Access and data rules
Access and data rules control which applications and URLs a user can reach, and how data moves once they are there: login controls, data controls (clipboard, file transfer, watermarking, and more), and Enterprise Data Loss Prevention (DLP). This is the richest policy type. See Policy overview for the shared concepts.
The Policy APIs are in Beta and are enabled by request. Contact your account team to join the Beta program.
Base path: /seb-api/v1/policy/access-and-data.
Mandatory fields
| Field | Required | Notes |
|---|---|---|
name | Yes | 1-350 characters |
mode | Yes | active or disabled |
applications | Yes | Which applications/URLs the rule targets. At least one segment must be configured. |
access | Yes | The access decision: { "action": "allow" | "block" | "prompt" | "redirect" }, plus optional access controls. |
tracking | Yes | Logging and evidence. Must include logLevel (off, anonymized, on, enhanced). |
scope | No (recommended) | Who the rule applies to. Omitting it applies to everyone. |
loginControls | No | Login behavior, keyed by type (formLogin, passkeyLogin, idpLogin, socialLogin). |
dataControls | No | Data protection controls. When sent, it must contain at least one non-null control. |
dlp | No | Enterprise DLP settings: profileId, bypassProfileValidation, detectionConfidence. Replaces the deprecated dataControls.dlpProfileId. |
Structure
The building blocks of every access and data rule:
| Block | Purpose |
|---|---|
applications | Defines the target: saas, private, nonWeb, localDesktop, and applicationGroups segments, each with an accessMode of none, any, or specific. |
access | The decision (allow/block/prompt/redirect) plus access controls like label, requireAuthentication, and openInPrismaBrowser. |
loginControls | How users may authenticate to the target application (form login, passkeys, IdP, social). |
dataControls | What users may do with data: clipboard, file upload/download, watermarking, printing, screenshots, web page interaction, and request identification (userAgent, customHttpHeader). |
dlp | The Enterprise DLP data profile the rule scans content against. |
A complete rule with all five application segments, the access decision, login controls, data controls, and tracking:
{
"name": "Finance SaaS - protected access",
"mode": "active",
"scope": { "users": { "userGroups": ["0UGEXAMPLEFINANCEXXXXXXXXXX"] } },
"applications": {
"saas": {
"accessMode": "specific",
"specific": { "applicationIds": ["0APEXAMPLEWORKDAYXXXXXXXXXX"] }
},
"private": { "accessMode": "none" },
"nonWeb": { "accessMode": "none" },
"localDesktop": { "accessMode": "none" },
"applicationGroups": { "accessMode": "none" }
},
"access": { "action": "allow" },
"loginControls": {
"formLogin": {
"action": "allowSpecificDomains",
"domains": ["@company.com"],
"mfaRequired": true
}
},
"dataControls": {
"clipboard": {
"dataIn": { "active": true, "action": "block" },
"dataOut": { "active": true, "action": "block" }
},
"fileProtection": { "fileDownload": { "action": "block" } }
},
"tracking": { "logLevel": "on", "sessionRecording": false }
}
applicationGroups accepts only none or specific (there is no any). nonWeb accepts none, anyAdminDefined, or specific. The remaining three segments (saas, private, localDesktop) accept none, any, or specific.
Tenant restrictions by application
applications.tenantConditions.apps limits supported applications to your organization's accounts. Each key is an application name and holds the email domains that count as your tenant. A user signed in with an address outside those domains is treated as a personal or third-party account.
"tenantConditions": {
"apps": {
"zoom": { "domains": [ "example.com" ] },
"figma": { "domains": [ "example.com", "example.co.uk" ] }
}
}
| Key | Application |
|---|---|
airtable | Airtable |
bitbucket | Bitbucket |
bonusly | Bonusly |
box | Box |
concur | SAP Concur |
figma | Figma |
launchdarkly | LaunchDarkly |
linear | Linear |
lucid | Lucid |
mongodb | MongoDB |
newrelic | New Relic |
pagerduty | PagerDuty |
panopto | Panopto |
posthog | PostHog |
sentry | Sentry |
typeform | Typeform |
workday | Workday |
zendesk | Zendesk |
zoom | Zoom |
Each application takes up to 100 domains, and a rule accepts at most 1000 domains across all applications.
