Create or replace a firewall
Writes the full configuration, creating the firewall if it does not exist. Each write creates a new version. templateFirewallId creates a new firewall as a copy of another; owner names the team that owns a newly created firewall.
AuthorizationBearer <token>A personal or service access token, sent as Authorization: Bearer <token>. See access tokens.
namespace*stringThe namespace id.
firewall*stringThe firewall id.
application/json- body
A full firewall configuration to store.
id*stringThe firewall id, unique within the namespace. It is part of the URL clients install packages from.
version*integerThe configuration version. Every write stores a new version; the server assigns it, so the value sent on a write is ignored.
ecosystem*stringThe package ecosystem the firewall serves, e.g. npm, pypi or maven.
parentId?stringA firewall to inherit from. Its rules, exceptions and upstreams apply in addition to this firewall's own.
upstreams*array<>The registries packages are fetched from, in the order they are consulted.
publishTarget?stringThe upstream id that publishes are forwarded to, for ecosystems that support publishing through the firewall.
rules*array<>The firewall's own rules. Rules inherited from a parent are listed separately.
exceptions*array<>The firewall's own exceptions: packages let through despite a rule.
defaultRepositoryPrefix?stringContainer images only: prepended to one-segment repository names, so alpine is addressed as library/alpine. Empty disables the rewrite.
name?stringA display name.
description?stringA free-form description.
updatedAt?stringWhen this version was stored.
date-timepermissions?The permissions each team holds on this firewall, keyed by team id.
templateFirewallId?stringCreate the firewall as a copy of this firewall instead of from the body.
owner?stringWhen creating a firewall, the team that is granted full permissions on it. Ignored on update.
The stored configuration.
application/json- response
A firewall: the upstream registries it proxies for one package ecosystem, and the rules and exceptions it enforces on them.
id*stringThe firewall id, unique within the namespace. It is part of the URL clients install packages from.
version*integerThe configuration version. Every write stores a new version; the server assigns it, so the value sent on a write is ignored.
ecosystem*stringThe package ecosystem the firewall serves, e.g. npm, pypi or maven.
parentId?stringA firewall to inherit from. Its rules, exceptions and upstreams apply in addition to this firewall's own.
upstreams*array<>The registries packages are fetched from, in the order they are consulted.
publishTarget?stringThe upstream id that publishes are forwarded to, for ecosystems that support publishing through the firewall.
rules*array<>The firewall's own rules. Rules inherited from a parent are listed separately.
exceptions*array<>The firewall's own exceptions: packages let through despite a rule.
defaultRepositoryPrefix?stringContainer images only: prepended to one-segment repository names, so alpine is addressed as library/alpine. Empty disables the rewrite.
name?stringA display name.
description?stringA free-form description.
updatedAt?stringWhen this version was stored.
date-timepermissions?The permissions each team holds on this firewall, keyed by team id.
curl -X PUT 'https://eu-sov-1.bytesafecloud.eu/v1/my-namespace-id/config/my-firewall-id' \ -H 'Content-Type: application/json' \ -d '{ "ecosystem": "npm", "exceptions": [], "id": "npm-main", "name": "npm (main)", "rules": [ { "description": "Block packages with known malware.", "executionPhase": "download", "id": "block-malware", "ruleEffect": { "block": true, "log": true }, "selector": { "function": { "name": "malware" } } } ], "upstreams": [ { "cached": false, "credentials": {}, "endpoint": "https://registry.npmjs.org", "id": "npmjs", "internal": false } ], "version": 1}'{ "id": "npm-main", "version": 3, "ecosystem": "npm", "upstreams": [ { "id": "internal", "endpoint": "https://npm.internal.example.com", "credentials": { "username": "1F56ED4E-D401-49E4-B40C-0B7B8411BAD6", "password": "1F56ED4E-D401-49E4-B40C-0B7B8411BAD6" }, "internal": true, "cached": true, "artifactCredentials": [ { "host": "files.internal.example.com", "credentials": { "token": "1F56ED4E-D401-49E4-B40C-0B7B8411BAD6" } } ] }, { "id": "npmjs", "endpoint": "https://registry.npmjs.org", "credentials": { "token": "1F56ED4E-D401-49E4-B40C-0B7B8411BAD6" }, "internal": false, "cached": false } ], "rules": [ { "id": "block-malware", "executionPhase": "download", "selector": { "function": { "name": "malware" } }, "ruleEffect": { "block": true, "log": true }, "description": "Block packages with known malware." } ], "exceptions": [], "name": "npm (main)", "description": "The npm firewall used by every build.", "updatedAt": "2026-03-02T09:30:00Z", "permissions": { "3b6f1e2a-9c4d-4e7f-a815-6d2c0b9e7f41": [ "fw:access", "fw:clone", "fw:read", "fw:update:config", "fw:update:credentials", "fw:update:rule", "fw:update:exception", "fw:delete" ], "everybody": [ "fw:access", "fw:clone", "fw:read" ] }}