## Access control lists (`acls`)

Rule sets that allow or block requests by IP/CIDR and other conditions; the platform provides built-in rules and tenants can create their own.

Authentication: User (some parameters admin only) · Docs: https://www-demo.kuxitong.com/en/docs/api/acls

### GET `/api/v2/acls`

List ACLs · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `sort` | string |  | Sort fields, comma-separated; prefix `-` for descending, e.g. `-created_at,id` |
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |
| `enabled` | boolean |  | Filter by enabled state. |
| `name` | string |  | Filter by name substring. |
| `owner` | string |  | platform = platform objects only; tenant = tenant objects only. Values: ["platform","tenant"] |

```sh
curl "https://panel.example.com/api/v2/acls" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/acls`

Create ACL · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `default_action` | string | Yes | Action when no rule matches. Values: ["allow","deny"] |
| `des` | string |  | Remark; empty if omitted (omitting it on update also clears it, since the update replaces the whole object). |
| `enabled` | boolean |  | Whether enabled Default: true |
| `name` | string | Yes | Name |
| `rules` | AclRule[] | Yes | Matched in order; the count is limited by the setting protect.acl_rules_max. |
| `tenant_id` | integer |  | Owning tenant; null = platform object (built-in or created by an admin, read-only for tenants). |

```sh
curl -X POST "https://panel.example.com/api/v2/acls" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"default_action":"deny","name":"office","rules":[{"action":"allow","when":{"f":"ip","op":"cidr","v":["192.0.2.0/24"]}}]}'
```

### POST `/api/v2/acls/batch-enable`

Batch enable or disable ACLs · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `enabled` | boolean | Yes | Whether enabled Default: true |
| `ids` | integer[] | Yes | IDs of the objects to change, at most 100. |

```sh
curl -X POST "https://panel.example.com/api/v2/acls/batch-enable" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":false,"ids":[1,2]}'
```

### GET `/api/v2/acls/{id}`

Get ACL · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/acls/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PUT `/api/v2/acls/{id}`

Update ACL · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `default_action` | string | Yes | Action when no rule matches. Values: ["allow","deny"] |
| `des` | string |  | Remark; empty if omitted (omitting it on update also clears it, since the update replaces the whole object). |
| `enabled` | boolean |  | Whether enabled Default: true |
| `name` | string | Yes | Name |
| `rules` | AclRule[] | Yes | Matched in order; the count is limited by the setting protect.acl_rules_max. |
| `tenant_id` | integer |  | Owning tenant; null = platform object (built-in or created by an admin, read-only for tenants). |

```sh
curl -X PUT "https://panel.example.com/api/v2/acls/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"default_action":"deny","name":"office","rules":[{"action":"allow","when":{"f":"ip","op":"cidr","v":["192.0.2.0/24"]}}]}'
```

### DELETE `/api/v2/acls/{id}`

Delete ACL · Authentication: User (some parameters admin only)

```sh
curl -X DELETE "https://panel.example.com/api/v2/acls/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

Access control lists object:

| Field | Type | Required | Description |
|---|---|---|---|
| `builtin` | boolean |  | Built-in object; cannot be deleted. (read-only) |
| `created_at` | string |  | Created at (read-only) |
| `default_action` | string |  | Action when no rule matches. Values: ["allow","deny"] |
| `des` | string |  | Remark; empty if omitted (omitting it on update also clears it, since the update replaces the whole object). |
| `enabled` | boolean |  | Whether enabled Default: true |
| `errors` | FieldError[] |  | Why each remaining item was not changed; field is /ids/<index>, code as in the single-item update (not_found, readonly and so on). |
| `id` | integer |  | Record ID (read-only) |
| `ids` | integer[] | Yes | IDs of the objects to change, at most 100. |
| `name` | string |  | Name |
| `rules` | AclRule[] |  | Matched in order; the count is limited by the setting protect.acl_rules_max. |
| `tenant_id` | integer |  | Owning tenant; null = platform object (built-in or created by an admin, read-only for tenants). (read-only) |
| `updated` | integer[] |  | IDs that were set (including those already in the target state), in request order. |
| `updated_at` | string |  | Updated at (read-only) |