Manage login and data controls
Access and data rules carry two control groups: loginControls (how users may authenticate to the target application) and dataControls (what they may do with data once inside, such as clipboard, file transfer, watermarking, and printing). This page shows how to set and update them from automation.
Use this when: you need to enforce or adjust login behavior or data protection on an existing access and data rule.
Prerequisites: a Super User service account and the environment variables from Getting started. Have an access and data rule's ID. New to this policy type? Read Access and data rules first.
export RULE_ID='0RLEXAMPLEACCESSRULEXXXXXXX'
Controls are replaced whole, never delta-patched. In a PATCH, a control you include fully replaces its previous body, omitted controls are preserved, and sending null removes a control. There is no per-element delta inside a control. Always send the complete control object you want.
Login controls
loginControls is keyed by control type:
| Key | Purpose |
|---|---|
formLogin | Username/password form login (allow, block, or restrict to domains; MFA; account shield) |
passkeyLogin | Passkey login (allow/block, optional MFA) |
idpLogin | Identity-provider (SSO and SAML) login, across the board or for specific provider domains |
socialLogin | Consumer social login (Google, Microsoft, Facebook, GitHub, X, LinkedIn, Apple), with googleAllowedDomains to keep corporate Google Workspace domains working |
For the settings each control accepts, see the Create an Access and Data rule reference.
Restrict form login to corporate domains:
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"loginControls": {
"formLogin": {
"action": "allowSpecificDomains",
"domains": ["@company.com"],
"mfaRequired": true
}
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Data controls
dataControls is keyed by control type. Common keys include clipboard, fileProtection, webpageWatermarking, screenshot, print, genAIPrompt, camera, and microphone. (For attaching an Enterprise Data Loss Prevention (DLP) profile, see Set a DLP profile on a rule.)
Block clipboard in and out, and enable watermarking:
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"dataControls": {
"clipboard": {
"dataIn": { "active": true, "action": "block" },
"dataOut": { "active": true, "action": "block" }
},
"webpageWatermarking": {
"action": "enable",
"settings": { "opacityPercentage": 25, "densityLevel": "standard" }
}
}
}'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Remove a control
Send the control key with null:
curl -sS -X PATCH "$PB_API_BASE/policy/access-and-data/rules/$RULE_ID" \
-H "Authorization: Bearer $PB_TOKEN" -H "Content-Type: application/json" \
-d '{ "dataControls": { "webpageWatermarking": null } }'
Response (200):
{ "id": "0RLEXAMPLEACCESSRULEXXXXXXX" }
Publish
Control edits land on the draft. Publish to enforce them:
curl -sS -X POST "$PB_API_BASE/configuration-management/draft/publish" \
-H "Authorization: Bearer $PB_TOKEN" -H "Content-Type: application/json" \
-d '{"description": "Tighten login and data controls"}'
Returns 201 when a new active version is created, or 409 with {"message": "No pending changes found in the current draft"} if the draft is empty.