---
title: Cloud Panel API — policies
slug: cloud-panel-api-policies
createdAt: 2026-11-02T08:43:10.983Z
---

## Create a policy

<font color="#EF4444">`POST https://core.fsflt.net/protection/v1/policies`</font>

| **Field**                                     | **Type** | **Required** | **Description**                                                                    |
| --------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------- |
| <font color="#EF4444">`name`</font>           | string   | yes          | Policy name                                                                        |
| <font color="#EF4444">`organizationId`</font> | UUID     | no           | Target tenant; defaults to the caller's organization                               |
| <font color="#EF4444">`isLimited`</font>      | boolean  | no           | Limited profile (no per-user bypass)                                               |
| <font color="#EF4444">`isShared`</font>       | boolean  | no           | Shares the policy with child organizations — **required for MSP/dealer templates** |

```curl
curl -X POST 'https://core.fsflt.net/protection/v1/policies' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Default Policy",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "isLimited": false,
    "isShared": false
  }'
```

```json
{
  "id": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
  "name": "Default Policy",
  "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
  "isLimited": false,
  "isShared": false
}
```

Read back, update and delete:

| Method                                | Endpoint                                                                  |
| ------------------------------------- | ------------------------------------------------------------------------- |
| <font color="#EF4444">`GET`</font>    | <font color="#EF4444">`/protection/v1/policies?organizationId=...`</font> |
| <font color="#EF4444">`GET`</font>    | <font color="#EF4444">`/protection/v1/policies/{policyId}`</font>         |
| <font color="#EF4444">`PATCH`</font>  |                                                                           |
| <font color="#EF4444">`DELETE`</font> | <font color="#EF4444">`/protection/v1/policies/{policyId}`</font>         |

## Block categories

Categories are global and identified by UUID. First fetch the catalogue (localized names), then send the IDs to the policy.

```curl
# 1. Catalogue (lang: en-US, it-IT, es-ES, ...)
curl 'https://core.fsflt.net/protection/v1/categories?lang=en-US' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY'

# 2. Block two categories on the policy
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/categories/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "categoryIds": [
      "0199e375-ede2-7851-a18a-b6d9ee5deae2",
      "0199e375-edeb-7c02-8997-a58432372ff6"
    ]
  }'
```

```json
{
  "errors": [],
  "successes": [
    {
      "policyId": "0199e88b-5ca8-7b03-a3fd-0b051e38e1c7",
      "categoryId": "0199e375-ede2-7851-a18a-b6d9ee5deae2"
    }
  ]
}
```

:::hint{type="info"}
Batch category endpoints return <font color="#EF4444">`207`</font> and report per-item outcomes in <font color="#EF4444">`successes`</font> / <font color="#EF4444">`errors`</font>. An empty <font color="#EF4444">`errors`</font> array means every item was applied; a <font color="#EF4444">`207`</font> is **not** a failure by itself. Inspect both arrays.
:::

The same pattern applies to the other protection modules:

| **Module**  | **Block**                                                             | **List blocked**                                          | **Allow**                                                    |
| ----------- | --------------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------ |
| Content     | <font color="#EF4444">`POST /policies/{id}/categories/blocked`</font> | <font color="#EF4444">`GET .../categories/blocked`</font> | <font color="#EF4444">`DELETE .../categories/blocked`</font> |
| Malware     | <font color="#EF4444">`POST /policies/{id}/malwares/blocked`</font>   | <font color="#EF4444">`GET .../malwares/blocked`</font>   | <font color="#EF4444">`DELETE .../malwares/blocked`</font>   |
| App Blocker | <font color="#EF4444">`POST /policies/{id}/appblocker/blocked`</font> | <font color="#EF4444">`GET .../appblocker/blocked`</font> | <font color="#EF4444">`DELETE .../appblocker/blocked`</font> |

Catalogue endpoints: <font color="#EF4444">`/protection/v1/categories`</font>, <font color="#EF4444">`/protection/v1/categories/macros`</font>, <font color="#EF4444">`/protection/v1/malwares/categories`</font>, <font color="#EF4444">`/protection/v1/malwares/macros`</font>, <font color="#EF4444">`/protection/v1/appblocker/categories`</font>, <font color="#EF4444">`/protection/v1/appblocker/macros`</font>.

