openapi: 3.2.0
info:
title: Cisco Secure Firewall Policy API
version: '1.0'
description: 'Operations tagged Policy across 3 of this provider''s published API definitions: cdfmc-openapi.yaml, cisco-secure-firewall-cdfmc-openapi.yml,
cisco-secure-firewall-scc-mesh-policy-openapi.json. Each path carries the servers of the definition it was published in.'
x-provenance:
method: harvested
first_party: true
harvested: '2026-08-19'
source: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/cdfmc-openapi.yaml
source_repo: https://github.com/CiscoDevNet/scc-public-api-docs
note: Verbatim first-party OpenAPI published by Cisco in the CiscoDevNet scc-public-api-docs repository, the source of
record for developer.cisco.com/docs/cisco-security-cloud-control-firewall-manager/. Not authored or modified by API
Evangelist.
derived_view: Per-tag view of cisco-secure-firewall-cdfmc-openapi.yml, the provider's source document. Operations and
schemas are the provider's, unmodified; only the partition is ours.
derived_from: cisco-secure-firewall-cdfmc-openapi.yml
operation_coverage: 328/332
x-evidence:
fetched: '2026-08-19'
url: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/cdfmc-openapi.yaml
http_status: 200
servers:
- url: https://api.us.security.cisco.com/firewall
description: US
- url: https://api.eu.security.cisco.com/firewall
description: EU
- url: https://api.apj.security.cisco.com/firewall
description: APJ
- url: https://api.au.security.cisco.com/firewall
description: AUS
- url: https://api.in.security.cisco.com/firewall
description: IN
- url: https://api.int.security.cisco.com/firewall
description: Staging
- url: https://scale.manage.security.cisco.com/api/rest
description: Scale
- url: https://ci.manage.security.cisco.com/api/rest
description: CI
- url: https://manage.stg.secure.cisco/api/rest
description: Stgf9
- url: https://api.security.cisco.com/pinacl/api
tags:
- name: Policy
paths:
/v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies:
get:
deprecated: false
description: '**Get the list of all access control policies.**'
operationId: getAllAccessPolicy
parameters:
- description: Only show the policy matching the specified name.
in: query
name: name
required: false
schema:
type: string
- description: 'Value is of format (including quotes): <code>"locked:{true|false}"</code><br/><code>locked</code>query
parameter when set to ''true'' returns list of Access Policies which are locked and when set to ''false'' returns
policies which are unlocked.'
in: query
name: filter
required: false
schema:
type: string
- description: UUID of the ticket for tracking the configuration changes.
in: header
name: ticket-id
required: false
schema:
type: string
- $ref: '#/components/parameters/domainUUID'
name: domainUUID
- $ref: '#/components/parameters/offset'
name: offset
- $ref: '#/components/parameters/limit'
name: limit
- $ref: '#/components/parameters/expanded'
name: expanded
responses:
'200':
content:
application/json:
examples:
'Example 1 : GET /fmc_config/v1/domain/DomainUUID/policy/accesspolicies ( Test GET ALL Success of AccessPolicy policy )':
value:
items:
- defaultAction:
id: id_of_default_action
type: AccessPolicyDefaultAction
description: policy to test FMC implementation
name: AccessPolicy1_updated
type: AccessPolicy
- defaultAction:
id: id_of_default_action
type: AccessPolicyDefaultAction
description: policy to test FMC implementation
name: AccessPolicy2_updated
type: AccessPolicy
links: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies?offset=0&limit=2
schema:
$ref: '#/components/schemas/AccessPolicyListContainer'
type: object
description: OK
default:
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
type: object
description: Error
tags:
- Policy
post:
deprecated: false
description: '**Create an access control policy. _Check the response section for applicable examples (if any)._**'
operationId: createAccessPolicy
parameters:
- description: UUID of the ticket for tracking the configuration changes.
