> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn about the different use cases for the Tenant Access Control List feature.

# Use Cases

export const AuthCodeGroup = ({children, dropdown}) => {
  const [processedChildren, setProcessedChildren] = useState(children);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      unsubscribe = window.autorun(() => {
        const processChildren = node => {
          if (typeof node === "string") {
            let processedNode = node;
            for (const [key, value] of window.rootStore.variableStore.values.entries()) {
              processedNode = processedNode.replace(new RegExp(key, "g"), value);
            }
            return processedNode;
          } else if (Array.isArray(node)) {
            return node.map(processChildren);
          } else if (node && node.props && node.props.children) {
            return {
              ...node,
              props: {
                ...node.props,
                children: processChildren(node.props.children)
              }
            };
          }
          return node;
        };
        setProcessedChildren(processChildren(children));
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  return <CodeGroup dropdown={dropdown}>{processedChildren}</CodeGroup>;
};

export const AuthCodeBlock = ({filename, icon, language, highlight, children}) => {
  const [processedChildren, setProcessedChildren] = useState(children);
  useEffect(() => {
    let unsubscribe = null;
    function init() {
      unsubscribe = window.autorun(() => {
        let processedChildren = children;
        for (const [key, value] of window.rootStore.variableStore.values.entries()) {
          processedChildren = processedChildren.replace(new RegExp(key, "g"), value);
        }
        setProcessedChildren(processedChildren);
      });
    }
    if (window.rootStore) {
      init();
    } else {
      window.addEventListener("adu:storeReady", init);
    }
    return () => {
      window.removeEventListener("adu:storeReady", init);
      unsubscribe?.();
    };
  }, [children]);
  return <CodeBlock filename={filename} icon={icon} language={language} lines highlight={highlight}>
      {processedChildren}
    </CodeBlock>;
};

