> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to configure Tenant Access Control List (ACL) rules with the Auth0 Management API.

# Configure Rules

export const AuthCodeBlock = ({filename, icon, language, highlight, children}) => {
  const [processedChildren, setProcessedChildren] = useState(children);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      unsubscribe = window.autorun(() => {
        let processedChildren = children;
        for (const [key, value] of window.rootStore.variableStore.values.entries()) {
          processedChildren = processedChildren.replace(new RegExp(key, "g"), value);
        }
        setProcessedChildren(processedChildren);
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  return <CodeBlock filename={filename} icon={icon} language={language} lines highlight={highlight}>
      {processedChildren}
    </CodeBlock>;
};

export const codeSamples = {
  "Examples": [{
    title: "Block all traffic from a given country",
    content: <>Here's an example of a Tenant ACL rule that blocks all incoming traffic from China.</>,
    samples: [{
      title: "Management API",
      language: "json",
      content: <>To create a Tenant ACL rule with the Management API:
            <ol>
              <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>create:network_acls</code> scope.</li>
              <li>Call the Management API <a href="/docs/api/management/v2/network-acls/post-network-acls">Create access control list</a> endpoint with the following body:</li>
            </ol>
          </>,
      code: `{
  "description": "Block all traffic from China",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": ["CN"]
    },
    "scope": "authentication"
  }
}`
    }, {
      title: "Go SDK",
      language: "go",
      code: `package main

import (
    "context"
    "log"

    "github.com/auth0/go-auth0"
    "github.com/auth0/go-auth0/management"
)

func main() {
    mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
    if err != nil {
      log.Fatal(err)
    }

    networkACL := &management.NetworkACL{
        Description: auth0.String("Block all traffic from China"),
        Active:      auth0.Bool(true),
        Priority:    auth0.Int(1),
        Rule: &management.NetworkACLRule{
            Action: &management.NetworkACLRuleAction{
                Block: auth0.Bool(true),
            },
            Match: &management.NetworkACLRuleMatch{
                GeoCountryCodes: &[]string{"CN"},
            },
            Scope: auth0.String("authentication"),
        },
    }

    err = mgmt.NetworkACL.Create(context.Background(), networkACL)
        if err != nil {
            log.Fatal(err)
        }
    log.Println("Network ACL has been created")
}`
    }, {
      title: "Node SDK",
      language: "javascript",
      code: `const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Block all traffic from China",
  active: true,
  priority: 1,
  rule: {
    action: {
      block: true
    },
    match: {
      geo_country_codes: ["CN"]
    },
    scope: "authentication"
  }
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);`
    }, {
      title: "Terraform",
      language: "terraform",
      code: `resource "auth0_network_acl" "block_traffic_acl" {
    description = "Block all traffic from China"
    active = true
    priority = 1
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["CN"]
        }
        scope = "authentication"
    }
}`
    }, {
      title: "Deploy CLI",
      language: "toml",
      code: `networkACLs:
  - description: Block all traffic from China
    active: true
    priority: 1
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - CN
      scope: authentication`
    }, {
      title: "Auth0 CLI",
      language: "bash",
      code: `auth0 network-acl create \\
--description "Block all traffic from China" \\
--priority 1 \\
--active true \\
--rule '{"action":{"block":true},"match":{"geo_country_codes":["CN"]},"scope":"authentication"}'`
    }]
  }],
  "Toggle monitoring mode for a rule": [{
    title: "Management API",
    language: "json",
    content: <>To enable monitoring mode for a Tenant ACL rule with the Management API:
        <ol>
          <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>update:network_acls</code> scope.</li>
          <li>Call the Management API <a href="/docs/api/management/v2/network-acls/patch-network-acls-by-id">Partial update for an access control list</a> endpoint with the following body:</li>
        </ol></>,
    code: `{
  "rule": {
    "action": {
      "log": true
    },
    "scope": "authentication"
  }
}`
  }, {
    title: "Go SDK",
    language: "go",
    code: `package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Log: auth0.Bool(true),
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Patch(context.Background(), "{yourTenantAclRuleId}", networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been updated to enable monitoring mode")`
  }, {
    title: "Node SDK",
    language: "javascript",
    code: `const updateNetworkAclPayload: Management.UpdateNetworkAclRequestContent = {
  rule: {
    action: {
      log: true,
    },
    scope: "authentication"
  }
};

const updateNetworkAcl = await client.networkAcls.update("{yourTenantAclRuleId}", updateNetworkAclPayload);`
  }, {
    title: "Terraform",
    language: "terraform",
    code: `resource "auth0_network_acl" "block_traffic_acl" {
    description = "Block all traffic from China"
    active = true
    priority = 1
    rule {
        action {
            block = true
            log = true
        }
        match {
            geo_country_codes = ["CN"]
        }
        scope = "authentication"
    }
}`
  }, {
    title: "Deploy CLI",
    language: "toml",
    code: `networkACLs:
  - description: Block all traffic from China
    active: true
    priority: 1
    rule:
      action:
        block: true
        log: true
      match:
        geo_country_codes:
          - CN
      scope: authentication`
  }, {
    title: "Auth0 CLI",
    language: "bash",
    code: `auth0 network-acl update {yourTenantAclRuleId} --action log`
  }]
};