in: header
name: ticket-id
required: false
schema:
type: string
- $ref: '#/components/parameters/domainUUID'
name: domainUUID
requestBody:
content:
application/json:
examples:
? 'Example 1 : POST /fmc_config/v1/domain/DomainUUID/policy/accesspolicies ( Success: POST method for AccessPolicy
with minimum required fields )'
: value:
defaultAction:
action: BLOCK
name: AccessPolicy1
type: AccessPolicy
'Example 2 : POST /fmc_config/v1/domain/DomainUUID/policy/accesspolicies ( Success: Test POST method for AccessPolicy )':
value:
defaultAction:
action: any_allowed_action_enum
intrusionPolicy:
id: id_of_existing_or_new_intrusion_policy
type: IntrusionPolicy
logBegin: true/false
logEnd: true/false
sendEventsToFMC: true/false
snmpConfig:
id: id_of_snmpConfig_object
type: SNMPAlert
syslogConfig:
id: id_of_syslog_object
type: SyslogAlert
type: AccessPolicyDefaultAction
variableSet:
id: id_of_variableSet_to_be_added
type: VariableSet
description: policy to test FMC implementation
name: AccessPolicy1
type: AccessPolicy
schema:
$ref: '#/components/schemas/AccessPolicy'
type: object
description: Input representation of access policy.
required: true
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/AccessPolicy'
type: object
description: Created
default:
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
type: object
description: Error
tags:
- Policy
servers:
- url: https://api.us.security.cisco.com/firewall
description: US
- url: https://api.eu.security.cisco.com/firewall
description: EU
- url: https://api.apj.security.cisco.com/firewall
description: APJ
- url: https://api.au.security.cisco.com/firewall
description: AUS
- url: https://api.in.security.cisco.com/firewall
description: IN
- url: https://api.int.security.cisco.com/firewall
description: Staging
- url: https://scale.manage.security.cisco.com/api/rest
description: Scale
- url: https://ci.manage.security.cisco.com/api/rest
description: CI
- url: https://manage.stg.secure.cisco/api/rest
description: Stgf9
/v1/cdfmc/api/fmc_config/v1/domain/{domainUUID}/policy/accesspolicies/{containerUUID}/accessrules:
delete:
deprecated: false
description: '**Delete all access rules. Use filtering to specify which access rules will be deleted. _Check the response
section for applicable examples (if any)._**'
operationId: deleteMultipleAccessRule
parameters:
- description: Boolean indicating whether this is a bulk operation.
in: query
name: bulk
required: true
schema:
type: boolean
- description: 'For bulk delete needs the filter="ids:" and with <code>bulk=true</code> flag, Value is of format (including
quotes): <code>"ids:id1,id2,..."</code>.<br/><code>ids</code> is a comma-separated list of rule IDs to be deleted.<br/>Supported
filter criteria are "name","timeRange","action","sourceNetworks","destinationNetworks","sourcePorts","destinationPorts","sourceZones","destinationZones","applications","sourceDynamicObjects","destinationDynamicObjects","vlanTags","comments","users","urls","intrusionPolicy","sourceSecurityGroupTags","fts".'
in: query
name: filter
required: true
schema:
type: string
- description: UUID of the ticket for tracking the configuration changes.
in: header
name: ticket-id
required: false
schema:
type: string
- description: The container id under which this specific resource is contained.
in: path
name: containerUUID
required: true
schema:
type: string
- $ref: '#/components/parameters/domainUUID'
name: domainUUID
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AccessRule'
type: object
description: The input representation of access rule model.
required: true
responses:
'200':
content:
application/json:
examples:
? 'Example 1 : DELETE /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID
( Test DELETE of Access rule )'
: value:
action: ALLOW
applications:
applications:
- id: '1553'
name: 1&1 Internet
type: Application
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
destinationZones:
objects:
- id: SecurityZoneUUID
name: Internal
type: SecurityZone
enabled: true
id: accessRuleUUID
ipsPolicy:
id: IntrusionPolicyUUID
name: Connectivity Over Security
type: IntrusionPolicy
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID
logBegin: false
logEnd: false
logFiles: false
metadata:
readOnly:
reason: SYSTEM
state: true
name: Rule2
originalSourceNetworks: {}
sendEventsToFMC: false
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name: AOL
type: ProtocolPortObject
sourceZones:
objects:
- id: SecurityZoneUUID
name: External
type: SecurityZone
type: AccessRule
urls:
urlCategoriesWithReputation:
- category:
id: URLCategoryUUID
name: Weapons
type: URLCategory
reputation: BENIGN_SITES_WITH_SECURITY_RISKS
type: UrlCategoryAndReputation
variableSet:
id: VariableSetUUID
name: Default Set
type: VariableSet
vlanTags:
objects:
- id: VlanTagUUID
name: vlan_tag_1
type: VlanTag
schema:
$ref: '#/components/schemas/AccessRule'
type: object
description: OK
default:
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
type: object
description: Error
tags:
- Policy
get:
deprecated: false
description: '**Get the list of all access rules associated with the specified policy ID.**'
operationId: getAllAccessRule
parameters:
- description: For GetAll Filter criteria can be specified using the format <code>"name:filterName;timeRange:true;action:filterAction;sourceNetworks:filterValue1,filterValue2...."</code>.<br/>Supported
filter criteria are "name","timeRange","action","sourceNetworks","originalClientIP","destinationNetworks","sourcePorts","destinationPorts","sourceZones","destinationZones","applications","sourceDynamicObjects","destinationDynamicObjects","vlanTags","comments","users","urls","intrusionPolicy","sourceSecurityGroupTags","fts".