export const codeSamples = [{
  title: "Block a request",
  samples: [{
    title: "Management API",
    language: "json",
    content: <>To create this Tenant ACL rule with the Management API:
          <ol>
            <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>create:network_acls</code> scope.</li>
            <li>Call the Management API <a href="/docs/api/management/v2/network-acls/post-network-acls">Create access control list</a> endpoint with the following body:</li></ol></>,
    code: `{
  "description": "Example of blocking a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}{
  "description": "Example of blocking a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}`
  }, {
    title: "Go SDK",
    language: "go",
    code: `package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of blocking a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Block: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}`
  }, {
    title: "Node SDK",
    language: "javascript",
    code: `const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of blocking a request",
  active: true,
  priority: 2,
  rule: {
    action: {
      block: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);`
  }, {
    title: "Terraform",
    language: "terraform",
    code: `resource "auth0_network_acl" "example_blocking_request_acl" {
    description = "Example of blocking a request"
    active = true
    priority = 2
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        scope = "authentication"
    }
}`
  }, {
    title: "Deploy CLI",
    language: "toml",
    code: `networkACLs:
  - description: Example of blocking a request
    active: true
    priority: 2
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      scope: authentication`
  }, {
    title: "Auth0 CLI",
    language: "bash",
    code: `auth0 network-acl create \
--description "Example of blocking a request" \
--active true \
--priority 2 \
--rule '{"action":{"block":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"scope":"authentication"}'`
  }]
}, {
  title: "Allow a request",
  samples: [{
    title: "Management API",
    language: "json",
    content: <>To create this Tenant ACL rule with the Management API:
          <ol>
            <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>create:network_acls</code> scope.</li>
            <li>Call the Management API <a href="/docs/api/management/v2/network-acls/post-network-acls">Create access control list</a> endpoint with the following body:</li></ol></>,
    code: `{
  "description": "Example of allowing a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "allow": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}`
  }, {
    title: "Go SDK",
    language: "go",
    code: `package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of allowing a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Allow: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}`
  }, {
    title: "Node SDK",
    language: "javascript",
    code: `const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of allowing a request",
  active: true,
  priority: 2,
  rule: {
    action: {
      allow: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);`
  }, {
    title: "Terraform",
    language: "terraform",
    code: `resource "auth0_network_acl" "example_allowing_request_acl" {
    description = "Example of allowing a request"
    active = true
    priority = 2
    rule {
        action {
            allow = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        scope = "authentication"
    }
}`
  }, {
    title: "Deploy CLI",
    language: "toml",
    code: `networkACLs:
  - description: Example of allowing a request
    active: true
    priority: 2
    rule:
      action:
        allow: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      scope: authentication`
  }, {
    title: "Auth0 CLI",
    language: "bash",
    code: `auth0 network-acl create \
--description "Example of allowing a request" \
--active true \
--priority 2 \
--rule '{"action":{"allow":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"scope":"authentication"}'`
  }]
}, {
  title: "Redirect a request",
  samples: [{
    title: "Management API",
    language: "json",
    content: <>To create this Tenant ACL rule with the Management API:
          <ol>
            <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>create:network_acls</code> scope.</li>
            <li>Call the Management API <a href="/docs/api/management/v2/network-acls/post-network-acls">Create access control list</a> endpoint with the following body:</li></ol></>,
    code: `{
  "description": "Example of redirecting a request",
  "active": true,
  "priority": 2,
  "rule": {
    "action": {
      "redirect": true,
      "redirect_uri": "REDIRECT_URI"
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "scope": "authentication"
  }
}`
  }, {
    title: "Go SDK",
    language: "go",
    code: `package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of redirecting a request"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(2),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Redirect: auth0.Bool(true),
				RedirectURI: auth0.String("REDIRECT_URI"),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}`
  }, {
    title: "Node SDK",
    language: "javascript",
    code: `const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of redirecting a request",
  active: true,
  priority: 2,
  rule: {
    action: {
      redirect: true,
      redirect_uri: "REDIRECT_URI",
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);`
  }, {
    title: "Terraform",
    language: "terraform",
    code: `resource "auth0_network_acl" "example_redirecting_request_acl" {
    description = "Example of redirecting a request"
    active = true
    priority = 2
    rule {
        action {
            redirect = true
            redirect_uri = "REDIRECT_URI"
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        scope = "authentication"
    }
}`
  }, {
    title: "Deploy CLI",
    language: "toml",
    code: `networkACLs:
  - description: Example of redirecting a request
    active: true
    priority: 2
    rule:
      action:
        redirect: true
        redirect_uri: REDIRECT_URI
      match:
        geo_country_codes:
          - {geoCountryCode}
      scope: authentication`
  }, {
    title: "Auth0 CLI",
    language: "bash",
    code: `auth0 network-acl create \
--description "Example of redirecting a request" \
--active true \
--priority 2 \
--rule '{"action":{"redirect":true,"redirect_uri":"REDIRECT_URI"},"match":{"geo_country_codes":["{geoCountryCode}"]},"scope":"authentication"}'`
  }]
}, {
  title: "Complex comparisons",
  samples: [{
    title: "Management API",
    language: "json",
    content: <>To create this Tenant ACL rule with the Management API:
          <ol>
            <li><a href="/docs/secure/tokens/access-tokens/management-api-access-tokens/get-management-api-access-tokens-for-production">Get a Management API access token</a> with the <code>create:network_acls</code> scope.</li>
            <li>Call the Management API <a href="/docs/api/management/v2/network-acls/post-network-acls">Create access control list</a> endpoint with the following body:</li></ol></>,
    code: `{
  "description": "Example of a complex comparison",
  "active": true,
  "priority": 1,
  "rule": {
    "action": {
      "block": true
    },
    "match": {
      "geo_country_codes": [
        "{geoCountryCode}"
      ]
    },
    "not_match": {
      "geo_subdivision_codes": [
        "{geoSubdivisionCode}"
      ]
    },
    "scope": "authentication"
  }
}`
  }, {
    title: "Go SDK",
    language: "go",
    code: `package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of a complex comparison"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(1),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Block: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			NotMatch: &management.NetworkACLRuleMatch{
				GeoSubdivisionCodes: &[]string{"{geoSubdivisionCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}package main

import (
	"context"
	"log"

	"github.com/auth0/go-auth0"
	"github.com/auth0/go-auth0/management"
)

func main() {
	mgmt, err := management.New("{yourDomain}", management.WithClientCredentials("{yourClientId}", "{yourClientSecret}"))
	if err != nil {
		log.Fatal(err)
	}

	networkACL := &management.NetworkACL{
		Description: auth0.String("Example of a complex comparison"),
		Active:      auth0.Bool(true),
		Priority:    auth0.Int(1),
		Rule: &management.NetworkACLRule{
			Action: &management.NetworkACLRuleAction{
				Block: auth0.Bool(true),
			},
			Match: &management.NetworkACLRuleMatch{
				GeoCountryCodes: &[]string{"{geoCountryCode}"},
			},
			NotMatch: &management.NetworkACLRuleMatch{
				GeoSubdivisionCodes: &[]string{"{geoSubdivisionCode}"},
			},
			Scope: auth0.String("authentication"),
		},
	}

