# Create an identity-visibility filter in the account

Launch stage: Public Preview

`POST /api/2.0/identity/{parent=accounts/*}/identity-visibility-filters`

Creates a group visibility filter in the account. Requires account admin privileges.
 Set `principal_type` to `GROUP` and specify exactly one of `exact` (external ID) or `prefix`
 (display-name starts with). The filter applies across all workspaces in the account.
 A duplicate filter ID or an existing rule with the same type and match value returns
 `ALREADY_EXISTS`. Filters are immutable; to change a rule, delete it and create a new one.

API scopes: identity

## Path parameters

- `parent` (string, required)
  Required. The parent account. Format: accounts/{account_id}

## Query parameters

- `identity_visibility_filter_id` (string, optional)
  Optional. The ID to use for the filter, which becomes the final component of its resource name.
   If not specified or empty, the server generates one. Must not contain `/`.

## Request body

Required. The filter to create. Set `principal_type` to `GROUP` and specify exactly one of
 `exact` or `prefix`. The server assigns the resource name; any supplied `name` is ignored.
- `principal_type` (string, required, Immutable)
  The type of principal this rule applies to. Set to `GROUP` when creating a filter.
   Other principal types are not supported for creation.
  Possible values:
  - `USER`
  - `SERVICE_PRINCIPAL`
  - `GROUP`
- `exact` (object, optional, Immutable)
  Exact match on the group's external ID from the identity provider.
  - `external_id` (string, required, Immutable)
    The identity provider's external ID for the group to match. This is not the Databricks group ID.
     The value must be non-empty and is matched exactly, including case.
- `prefix` (object, optional, Immutable)
  Case-sensitive starts-with match on the group's display name.
  - `display_name_prefix` (string, required, Immutable)
    The display-name prefix to match. Must contain at least one non-whitespace character.
     Leading and trailing whitespace are preserved, and matching is case-sensitive.

## Returns

Returns the IdentityVisibilityFilter object.

## Response

```json
{
  "name": "string",
  "principal_type": "USER",
  "exact": {
    "external_id": "string"
  },
  "prefix": {
    "display_name_prefix": "string"
  }
}
```