Skip to main content
When you manage the Tenant Access Control List (ACL) with the Management API, the following rule parameters define the behavior of its rules.

​
Signals

​
string[]
List of Autonomous System Numbers (ASNs)
​
string[]
List of IPv4 addresses or CIDR ranges of the infrastructure connecting directly to the Auth0 edge. Use this to match against the IP of a your reverse proxy or VPN rather than the end user IP.
​
string[]
List of IPv6 addresses or CIDR ranges of the infrastructure connecting directly to the Auth0 edge. Use this to match against the IP of a your reverse proxy or VPN rather than the end user IP.
​
string[]
List of hostnames relevant to the tenant. This is matched against the Server Name Indication (SNI) of the request. Supported values include:, Canonical hostnames (for example, t1.us.auth0.com
  • Auth0 managed custom domains (for example, auth.acmetest.org
  • Self-managed custom domains (for example, cd-t1…edge.tenants.us.auth0.com
You can use this signal to disable or restrict access to your canonical domain while allowing traffic via custom domains.
​
string[]
List of IPv4 addresses or CIDR ranges.
​
string[]
List of IPv6 addresses or CIDR ranges.
​
string[]
List of ISO 3166-1 alpha-2 country code.
​
string[]
List of ISO 3166-2 subdivision code.
​
string[]
List of JA3 TLS Fingerprints.
​
string[]
List of JA4 TLS Fingerprints.
​
string[]
List of client device or browser.

​
Conditions

​
object
Returns successful if the provided signal and any of the provided values are equivalent.
​
object
Returns successful if the provided signal and none of the provided values are equivalent.

​
Actions

​
boolean
Allows traffic to pass through unaffected.
​
boolean
Blocks traffic from accessing specified scopes.
​
boolean
Redirects traffic to a provided location.
​
string
URI to redirect traffic to.
​
boolean
Monitoring mode. No action is taken, but results are included in the Tenant ACL log event.

​
Scopes

​
Enforces Tenant ACL for both management and authentication scopes.
​
Enforces Tenant ACL for requests sent to {yourDomain}/api/v2/\*} and {yourDomain}/scim/\*}.
​
Controls access to Dynamic Client Registration endpoint /oidc/register.
​
Enforces Tenant ACL for requests sent to anywhere not covered in management scope.