> ## Documentation Index > Fetch the complete documentation index at: https://docs.trackup.me/llms.txt > Use this file to discover all available pages before exploring further. # Create a firewall rule > Create a firewall rule; omitted weight follows the current highest project weight. Required permission: firewall-rule.create. ## OpenAPI ````yaml https://api.trackup.me/openapi.json post /v1/projects/{id}/firewall-rules openapi: 3.1.0 info: title: Trackup API description: >- API-key-accessible Trackup operations. Send your key in the `X-Api-Key` header. Keys belong to a team. `X-Team-Id` is not required; if supplied, it must match that team. Each operation lists its required key permission. The key creator must remain a team member and normally hold that permission. The ingest-only permissions `visitor.create`, `conversion.create`, and `request.create` do not need to be held by the creator. Project access and selection are described per operation. Session-only account, administration and OAuth operations are not part of this reference. The same operations are available as MCP tools at `/mcp` (Streamable HTTP). Authenticate with `X-Api-Key` or connect through OAuth, which issues an API key on consent. Schema validation errors return HTTP 422 with an `errors` object. Other errors generally contain `error` and `message`; operation-specific responses describe exceptions. version: 1.0.0 servers: - url: / description: Current API environment security: - ApiKey: [] paths: /v1/projects/{id}/firewall-rules: post: tags: - Firewall rules summary: Create a firewall rule description: >- Create a firewall rule; omitted weight follows the current highest project weight. Required permission: firewall-rule.create. operationId: createFirewallRule parameters: - in: path name: id schema: type: string format: uuid required: true requestBody: required: true content: application/json: schema: type: object properties: name: type: string minLength: 1 maxLength: 255 enabled: type: boolean mode: type: string enum: - basic - advanced default: advanced weight: type: integer minimum: 0 maximum: 9999 expression: type: array items: type: array items: type: object properties: field: type: string minLength: 1 operator: type: string enum: - eq - ne - gt - lt - gte - lte - contains - not_contains - starts_with - ends_with - in - not_in - matches - not_matches - exists - not_exists value: anyOf: - type: string - type: number - type: boolean - type: array items: type: string required: - field - operator - value minItems: 1 action: type: object properties: type: type: string enum: - allow - block - challenge - redirect - serve_page - log redirectUrl: type: string format: uri pattern: ^https:// statusCode: type: integer minimum: 100 maximum: 599 pageId: type: string format: uuid required: - type required: - name - expression - action responses: '201': description: Created successfully. content: application/json: schema: $ref: '#/components/schemas/FirewallRule' '400': description: Malformed request or an invalid operation. content: application/json: schema: $ref: '#/components/schemas/ApiError' '401': description: The X-Api-Key header is missing or the API key is invalid. content: application/json: schema: $ref: '#/components/schemas/ApiError' '403': description: >- The key is expired, revoked, lacks permission, or its creator no longer has the required team access. A conflicting X-Team-Id is also rejected. content: application/json: schema: $ref: '#/components/schemas/ApiError' '404': description: >- The requested resource was not found or is outside the permitted scope. content: application/json: schema: $ref: '#/components/schemas/ApiError' '422': description: >- Invalid input. Each field path maps to its first validation message; _form identifies an object-level error. content: application/json: schema: $ref: '#/components/schemas/ValidationError' '500': description: An unexpected error occurred. content: application/json: schema: $ref: '#/components/schemas/ApiError' components: schemas: FirewallRule: type: object properties: id: type: string name: type: string enabled: type: boolean mode: type: string enum: - basic - advanced weight: type: number expression: type: array items: type: array items: type: object properties: field: type: string operator: type: string enum: - eq - ne - gt - lt - gte - lte - contains - not_contains - starts_with - ends_with - in - not_in - matches - not_matches - exists - not_exists value: anyOf: - type: string - type: number - type: boolean - type: array items: type: string required: - field - operator - value action: type: object properties: type: type: string enum: - allow - block - challenge - redirect - serve_page - log redirectUrl: type: string statusCode: type: number pageId: type: string required: - type projectId: type: string createdAt: type: string required: - id - name - enabled - mode - weight - expression - action - projectId - createdAt example: id: 66666666-6666-4666-8666-666666666666 name: Block traffic outside Brazil enabled: true mode: advanced weight: 10 expression: - - field: ip.geoip.country operator: not_in value: - BR action: type: block statusCode: 403 projectId: 11111111-1111-4111-8111-111111111111 createdAt: '2026-10-26T12:00:00.000Z' ApiError: type: object properties: error: type: string message: type: string required: - error - message additionalProperties: true ValidationError: type: object properties: errors: type: object additionalProperties: type: string required: - errors securitySchemes: ApiKey: type: apiKey in: header name: X-Api-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.