Create an access and data rule
POST /seb-api/v1/policy/access-and-data/rules
Show request and response
curl -sS -X POST "$PB_API_BASE/policy/access-and-data/rules" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Finance SaaS - protected access",
"mode": "active",
"scope": { "users": { "userGroups": ["0UGEXAMPLEFINANCEXXXXXXXXXX"] } },
"applications": {
"saas": { "accessMode": "specific", "specific": { "applicationIds": ["0APEXAMPLEWORKDAYXXXXXXXXXX"] } },
"private": { "accessMode": "none" },
"nonWeb": { "accessMode": "none" }
},
"access": { "action": "allow" },
"dataControls": {
"clipboard": { "dataIn": {"active": true, "action": "block"}, "dataOut": {"active": true, "action": "block"} }
},
"tracking": { "logLevel": "on", "sessionRecording": false }
}'
Response:
The resolved rule: the fields you sent, every server-side default filled in, and the new id.
Applications is required, and at least one segment must be set. Configure at least one of saas, private, nonWeb, localDesktop, or applicationGroups. Use accessMode: "any" for "all applications of this kind" or accessMode: "specific" with the matching IDs/URLs. See Applications.
Login and data controls
- Login controls (
loginControls) gate how users authenticate to the target application. See Manage login and data controls. - Data controls (
dataControls) protect data in the session. See Manage login and data controls. - The top-level
dlpobject links an Enterprise DLP data profile (dlp.profileId). See Set a DLP profile on a rule.
dataControls.dlpProfileId is deprecated. Use dlp.profileId. The same applies to dataControls.dlpProfile (now dlp.profile) and dataControls.bypassDlpProfileValidation (now dlp.bypassProfileValidation). The old locations still work during the deprecation window and will then be removed.
userAgent and customHttpHeader. Configure these controls under dataControls. They moved here from customization rules: a customization rule keeps and can still edit the ones it already has, but adding a new one there returns 400.
Controls are replaced whole on PATCH. A control you include replaces its previous body; omitted controls are preserved; null removes a control. There is no per-element delta inside a control.
Sections
Access-and-data sections are created with POST /seb-api/v1/policy/access-and-data/sections (only name is required) and ordered with the positions endpoints.
Examples
Expand an example to see the request, response, and notes.
Deny-all baseline
A catch-all rule that blocks all web access. Put it last (lowest priority) as a default-deny floor, then add higher-priority allow rules above it. Omitting scope applies it to everyone.
curl -sS -X POST "$PB_API_BASE/policy/access-and-data/rules" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Default deny - all web access",
"mode": "active",
"applications": {
"saas": { "accessMode": "any" },
"private": { "accessMode": "any" },
"nonWeb": { "accessMode": "anyAdminDefined" }
},
"access": { "action": "block" },
"tracking": { "logLevel": "on", "sessionRecording": false }
}'
Response (201):
The resolved rule: the fields you sent, every server-side default filled in, and the new id.
After creating it, move it to the bottom of the list with the positions endpoints.
Allow a specific application, but prompt the user first
Set access.action to prompt and configure access.userPrompt. Use warnAndAllow for a simple warning, or proceedWithReason to make the user type a justification. durationMinutes (a string enum, for example "240") controls how long their choice is remembered.
curl -sS -X POST "$PB_API_BASE/policy/access-and-data/rules" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Generative AI - allow with justification",
"mode": "active",
"applications": {
"saas": { "accessMode": "specific", "specific": { "applicationIds": ["0APEXAMPLEGENAIXXXXXXXXXXXX"] } }
},
"access": {
"action": "prompt",
"userPrompt": { "mode": "proceedWithReason", "durationMinutes": "240" }
},
"tracking": { "logLevel": "on", "sessionRecording": false }
}'
Response (201):
The resolved rule: the fields you sent, every server-side default filled in, and the new id.
