXPOSURE_RISK_DETECTED`, `VULNERABLE_APPLICATION_DETECTED`

### CloudProviderCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `cloudProviders` (list of enum, required) — Cloud providers to evaluate.
  - Allowed values: `AWS`, `AZURE`, `GCP`, `MONGO_ATLAS`, `PROVIDER_UNSPECIFIED`

### AccountIdCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `accountIds` (list of string, required) — Cloud-provider-assigned account IDs to evaluate.

### RegionCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `regions` (list of string, required) — Source regions to evaluate.

### VpcCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `vpcs` (list of string, required) — Cloud-provider-assigned VPC IDs to evaluate.

### SubnetsCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `subnets` (list of string, required) — Cloud-provider-assigned subnet IDs to evaluate.

### ResourceGroupNameCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceGroupNames` (list of string, required) — Resource group names to evaluate.

### EncryptionTypeCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `encryptionTypes` (list of enum, required) — Encryption types to evaluate.
  - Allowed values: `ENCRYPTION_TYPE_UNSPECIFIED`, `UNENCRYPTED`, `PROVIDER_MANAGED_KEY`, `CUSTOMER_MANAGED_KEY`

### ResourceNameCondition

- `operator` (enum, required) — Operator that evaluates string values. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `CONTAINS`, `NOT_CONTAINS`, `STARTS_WITH`, `NOT_STARTS_WITH`, `ENDS_WITH`, `NOT_ENDS_WITH`, `UNSPECIFIED`
- `resourceNames` (list of string, required) — Resource names to evaluate.

### ResourceIdCondition

- `operator` (enum, required) — Operator that evaluates whether the value is in the list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `IN`, `NOT_IN`, `UNSPECIFIED`
- `resourceIds` (list of string, required) — Cloud-provider-assigned resource IDs to evaluate.

### TagKeysCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `tagKeys` (list of string, required) — Tag keys to evaluate.

### TagKeyValuesCondition

- `operator` (enum, required) — Operator that evaluates whether the original list contains any, all, or none of the values in this list. `UNSPECIFIED` is supported only in responses.
  - Allowed values: `CONTAINS_ANY_OF`, `CONTAINS_NONE_OF`, `CONTAINS_ALL_OF`, `UNSPECIFIED`
- `tagKeyValues` (list of TagKeyValue, required) — Tag key-value pairs to evaluate.

### TagKeyValue

- `key` (string, required) — Tag key.
- `value` (string, optional) — Tag value.

## Examples

**Request**

```json
{}
```

**Response**

```json
{
  "actionApprovalRules": [
    {
      "id": "018f3b3f-4818-7c31-a0d7-2e02f2f83a30",
      "projectId": "7b1d4f2a-3c5e-4a6b-8d9e-1f2a3b4c5d6e",
      "operation": "DELETE_BACKUP_POLICY",
      "requiredApprovals": 2,
      "approvalWindowHours": 24,
      "executionWindowHours": 4,
      "description": "Require approval before deleting backup policies.",
      "resourceSelector": {
        "resourceSelectionMode": "CONDITIONAL",
        "resourceInclusionOverride": [
          "string"
        ],
        "resourceExclusionOverride": [
          "string"
        ],
        "expression": {
          "group": {
            "operator": "AND",
            "operands": [
              {
                "resourceType": {
                  "operator": "IN",
                  "resourceTypes": [
                    "AWS_EC2",
                    "AWS_RDS"
                  ]
                }
              },
              {
                "environment": {
                  "operator": "IN",
                  "environments": [
                    "PROD",
                    "PROD_INTERNAL"
                  ]
                }
              }
            ]
          },
          "resourceType": {
            "operator": "IN",
            "resourceTypes": [
              "AWS_EC2",
              "AWS_RDS"
            ]
          },
          "dataClasses": {
            "operator": "CONTAINS_ANY_OF",
            "dataClasses": [
              "PII",
              "PHI"
            ]
          },
          "environment": {
            "operator": "IN",
            "environments": [
              "PROD",
              "PROD_INTERNAL"
            ]
          },
          "apps": {
            "operator": "CONTAINS_ANY_OF",
            "apps": [
              "PostgreSQL",
              "MySQL"
            ]
          },
          "sensitivityAnnotations": {
            "operator": "IN",
            "sensitivityAnnotations": [
              "CONFIDENTIAL",
              "HIGH_RISK_CONFIDENTIAL"
            ]
          },
          "securityScanConclusion": {
            "operator": "CONTAINS_ANY_OF",
            "securityScanConclusions": [
              "MALWARE_DETECTED",
              "DATA_ANOMALY_DETECTED"
            ]
          },
          "cloudProvider": {
            "operator": "IN",
            "cloudProviders": [
              "AWS",
              "AZURE"
            ]
          },
          "accountId": {
            "operator": "IN",
            "accountIds": [
              "123456789012"
            ]
          },
          "sourceRegion": {
            "operator": "IN",
            "regions": [
              "us-east-1",
              "us-west-2"
            ]
          },
          "vpc": {
            "operator": "IN",
            "vpcs": [
              "vpc-387d190d",
              "vpc-0e2a61a6"
            ]
          },
          "subnets": {
            "operator": "CONTAINS_ANY_OF",
            "subnets": [
              "subnet-aa2c166e",
              "subnet-eb71c3a2"
            ]
          },
          "resourceGroupName": {
            "operator": "IN",
            "resourceGroupNames": [
              "prod-rg"
            ]
          },
          "encryptionType": {
            "operator": "CONTAINS_ANY_OF",
            "encryptionTypes": [
              "CUSTOMER_MANAGED_KEY"
            ]
          },
          "resourceName": {
            "operator": "CONTAINS",
            "resourceNames": [
              "db-server"
            ]
          },
          "resourceId": {
            "operator": "IN",
            "resourceIds": [
              "i-0b0f5b5ef75b1c009"
            ]
          },
          "tagKeys": {
            "operator": "CONTAINS_ANY_OF",
            "tagKeys": [
              "environment",
              "app"
            ]
          },
          "tagKeyValues": {
            "operator": "CONTAINS_ANY_OF",
            "tagKeyValues": [
              {
                "key": "environment",
                "value": "staging"
              }
            ]
          }
        }
      },
      "approverIdpId": "018f3b3f-4818-7c31-a0d7-2e02f2f83a31",
      "approverProviderGroupId": "platform-admins",
      "exemptApiCredentials": false
    }
  ],
  "totalCount": 1,
  "nextPageToken": "string"
}
```

**SDK Code**

```python
import requests

url = "https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules/list"

querystring = {"pageSize":"10"}

payload = {}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers, params=querystring)

print(response.json())
```

```javascript
const url = 'https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules/list?pageSize=10';
const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://{account-domain}.console.eon.io/api/v1/projects/733888d8-2573-5f9a-b81d-21f051d24fda/action-approvals/rules/list?pageSize=10")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();
```