<Card path="Before you start">
  To configure a Tenant ACL rule, you need a [Management API access token](/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production) with the following scopes:

  * `create:network_acls`
  * `update:network_acls`
  * `read:network_acls`
  * `delete:network_acls`
</Card>

You can configure Tenant Access Control List (ACL) rules with the Auth0 <Tooltip tip="Management API: A product to allow customers to perform administrative tasks." cta="View Glossary" href="/docs/glossary?term=Management+API">Management API</Tooltip>.

## Available actions

You can view, create, update, and delete Tenant ACL rules with the Management API.

| Action           | Endpoint                                                                                                             | Required scope        |
| ---------------- | -------------------------------------------------------------------------------------------------------------------- | --------------------- |
| View a rule      | [Get a specific access control list entry for a tenant](/docs/api/management/v2/network-acls/get-network-acls-by-id) | `read:network_acls`   |
| View all rules   | [Get all access control list entries for a tenant](/docs/api/management/v2/network-acls/get-network-acls)            | `read:network_acls`   |
| Create a rule    | [Create access control list](/docs/api/management/v2/network-acls/post-network-acls)                                 | `create:network_acls` |
| Update a rule    | [Partial update for an access control list](/docs/api/management/v2/network-acls/patch-network-acls-by-id)           | `update:network_acls` |
| Overwrite a rule | [Update access control list](/docs/api/management/v2/network-acls/put-network-acls-by-id)                            | `update:network_acls` |
| Delete a rule    | [Delete access control list](/docs/api/management/v2/network-acls/delete-network-acls-by-id)                         | `delete:network_acls` |

## Parameters

For detailed information about Tenant ACL parameters and how to use them, read [Reference](./reference).

<ParamField path="description" type="string" required>
  Describes the purpose or functionality of the rule.

  Example: `Only allow requests originating from the United States`
</ParamField>

<ParamField path="active" type="boolean" required>
  Enables or disables the rule.

  Example: `true`
</ParamField>

<ParamField path="priority" type="number" required>
  Numerical value that determines the order in which the rule is evaluated.

  Example: `1`
</ParamField>

<ParamField path="rule" type="object" required>
  Contains the conditions and actions of the rule.

  <Expandable>
    <ParamField path="action" type="object" required>
      Contains the action that the rule performs.

      Example: `{ allow: true }`
    </ParamField>

    <ParamField path="match" type="object">
      Defines the condition(s) that the incoming request must fulfill.

      Example: `{ geo_country_codes: ["US"] }`
    </ParamField>

    <ParamField path="not_match" type="object">
      Defines the condition(s) that the incoming request must not fulfill.

      Example: `{ geo_country_codes: ["CN"] }`
    </ParamField>

    <ParamField path="scope" type="string" required>
      Service or context in which the rule is enforced.

      Example: `authentication`
    </ParamField>
  </Expandable>
</ParamField>

## Examples

<AccordionGroup>
  {
      codeSamples["Examples"].map((e) => (
        <Accordion title={e.title}>
          {
            e.content ? e.content : null
          }
          <Tabs>
            {
              e.samples.map((s) => (
                <Tab title={s.title}>
                {
                  s.content ? s.content : null
                }
                <AuthCodeBlock language={s.language} children={s.code} />
                </Tab>
              ))
            }
          </Tabs>
        </Accordion>
      ))
  }
</AccordionGroup>

## Toggle monitoring mode for a rule

You can enable [monitoring mode](../tenant-access-control-list) for a Tenant ACL rule with the Management API [Update access control list](https://auth0.com/docs/api/management/v2/network-acls/put-network-acls-by-id) endpoint.

Add the `log` property to the `rule.action` object and set its value to `true`.

<Tabs>
  {
      codeSamples["Toggle monitoring mode for a rule"].map((sample) => (
        <Tab title={sample.title}>
          {
            sample.content ? sample.content : null
          }
          <AuthCodeBlock language={sample.language} children={sample.code} />
        </Tab>
      ))
  }
</Tabs>