Schedules (time-based blocking) are available at <font color="#EF4444">`/policies/{id}/categories/blocked/schedule`</font>, <font color="#EF4444">`/malwares/blocked/schedule`</font> and <font color="#EF4444">`/appblocker/blocked/schedule`</font>.

## Geoblocking and TLD blocking

```curl
# Countries catalogue
curl 'https://core.fsflt.net/protection/v1/countries' -H 'x-api-key: YOUR_CLOUD_API_KEY'

# Block a country
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/countries/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "countryId": "0199e375-ef2e-7032-9d43-0a4a981ac05b" }'

# Block a TLD
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/tlds/blocked' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "tldId": "0199e375-ef61-7080-a32f-58cae2bbc53b" }'
```

Unblock via <font color="#EF4444">`DELETE /policies/{id}/countries/blocked/{countryId}`</font> and <font color="#EF4444">`DELETE /policies/{id}/tlds/blocked/{tldId}`</font>. TLD catalogue: <font color="#EF4444">`GET /protection/v1/tlds`</font>.

## Exception groups (allow/block lists)

An exception group is reusable across policies. <font color="#EF4444">`type`</font> is <font color="#EF4444">`allowlist`</font> or <font color="#EF4444">`blocklist`</font>.

```curl
# 1. Create the group with its initial domains
curl -X POST 'https://core.fsflt.net/protection/v1/exceptiongroups' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "Corporate allowlist",
    "organizationId": "019f88ef-7fb5-725c-88e8-0d7028d1b392",
    "type": "allowlist",
    "domains": ["www.example.com", "intranet.example.com"]
  }'

# 2. Add more domains later
curl -X POST 'https://core.fsflt.net/protection/v1/exceptiongroups/0199ec91-18b4-7ba1-922b-e42690acfd2e/domains' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "domains": ["www.mercedes-benz.it", "www.adobe.com"] }'

# 3. Attach the group to a policy
curl -X POST 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/exceptiongroups' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{ "exceptionGroupId": "0199ec91-18b4-7ba1-922b-e42690acfd2e" }'
```

Other operations: <font color="#EF4444">`GET /protection/v1/exceptiongroups?includeAssociatedPolicies=true`</font>, <font color="#EF4444">`PATCH/DELETE /protection/v1/exceptiongroups/{id}`</font>, <font color="#EF4444">`GET/DELETE .../domains[/{domainId}]`</font>, <font color="#EF4444">`GET/DELETE /policies/{id}/exceptiongroups[/{groupId}]`</font>.

## Policy settings (SafeSearch, IP blocking)

```curl
curl -X PATCH 'https://core.fsflt.net/protection/v1/policies/0199e88b-5ca8-7b03-a3fd-0b051e38e1c7/settings' \
  -H 'x-api-key: YOUR_CLOUD_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "googleSafeSearchEnabled": true,
    "youtubeSafeSearchEnabled": true,
    "ipBlockingEnabled": true
  }'
```

Available flags: <font color="#EF4444">`googleSafeSearchEnabled`</font>, <font color="#EF4444">`youtubeSafeSearchEnabled`</font>, <font color="#EF4444">`bingSafeSearchEnabled`</font>, <font color="#EF4444">`duckduckgoSafeSearchEnabled`</font>, <font color="#EF4444">`ipBlockingEnabled`</font>. Use <font color="#EF4444">`GET`</font> on the same route to read them.

## Starting from a template

Instead of building a policy from scratch, you can clone the category set of a predefined template:

```curl
curl 'https://core.fsflt.net/protection/v1/templates?lang=en-US' -H 'x-api-key: YOUR_CLOUD_API_KEY'
curl 'https://core.fsflt.net/protection/v1/templates/{templateId}/categories?lang=en-US' -H 'x-api-key: YOUR_CLOUD_API_KEY'
```

Take the returned category IDs and feed them to <font color="#EF4444">`POST /policies/{policyId}/categories/blocked`</font>.