Create an inventory rule
Adds a rule so scripts from a known vendor are decided without being reviewed one by one. The rule applies straight away to every script nobody has decided yet, and never changes a decision a person made. An exclude rule removes matching scripts from PCI scope, the compliance figures and script alerts, so keep its pattern narrow. A website can have up to 200 rules.
Requires the manager role on the website and the compliance plan feature.
AuthorizationBearer <JWT>An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.
workspaceId*stringThe workspace's id.
websiteId*stringThe website's id.
application/json- body
name*stringDisplay name for the rule.
1 <= length <= 255urlPattern*stringPattern to match script URLs against.
1 <= length <= 1024patternType?PatternTypeHow urlPattern is read. glob uses * wildcards and is the default. regex is a regular expression; one with too many unbounded repetitions is rejected.
"glob""regex"action?RuleActionWhat happens to a script the rule matches. justify (the default) records it as reviewed and allowed. reject records it as unauthorized, a finding that stays in the inventory until the script stops loading. exclude takes it out of PCI scope, the compliance figures and script alerts; use it only for scripts a visitor's own software injects, such as a browser extension. No rule overrides a decision a person made.
"justify""reject""exclude"justification*stringApplied to every script the pattern matches: the justification on a justify rule, the reason on a reject or exclude one.
1 <= length <= 4096tagIds?array<string>Tags to apply to every script this rule matches.
items <= 50enabled?booleanDefaults to true.
sortOrder?|Rules are tried from the lowest value up, and the first match wins. Put the most specific rules first.
0 <= valueA rule that decides matching scripts automatically: justifying them, rejecting them, or excluding them from PCI scope.
application/json- response
id*stringworkspaceId*stringwebsiteId*stringname*stringDisplay name.
urlPattern*stringPattern matched against the script URL.
patternType*PatternTypeHow urlPattern is read. glob uses * wildcards and is the default. regex is a regular expression; one with too many unbounded repetitions is rejected.
"glob""regex"action*RuleActionWhat happens to a script the rule matches. justify (the default) records it as reviewed and allowed. reject records it as unauthorized, a finding that stays in the inventory until the script stops loading. exclude takes it out of PCI scope, the compliance figures and script alerts; use it only for scripts a visitor's own software injects, such as a browser extension. No rule overrides a decision a person made.
"justify""reject""exclude"justification*stringApplied to every script this rule matches: the justification on a justify rule, the reason on a reject or exclude one.
tagIds*array<string>Tags applied to matching scripts.
enabled*booleanA disabled rule matches nothing.
sortOrder*|Rules are tried from the lowest value up, and the first match wins. Put the most specific rules first.
0 <= valuecreatedAt*stringdate-timeupdatedAt*stringdate-timecurl -X POST 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/compliance/rules' \ -H 'Content-Type: application/json' \ -d '{ "name": "Stripe", "urlPattern": "https://*.stripe.com/*", "justification": "Stripe payment scripts, approved vendor."}'{ "id": "string", "workspaceId": "string", "websiteId": "string", "name": "Stripe", "urlPattern": "https://*.stripe.com/*", "patternType": "glob", "action": "justify", "justification": "string", "tagIds": [ "string" ], "enabled": true, "sortOrder": 0, "createdAt": "2019-08-24T14:15:22Z", "updatedAt": "2019-08-24T14:15:22Z"}