I've recently learned about the new "REST API Access policy" feature.
This, in conjunction with its prerequisite, Adaptive Authentication, is supposed to allow a greater degree of control over which users can access the platform from which IP addresses.
I've been experimenting with this in my personal developer instance.
I have been able to successfully design a rule like: "By default, users can only log in interactively from a specific IP range, unless they have a special role that allows them to log in from a different IP range."
I want to design a rule like: "By default, users can only make API calls from a specific IP range, unless they have a special role that allows them to make specific API calls from a different IP range."
This seems like a reasonable thing to do, but...as far as I can tell, the only way to do this would be to craft a REST API Access Policy [sys_api_access_policy] for every possible permutation of API, Resource, HTTP Method, and version.
This strikes me as extremely impractical (especially since new APIs may be created over time), so I am assuming that I'm wrong and that there is another way to do this.
Has anyone had any experience using these policies to restrict API access by default and then craft specific exceptions? Or have any other tips to share regarding this functionality?
Hi @Daniel Draes @mholmes
The global REST API Access policy option is getting released as part of the Utah release.
Please refer to this product documentation.
Thanks,
Randheer
