Can we use "REST API access policies" to restrict all API calls by default, then craft specific exceptions?

[mholmes]

I've recently learned about the new "REST API Access policy" feature.

This, in conjunction with its prerequisite, Adaptive Authentication, is supposed to allow a greater degree of control over which users can access the platform from which IP addresses.

I've been experimenting with this in my personal developer instance.

I have been able to successfully design a rule like: "By default, users can only log in interactively from a specific IP range, unless they have a special role that allows them to log in from a different IP range."

I want to design a rule like: "By default, users can only make API calls from a specific IP range, unless they have a special role that allows them to make specific API calls from a different IP range."

This seems like a reasonable thing to do, but...as far as I can tell, the only way to do this would be to craft a REST API Access Policy [sys_api_access_policy] for every possible permutation of API, Resource, HTTP Method, and version.

This strikes me as extremely impractical (especially since new APIs may be created over time), so I am assuming that I'm wrong and that there is another way to do this.

Has anyone had any experience using these policies to restrict API access by default and then craft specific exceptions? Or have any other tips to share regarding this functionality?

[Daniel Draes · Accepted solution]

Hi @mholmes 

you are correct that as of this date/release you will need to craft one policy per API permutation. Not practical but the way this feature is currently working. I had a customer on the phone some time back asking exactly the same question.

I believe this idea here could be what you are looking for, feel encouraged to upvote it 😄

Creating one REST API Access Policy to control all REST APIs

[mholmes]

That is disappointing, but I appreciate the clarity. Thanks!

[roy_walton]

@Daniel Draes Thanks for this. We are looking to do the same thing as the OP. Any update on this functionality? Also, I'm unable to find the "Creating one REST API..." community post that you linked to. Was it archived? Any chance you can share the content somehow?

[Daniel Draes]

Our Idea portal has moved to our support system. The idea is still there but flagged as 'unlikely to implement': View Idea Page - Now Support (servicenow.com)

Feel free to raise another one referring to the original idea.