Account Network Policy

View as Markdown

Get a network policyGET /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}List network policiesGET /api/2.0/accounts/{account_id}/network-policiesCreate a network policyPOST /api/2.0/accounts/{account_id}/network-policiesUpdate a network policyPUT /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}Delete a network policyDELETE /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}

AccountNetworkPolicy object

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$

The unique identifier for the network policy.

Example: example-policy-name

account_idstringuuid

The associated account ID for this Network Policy object.

Example: 123e4567-e89b-12d3-a456-426614174000

egressobject

The network policies applying for egress traffic.

Show child attributesHide child attributes

network_accessobject

The access policy enforced for egress traffic to the internet.

Show child attributesHide child attributes

restriction_modestring

The restriction mode that controls how serverless workloads can access the internet.

Values:

• RESTRICTION_MODE_UNSPECIFIED
• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

allowed_internet_destinationsarray of object

List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

allowed_storage_destinationsarray of object

List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

bucket_namestring

AWS

The name of the S3 storage bucket.

GCP

The name of the GGS bucket or S3 storage bucket for cross-cloud access to AWS S3.

Example: my-cloud-storage

regionstring

AWS

The region in which the S3 bucket is located.

GCP

The AWS region in which the cross-cloud S3 bucket is located.

Example: us-west-1

storage_destination_typestring

The type of storage destination.

GCP

In addition to GOOGLE_CLOUD_STORAGE, AWS_S3 can be used for cross-cloud access

Values:

• STORAGE_DESTINATION_TYPE_UNSPECIFIED
• AWS_S3
• AZURE_STORAGE
• GOOGLE_CLOUD_STORAGE

Example: AWS_S3

azure_storage_accountstring

The Azure storage account name.

Example: example

azure_storage_servicestring

The Azure storage service type (blob, dfs, etc.).

Example: blob

policy_enforcementobject

Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES

Show child attributesHide child attributes

enforcement_modestring

The mode of policy enforcement. ENFORCED blocks traffic that violates policy, while DRY_RUN only logs violations without blocking. When not specified, defaults to ENFORCED.

Values:

• ENFORCEMENT_MODE_UNSPECIFIED
• ENFORCED
• DRY_RUN

Example: DRY_RUN

dry_run_mode_product_filterarray of string

When empty, it means dry run for all products. When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode.

Values:

• DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED
• DBSQL
• ML_SERVING

Example: DBSQL

blocked_internet_destinationsarray of objectBeta

List of internet destinations that serverless workloads are blocked from accessing. These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN. Currently supports DNS_NAME type only; IP_RANGE support is planned.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

ingressobject

The network policies applying for ingress traffic.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

ingress_dry_runobject

The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

View as Markdown

The AccountNetworkPolicy object

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

Get a network policy GA

GET /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}

Gets a network policy.

API scopes: networking

Parameters

account_idstringuuidRequiredpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 123e4567-e89b-12d3-a456-426614174000

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$Requiredpath

The unique identifier of the network policy to retrieve.

Example: example-policy-name

Response

Returns the AccountNetworkPolicy object.

View as Markdown

Response

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

List network policies GA

GET /api/2.0/accounts/{account_id}/network-policies

Gets an array of network policies.

API scopes: networking

Parameters

account_idstringuuidRequiredpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 123e4567-e89b-12d3-a456-426614174000

page_tokenstringquery

Pagination token to go to next page based on previous query.

Response

Returns a list of AccountNetworkPolicy objects.

View as Markdown

Response

{
  "items": [
    {
      "network_policy_id": "example-policy-name",
      "account_id": "123e4567-e89b-12d3-a456-426614174000",
      "egress": {},
      "ingress": {},
      "ingress_dry_run": {}
    }
  ],
  "next_page_token": "string"
}

Create a network policy GA

POST /api/2.0/accounts/{account_id}/network-policies

Creates a new network policy to manage which network destinations can be accessed from the <Databricks> environment.

API scopes: networking

Parameters

account_idstringuuidRequiredpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 123e4567-e89b-12d3-a456-426614174000

Request body

Network policy configuration details.

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$

The unique identifier for the network policy.

Example: example-policy-name

account_idstringuuid

The associated account ID for this Network Policy object.

Example: 123e4567-e89b-12d3-a456-426614174000

egressobject

The network policies applying for egress traffic.

Show child attributesHide child attributes

network_accessobject

The access policy enforced for egress traffic to the internet.

Show child attributesHide child attributes

restriction_modestring

The restriction mode that controls how serverless workloads can access the internet.

Values:

• RESTRICTION_MODE_UNSPECIFIED
• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

allowed_internet_destinationsarray of object

List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

allowed_storage_destinationsarray of object

List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

bucket_namestring

AWS

The name of the S3 storage bucket.

GCP

The name of the GGS bucket or S3 storage bucket for cross-cloud access to AWS S3.

Example: my-cloud-storage

regionstring

AWS

The region in which the S3 bucket is located.

GCP

The AWS region in which the cross-cloud S3 bucket is located.

Example: us-west-1

storage_destination_typestring

The type of storage destination.

GCP

In addition to GOOGLE_CLOUD_STORAGE, AWS_S3 can be used for cross-cloud access

Values:

• STORAGE_DESTINATION_TYPE_UNSPECIFIED
• AWS_S3
• AZURE_STORAGE
• GOOGLE_CLOUD_STORAGE

Example: AWS_S3

azure_storage_accountstring

The Azure storage account name.

Example: example

azure_storage_servicestring

The Azure storage service type (blob, dfs, etc.).

Example: blob

policy_enforcementobject

Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES

Show child attributesHide child attributes

enforcement_modestring

The mode of policy enforcement. ENFORCED blocks traffic that violates policy, while DRY_RUN only logs violations without blocking. When not specified, defaults to ENFORCED.

Values:

• ENFORCEMENT_MODE_UNSPECIFIED
• ENFORCED
• DRY_RUN

Example: DRY_RUN

dry_run_mode_product_filterarray of string

When empty, it means dry run for all products. When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode.

Values:

• DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED
• DBSQL
• ML_SERVING

Example: DBSQL

blocked_internet_destinationsarray of objectBeta

List of internet destinations that serverless workloads are blocked from accessing. These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN. Currently supports DNS_NAME type only; IP_RANGE support is planned.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

ingressobject

The network policies applying for ingress traffic.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

ingress_dry_runobject

The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

Response

Returns the AccountNetworkPolicy object.

View as Markdown

Request

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

Response

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

Update a network policy GA

PUT /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}

Updates a network policy. This allows you to modify the configuration of a network policy.

API scopes: networking

Parameters

account_idstringuuidRequiredpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 123e4567-e89b-12d3-a456-426614174000

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$Requiredpath

The unique identifier for the network policy.

Example: example-policy-name

Request body

Updated network policy configuration details.

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$

The unique identifier for the network policy.

Example: example-policy-name

account_idstringuuid

The associated account ID for this Network Policy object.

Example: 123e4567-e89b-12d3-a456-426614174000

egressobject

The network policies applying for egress traffic.

Show child attributesHide child attributes

network_accessobject

The access policy enforced for egress traffic to the internet.

Show child attributesHide child attributes

restriction_modestring

The restriction mode that controls how serverless workloads can access the internet.

Values:

• RESTRICTION_MODE_UNSPECIFIED
• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

allowed_internet_destinationsarray of object

List of internet destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

allowed_storage_destinationsarray of object

List of storage destinations that serverless workloads are allowed to access when in RESTRICTED_ACCESS mode.

Show child attributesHide child attributes

bucket_namestring

AWS

The name of the S3 storage bucket.

GCP

The name of the GGS bucket or S3 storage bucket for cross-cloud access to AWS S3.

Example: my-cloud-storage

regionstring

AWS

The region in which the S3 bucket is located.

GCP

The AWS region in which the cross-cloud S3 bucket is located.

Example: us-west-1

storage_destination_typestring

The type of storage destination.

GCP

In addition to GOOGLE_CLOUD_STORAGE, AWS_S3 can be used for cross-cloud access

Values:

• STORAGE_DESTINATION_TYPE_UNSPECIFIED
• AWS_S3
• AZURE_STORAGE
• GOOGLE_CLOUD_STORAGE

Example: AWS_S3

azure_storage_accountstring

The Azure storage account name.

Example: example

azure_storage_servicestring

The Azure storage service type (blob, dfs, etc.).

Example: blob

policy_enforcementobject

Optional. When policy_enforcement is not provided, we default to ENFORCE_MODE_ALL_SERVICES

Show child attributesHide child attributes

enforcement_modestring

The mode of policy enforcement. ENFORCED blocks traffic that violates policy, while DRY_RUN only logs violations without blocking. When not specified, defaults to ENFORCED.

Values:

• ENFORCEMENT_MODE_UNSPECIFIED
• ENFORCED
• DRY_RUN

Example: DRY_RUN

dry_run_mode_product_filterarray of string

When empty, it means dry run for all products. When non-empty, it means dry run for specific products and for the other products, they will run in enforced mode.

Values:

• DRY_RUN_MODE_PRODUCT_FILTER_UNSPECIFIED
• DBSQL
• ML_SERVING

Example: DBSQL

blocked_internet_destinationsarray of objectBeta

List of internet destinations that serverless workloads are blocked from accessing. These destinations are enforced when restriction mode is RESTRICTED_ACCESS or DRY_RUN. Currently supports DNS_NAME type only; IP_RANGE support is planned.

Show child attributesHide child attributes

destinationstring

The internet destination to which access will be allowed. Format dependent on the destination type.

Example: example.dest.domain.com

internet_destination_typestring

The type of internet destination. Currently only DNS_NAME is supported.

Values:

• INTERNET_DESTINATION_TYPE_UNSPECIFIED
• DNS_NAME

Example: DNS_NAME

ingressobject

The network policies applying for ingress traffic.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

ingress_dry_runobject

The ingress policy for dry run mode. Dry run will always run even if the request is allowed by the ingress policy. When this field is set, the policy will be evaluated and emit logs only without blocking requests.

Show child attributesHide child attributes

public_accessobject

The network policy restrictions for public access to the workspace. Configures how public internet traffic is allowed or denied access.

Show child attributesHide child attributes

restriction_modestring

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS

Example: RESTRICTED_ACCESS

deny_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

allow_rulesarray of object

Show child attributesHide child attributes

originobject

Show child attributesHide child attributes

all_ip_rangesboolean

Matches all IPv4 and IPv6 ranges (both public and private).

included_ip_rangesobject

Will not allow IP ranges with private IPs.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

excluded_ip_rangesobject

Excluded means: all public IP ranges except this one.

Show child attributesHide child attributes

ip_rangesarray of string

We only support IPv4 and IPv4 CIDR notation for now.

Example: 0.0.0.0/32

destinationobject

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobject

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 characters

The label for this ingress rule.

private_accessobjectBeta

The network policy restrictions for private access. Configures how requests arriving over private connectivity are governed.

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for private access.

Values:

• ALLOW_ALL_REGISTERED_ENDPOINTS
• RESTRICTED_ACCESS

Example: ALLOW_ALL_REGISTERED_ENDPOINTS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Azure

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS. Requests arriving through the workspace's Azure Private Link (ui-api) endpoints are allowed even without a matching allow rule, unless explicitly denied by a deny rule whose origin is azure_workspace_private_link or all_private_access.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the private connectivity the request arrives through, for example a specific set of registered endpoints or any endpoint registered to the account. See PrivateRequestOrigin.

Show child attributesHide child attributes

endpointsobjectBeta

Matches requests arriving through any of the specified registered endpoints.

Show child attributesHide child attributes

endpoint_idsarray of stringBeta

The IDs of the registered endpoints. Must contain at least one endpoint ID.

all_registered_endpointsbooleanBeta

Matches requests arriving through any endpoint registered to the account. Must be set to true when specified.

azure_workspace_private_linkbooleanBeta

Matches requests arriving through the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

all_private_accessbooleanBeta

Matches requests arriving over any private connectivity, including registered endpoints and the workspace's Azure Private Link (ui-api) endpoints. Can only be used in deny rules of workspace-level network policies. Must be set to true when specified.

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI, workspace APIs, or account-level APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals. On the account-level network policy, scoping to specific identities is not currently supported, so this field must be unset (the rule matches all users and service principals).

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

cross_workspace_accessobjectBeta

Show child attributesHide child attributes

restriction_modestringBeta

The restriction mode for cross-workspace access.

Values:

• FULL_ACCESS
• RESTRICTED_ACCESS
• LEGACY_MODE

Example: RESTRICTED_ACCESS

deny_rulesarray of objectBeta

Deny rules are evaluated first. A request matching any deny rule is denied, regardless of allow rules. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

allow_rulesarray of objectBeta

Allow rules are evaluated after deny rules. A request matching any allow rule is allowed; a request matching no rule is denied by default. Only applies when restriction_mode is RESTRICTED_ACCESS.

Show child attributesHide child attributes

originobjectBeta

The origin the request must match — the source workspace the request comes from, either specific source workspaces or any source workspace in any account. See CrossWorkspaceRequestOrigin.

Show child attributesHide child attributes

all_source_workspacesbooleanBeta

Matches all source workspaces.

selected_workspacesobjectBeta

Specific source workspace IDs to match.

Show child attributesHide child attributes

workspace_idsarray of int64Beta

destinationobjectBeta

The destination the request must match — the resource being accessed, for example the workspace UI or workspace APIs. See RequestDestination.

Show child attributesHide child attributes

all_destinationsboolean

When true, match all destinations, no other destination fields can be set. When not set or false, at least one specific destination must be provided.

workspace_uiobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

workspace_apiobject

Show child attributesHide child attributes

scopesarray of string

Example: sql

scope_qualifierstring

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

excluded_scopesarray of string

Inverse of scopes: matches every API scope EXCEPT those listed here ("allow all except"). Mutually exclusive with scopes — a single destination may set at most one of the two.

Example: sql

apps_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

lakebase_runtimeobject

Show child attributesHide child attributes

all_destinationsboolean

Must be set to true.

account_uiobjectBeta

Matches requests to the account console UI. Can only be used in the account-level network policy.

Show child attributesHide child attributes

all_destinationsbooleanBeta

Must be set to true.

account_apiobjectBeta

Matches requests to account-level APIs. Can only be used in the account-level network policy.

Show child attributesHide child attributes

scopesarray of stringBeta

The API scopes to match. Use "all-apis" to match any account-level API.

Example: all-apis

scope_qualifierstringBeta

Qualifies the breadth of API access for the listed scopes. See ApiScopeQualifier.

Values:

• API_SCOPE_QUALIFIER_READ
• API_SCOPE_QUALIFIER_ALL

authenticationobjectBeta

The authenticated identity the request must match. When unset, the rule matches all users and service principals.

Show child attributesHide child attributes

identity_typestring

Values:

• IDENTITY_TYPE_UNSPECIFIED
• IDENTITY_TYPE_ALL_USERS
• IDENTITY_TYPE_ALL_SERVICE_PRINCIPALS
• IDENTITY_TYPE_SELECTED_IDENTITIES

Example: IDENTITY_TYPE_ALL_USERS

identitiesarray of object

Valid only when IdentityType is IDENTITY_TYPE_SELECTED_IDENTITIES.

Show child attributesHide child attributes

principal_typestring

Values:

• PRINCIPAL_TYPE_UNSPECIFIED
• PRINCIPAL_TYPE_USER
• PRINCIPAL_TYPE_SERVICE_PRINCIPAL

principal_idint64

labelstring<= 255 charactersBeta

The label for this ingress rule.

Response

Returns the AccountNetworkPolicy object.

View as Markdown

Request

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

Response

{
  "network_policy_id": "example-policy-name",
  "account_id": "123e4567-e89b-12d3-a456-426614174000",
  "egress": {
    "network_access": {}
  },
  "ingress": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  },
  "ingress_dry_run": {
    "public_access": {},
    "private_access": {},
    "cross_workspace_access": {}
  }
}

Delete a network policy GA

DELETE /api/2.0/accounts/{account_id}/network-policies/{network_policy_id}

Deletes a network policy. Cannot be called on 'default-policy'.

API scopes: networking

Parameters

account_idstringuuidRequiredpath

Your <Databricks> account ID. You can find your account ID in your <Databricks> accounts console.

Example: 123e4567-e89b-12d3-a456-426614174000

network_policy_idstring^[a-zA-Z0-9_.-]{1,32}$Requiredpath

The unique identifier of the network policy to delete.

Example: example-policy-name

View as Markdown

Response

{}