Lock down a sensitive application
Allow one high-value application, but clamp the data controls: block clipboard in both directions, block downloads, and attach an Enterprise DLP profile. See Set a DLP profile on a rule for how to discover the profile ID.
curl -sS -X POST "$PB_API_BASE/policy/access-and-data/rules" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Workday - sensitive access",
"mode": "active",
"scope": { "users": { "userGroups": ["0UGEXAMPLEFINANCEXXXXXXXXXX"] } },
"applications": {
"saas": { "accessMode": "specific", "specific": { "applicationIds": ["0APEXAMPLEWORKDAYXXXXXXXXXX"] } }
},
"access": { "action": "allow" },
"dataControls": {
"clipboard": {
"dataIn": { "active": true, "action": "block" },
"dataOut": { "active": true, "action": "block" }
},
"fileProtection": {
"fileDownload": { "action": "block" }
}
},
"dlp": { "profileId": "11995044" },
"tracking": { "logLevel": "enhanced", "sessionRecording": false }
}'
Response (201):
The resolved rule: the fields you sent, every server-side default filled in, and the new id.
Business Applications group with DLP (two-service flow)
Scope a rule to an existing application group (for example your "Business Applications" group), then discover a DLP profile ID from the separate Enterprise DLP API and attach it.
Step 1: list DLP profiles (Enterprise DLP, a different host)
curl -sS "https://api.dlp.paloaltonetworks.com/v2/api/data-profiles?page=0&size=50" \
-H "Authorization: Bearer $PB_TOKEN"
The profile ID is content[].id:
{ "content": [ { "id": "11995044", "name": "PII - strict" } ] }
Step 2: attach it to a rule scoped to the application group
curl -sS -X POST "$PB_API_BASE/policy/access-and-data/rules" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "Business apps - DLP",
"mode": "active",
"applications": {
"applicationGroups": {
"accessMode": "specific",
"specific": { "applicationGroupIds": ["0AGEXAMPLEBUSINESSAPPSXXXXX"] }
}
},
"access": { "action": "allow" },
"dataControls": {
"fileProtection": { "fileUpload": { "action": "block" } }
},
"dlp": { "profileId": "11995044" },
"tracking": { "logLevel": "on", "sessionRecording": false }
}'
Response (201):
The resolved rule: the fields you sent, every server-side default filled in, and the new id.
Note: dlp.profileId needs at least one inline data control on the rule; a profile on its own returns 400. See Set a DLP profile on a rule.
File protection (block uploads and downloads)
fileProtection configures the download and upload directions independently. Each direction has its own action.
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dataControls": {
"fileProtection": {
"fileDownload": { "action": "block" },
"fileUpload": { "action": "block" }
}
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Note: to keep downloaded files usable only inside the Prisma Browser, set fileDownload.action to useInPrismaBrowserOnly; pair it with fileUpload.action: "blockOnlyProtected" so protected files cannot leave. (allowProtectedBetweenRuleApps is a legacy, read-only value: it may appear on pre-existing rules but is rejected on create/update.)
Clipboard only within the rule's applications
The clipboard control governs data crossing the boundary of the rule's applications. Block both directions so users can copy and paste within the protected applications, but cannot carry clipboard data in from, or out to, anything else.
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dataControls": {
"clipboard": {
"dataIn": { "active": true, "action": "block" },
"dataOut": { "active": true, "action": "block" }
}
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Set excludeOmnibox: true on a direction to leave the address bar out of the restriction.
Hide, disable, or mask page elements
webUserInteraction targets elements by CSS selector. Each selector takes an action: hide (the default), disable, or mask. selectors is required and non-empty when the control's action is enable.
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dataControls": {
"webUserInteraction": {
"action": "enable",
"selectors": [
{ "name": "Export button", "selector": "#export", "action": "disable" },
{ "name": "Salary column", "selector": ".salary", "action": "mask" }
]
}
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Identify Prisma Browser traffic with a header
Add a custom HTTP header, or a User-Agent component, to requests that match the rule, so an upstream proxy or the application can recognize them.
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dataControls": {
"customHttpHeader": { "mode": "custom", "customHeaderName": "X-Corp-Browser", "customHeaderValue": "prisma" },
"userAgent": { "mode": "custom", "additionalComponent": "CorpManaged" }
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }