Access policies

An access policy sets the sign-in methods and Self-Service permissions of the guests its email patterns match. See Access Policies for how policies work.

Base path: {apiBaseUrl}/organizations/{organizationId}/contexts/sign-in/{contextId}/access-policies

Operations

Operation	Method and path	Permission
List access policies	GET .../access-policies	Sign In › Access Policies (Read)
Get an access policy	GET .../access-policies/{policyId}	Sign In › Access Policies (Read)
Create an access policy	POST .../access-policies	Sign In › Access Policies (Write)
Update an access policy	PUT .../access-policies/{policyId}	Sign In › Access Policies (Write)
Delete an access policy	DELETE .../access-policies/{policyId}	Sign In › Access Policies (Write)
Add email patterns	POST .../access-policies/{policyId}/email-patterns/add	Sign In › Access Policies (Write)
Remove email patterns	POST .../access-policies/{policyId}/email-patterns/remove	Sign In › Access Policies (Write)

The permission is set per Sign-In Context, and its ID in requiredPermission is sign-in.access-policies. See API permissions.

Every operation on one policy names it by its policyId, from List access policies or the response of Create an access policy. An unknown ID, or the ID of a policy of another context, returns 404.

The access policy object

Field	Type	Description
policyId	string	The ID of the policy. Use it in the path of the other operations.
name	string	The name of the policy, unique in the context.
default	boolean	true for the fallback policy of the context, which governs every email address that no other policy’s patterns match and cannot be deleted; otherwise false.
emailPatterns	string[]	The email addresses and domains the policy applies to, sorted. Change them with Add email patterns and Remove email patterns.
signInPermissions	object	The sign-in methods the policy allows.
signInPermissions.meetingHost	boolean	Meeting Host. true when users of the policy can sponsor guests as meeting hosts; otherwise false.
signInPermissions.emailSelfProvisioning	boolean	Email Self-Provisioning. true when users can sign in by verifying their email address; otherwise false.
signInPermissions.saml	boolean	SAML Login. true when users can sign in with SAML; otherwise false.
selfServicePortal	boolean	Self-Service Portal. true when users of the policy can use the Self-Service Portal; otherwise false.
selfServicePermissions	object	What users of the policy can manage in the Self-Service Portal.
selfServicePermissions.manageConferences	boolean	Manage Conferences. true when users can manage conferences; otherwise false.
selfServicePermissions.manageWhitelistings	boolean	Manage Whitelistings. true when users can manage whitelistings; otherwise false.
siteBasedRedirect	boolean	Site Based Redirect. true when users of the policy are redirected by the site they sign in at; otherwise false.

The fields are the switches of the policy editor under Access Policies. The settings behind each switch, such as redirect URLs, session lengths and device limits, are managed in the Admin Dashboard. A method switched on through the API uses the settings of the policy, which on a new policy are the defaults of a new policy.

{
  "policyId": "66f2a1c4e8b0a93d5c1e7f20",
  "name": "Contractors",
  "default": false,
  "emailPatterns": ["@contractor.example"],
  "signInPermissions": { "meetingHost": false, "emailSelfProvisioning": true, "saml": false },
  "selfServicePortal": true,
  "selfServicePermissions": { "manageConferences": false, "manageWhitelistings": true },
  "siteBasedRedirect": false
}

Email patterns

• A pattern is a full email address, such as alice@example.com, or a domain, such as @example.com.
• An email address is governed by the policy with the longest pattern it ends with.
• Patterns are trimmed and stored in lower case.
• A pattern is 1 to 254 characters and cannot be blank.
• A request takes 1 to 500 patterns, each once. Upper and lower case count as the same pattern.

Errors are in Errors, pagination in Pagination. The legacy operations with the x-auth-token header are in Access Policy (legacy).