	err = mgmt.NetworkACL.Create(context.Background(), networkACL)
	if err != nil {
		log.Fatal(err)
	}
	log.Println("Network ACL has been created")
}`
  }, {
    title: "Node SDK",
    language: "javascript",
    code: `const createNetworkAclPayload: Management.CreateNetworkAclRequestContent = {
  description: "Example of a complex comparison",
  active: true,
  priority: 1,
  rule: {
    action: {
      block: true,
    },
    match: {
      geo_country_codes: ["{geoCountryCode}"],
    },
    not_match: {
      geo_subdivision_codes: ["{geoSubdivisionCode}"],
    },
    scope: "authentication",
  },
};

const createNetworkAcl = await client.networkAcls.create(createNetworkAclPayload);`
  }, {
    title: "Terraform",
    language: "terraform",
    code: `resource "auth0_network_acl" "example_complex_comparison_acl" {
    description = "Example of a complex comparison"
    active = true
    priority = 1
    rule {
        action {
            block = true
        }
        match {
            geo_country_codes = ["{geoCountryCode}"]
        }
        not_match {
            geo_subdivision_codes = ["{geoSubdivisionCode}"]
        }
        scope = "authentication"
    }
}`
  }, {
    title: "Deploy CLI",
    language: "toml",
    code: `networkACLs:
  - description: Example of a complex comparison
    active: true
    priority: 1
    rule:
      action:
        block: true
      match:
        geo_country_codes:
          - {geoCountryCode}
      not_match:
        geo_subdivision_codes:
          - {geoSubdivisionCode}
      scope: authentication`
  }, {
    title: "Auth0 CLI",
    language: "bash",
    code: `auth0 network-acl create \
--description "Example of a complex comparison" \
--active true \
--priority 1 \
--rule '{"action":{"block":true},"match":{"geo_country_codes":["{geoCountryCode}"]},"not_match":{"geo_subdivision_codes":["{geoSubdivisionCode}"]},"scope":"authentication"}'`
  }]
}];

## Block a request

Here is an example of a Tenant ACL rule that blocks incoming traffic from a specific geolocation country code.

<Tabs>
  {
      codeSamples.filter((s) => s.title === "Block a request")[0].samples.map((s) => (
        <Tab title={s.title}>
        { s.content ? s.content : null}
        <AuthCodeBlock language={s.language} children={s.code} />
        </Tab>
      ))
  }
</Tabs>

### Example of a block page

<Frame>
  <img src="https://mintcdn.com/generaltranslationinc/eTnlaUmP9KiNe1Wi/docs/images/cdy7uua7fh8z/34bruOvQ9n8CpMW1DndkYn/fb87ec4a0c9218caed2e0c49d1a7459a/Tenant_ACL_-_Block_page_example.png?fit=max&auto=format&n=eTnlaUmP9KiNe1Wi&q=85&s=ca83cb1a76c92e4e1e9ad9b75688c248" alt="" width="1200" height="446" data-path="docs/images/cdy7uua7fh8z/34bruOvQ9n8CpMW1DndkYn/fb87ec4a0c9218caed2e0c49d1a7459a/Tenant_ACL_-_Block_page_example.png" />
</Frame>

## Allow a request

Here is an example of a Tenant ACL rule that allows traffic only from a specific geolocation country code.

<Tabs>
  {
      codeSamples.filter((s) => s.title === "Allow a request")[0].samples.map((s) => (
        <Tab title={s.title}>
        { s.content ? s.content : null}
        <AuthCodeBlock language={s.language} children={s.code} />
        </Tab>
      ))
  }
</Tabs>

## Redirect a request

Here is an example of a Tenant ACL rule that redirects all traffic from a specific geolocation country code.

<Tabs>
  {
      codeSamples.filter((s) => s.title === "Redirect a request")[0].samples.map((s) => (
        <Tab title={s.title}>
        { s.content ? s.content : null}
        <AuthCodeBlock language={s.language} children={s.code} />
        </Tab>
      ))
  }
</Tabs>

## Complex comparisons

You can combine the `match` and `not_match` operators in a single Tenant ACL rule to enforce fine-grained access policies.

Here is an example of a Tenant ACL rule that evaluates the `geo_country_code` and `geo_subdivision_code` signals to block all traffic from a given country except for a specific state, region, or province within that country.

<Tabs>
  {
      codeSamples.filter((s) => s.title === "Complex comparisons")[0].samples.map((s) => (
        <Tab title={s.title}>
        { s.content ? s.content : null}
        <AuthCodeBlock language={s.language} children={s.code} />
        </Tab>
      ))
  }
</Tabs>