Cloud Panel API — policies

9 min

Create a policy

POST https://core.fsflt.net/protection/v1/policies

Field	Type	Required	Description
name	string	yes	Policy name
organizationId	UUID	no	Target tenant; defaults to the caller's organization
isLimited	boolean	no	Limited profile (no per-user bypass)
isShared	boolean	no	Shares the policy with child organizations — required for MSP/dealer templates

curl -X POST 'https://core.fsflt.net/protection/v1/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Default Policy",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "isLimited": false,
    "isShared": false
  }'

{
  "id": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
  "name": "Default Policy",
  "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
  "isLimited": false,
  "isShared": false
}

Read back, update and delete:

Method	Endpoint
GET	/protection/v1/policies?organizationId=...
GET	/protection/v1/policies/{policyId}
PATCH
DELETE	/protection/v1/policies/{policyId}

Block categories

Categories are global and identified by UUID. First fetch the catalogue (localized names), then send the IDs to the policy.

# 1. Catalogue (lang: en-US, it-IT, es-ES, ...)
curl 'https://core.fsflt.net/protection/v1/categories?lang=en-US' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# 2. Block two categories on the policy
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/categories/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "categoryIds": [
      "0199e375-ede2-7851-a18a-b6d9ee5deae2",
      "0199e375-edeb-7c02-8997-a58432372ff6"
    ]
  }'

{
  "errors": [],
  "successes": [
    {
      "policyId": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
      "categoryId": "0199e375-ede2-7851-a18a-b6d9ee5deae2"
    }
  ]
}

Batch category endpoints return 207 and report per-item outcomes in successes / errors. An empty errors array means every item was applied; a 207 is not a failure by itself. Inspect both arrays.

The same pattern applies to the other protection modules:

Module	Block	List blocked	Allow
Content	POST /policies/{id}/categories/blocked	GET .../categories/blocked	DELETE .../categories/blocked
Malware	POST /policies/{id}/malwares/blocked	GET .../malwares/blocked	DELETE .../malwares/blocked
App Blocker	POST /policies/{id}/appblocker/blocked	GET .../appblocker/blocked	DELETE .../appblocker/blocked

Catalogue endpoints: /protection/v1/categories, /protection/v1/categories/macros, /protection/v1/malwares/categories, /protection/v1/malwares/macros, /protection/v1/appblocker/categories, /protection/v1/appblocker/macros.

Schedules (time-based blocking) are available at /policies/{id}/categories/blocked/schedule, /malwares/blocked/schedule and /appblocker/blocked/schedule.

Geoblocking and TLD blocking

# Countries catalogue
curl 'https://core.fsflt.net/protection/v1/countries' -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Block a country
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/countries/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "countryId": "0199e375-ef2e-7032-9d43-0a4a981ac05b" }'

# Block a TLD
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/tlds/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "tldId": "0199e375-ef61-7080-a32f-58cae2bbc53b" }'

Unblock via DELETE /policies/{id}/countries/blocked/{countryId} and DELETE /policies/{id}/tlds/blocked/{tldId}. TLD catalogue: GET /protection/v1/tlds.

Exception groups (allow/block lists)

An exception group is reusable across policies. type is allowlist or blocklist.

# 1. Create the group with its initial domains
curl -X POST 'https://core.fsflt.net/protection/v1/exceptiongroups' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Corporate allowlist",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "type": "allowlist",
    "domains": ["www.example.com", "intranet.example.com"]
  }'

# 2. Add more domains later
curl -X POST 'https://core.fsflt.net/protection/v1/exceptiongroups/0199ec91-18b4-7ba1-922b-e42690acfd2e/domains' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "domains": ["www.mercedes-benz.it", "www.adobe.com"] }'

# 3. Attach the group to a policy
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/exceptiongroups' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "exceptionGroupId": "0199ec91-18b4-7ba1-922b-e42690acfd2e" }'

Other operations: GET /protection/v1/exceptiongroups?includeAssociatedPolicies=true, PATCH/DELETE /protection/v1/exceptiongroups/{id}, GET/DELETE .../domains[/{domainId}], GET/DELETE /policies/{id}/exceptiongroups[/{groupId}].

Policy settings (SafeSearch, IP blocking)

curl -X PATCH 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/settings' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "googleSafeSearchEnabled": true,
    "youtubeSafeSearchEnabled": true,
    "ipBlockingEnabled": true
  }'

Available flags: googleSafeSearchEnabled, youtubeSafeSearchEnabled, bingSafeSearchEnabled, duckduckgoSafeSearchEnabled, ipBlockingEnabled. Use GET on the same route to read them.

Starting from a template

Instead of building a policy from scratch, you can clone the category set of a predefined template:

curl 'https://core.fsflt.net/protection/v1/templates?lang=en-US' -H 'x-api-key: YOUR_CLOUD_API_KEY'
curl 'https://core.fsflt.net/protection/v1/templates/{templateId}/categories?lang=en-US' -H 'x-api-key: YOUR_CLOUD_API_KEY'

Take the returned category IDs and feed them to POST /policies/{policyId}/categories/blocked.