in: query
name: filter
required: false
schema:
type: string
- description: UUID of the ticket for tracking the configuration changes.
in: header
name: ticket-id
required: false
schema:
type: string
- description: The container id under which this specific resource is contained.
in: path
name: containerUUID
required: true
schema:
type: string
- $ref: '#/components/parameters/domainUUID'
name: domainUUID
- $ref: '#/components/parameters/offset'
name: offset
- $ref: '#/components/parameters/limit'
name: limit
- $ref: '#/components/parameters/expanded'
name: expanded
responses:
'200':
content:
application/json:
examples:
? 'Example 1 : GET /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules ( Success:
Test GET ALL success )'
: value:
items:
- id: accessRuleUUID1
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID1
name: Rule1
type: AccessRule
- id: accessRuleUUID2
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID2
name: Rule2
type: AccessRule
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules?offset=0&limit=1
paging:
count: 2
limit: 2
offset: 0
pages: 1
? 'Example 2 : GET /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules?expanded=true
( Success: Test GET ALL success with expanded=true )'
: value:
items:
- action: ALLOW
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationNetworks: {}
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
enabled: true
id: accessRuleUUID2
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID2
logBegin: false
logEnd: false
logFiles: false
metadata:
readOnly:
reason: SYSTEM
state: true
name: Rule1
originalSourceNetworks: {}
sendEventsToFMC: false
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourceNetworks: {}
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name: AOL
type: ProtocolPortObject
type: AccessRule
variableSet:
id: VariableSetUUID
name: Default Set
type: VariableSet
vlanTags:
objects:
- id: VlanTagUUID
name: vlan_tag_1
type: VlanTag
- action: ALLOW
applications:
applications:
- id: applictaionUUID
name: 1&1 Internet
type: Application
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
destinationZones:
objects:
- id: SecurityZone
name: Internal
type: SecurityZone
enabled: true
id: accessRuleUUID1
ipsPolicy:
id: IntrusionPolicyUUID
name: Connectivity Over Security
type: IntrusionPolicy
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules/accessRuleUUID1
logBegin: false
logEnd: false
logFiles: false
metadata:
readOnly:
reason: SYSTEM
state: true
name: Rule2
originalSourceNetworks: {}
sendEventsToFMC: false
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name: AOL
type: ProtocolPortObject
sourceZones:
objects:
- id: SecurityZone
name: External
type: SecurityZone
type: AccessRule
urls:
urlCategoriesWithReputation:
- category:
id: URLCategoryUUID
name: Weapons
type: URLCategory
reputation: BENIGN_SITES_WITH_SECURITY_RISKS
type: UrlCategoryAndReputation
variableSet:
id: VariableSetUUID
name: Default Set
type: VariableSet
vlanTags:
objects:
- id: VlanTagUUID
name: vlan_tag_1
type: VlanTag
links:
self: /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules?offset=0&limit=2
paging:
count: 2
limit: 2
offset: 0
pages: 1
schema:
$ref: '#/components/schemas/AccessRuleListContainer'
type: object
description: OK
default:
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
type: object
description: Error
tags:
- Policy
post:
deprecated: false
description: '**Create access rules. _Check the response section for applicable examples (if any)._**'
operationId: createMultipleAccessRule
parameters:
- description: Boolean indicating whether this is a bulk operation.
in: query
name: bulk
required: false
schema:
type: boolean
- description: Specifies that the rules will be inserted after the specified rule index. If no section or category is
specified, the rules will be added to the section or category after the insertion point. insertBefore takes precedence
over insertAfter - if both are specified, the insertBefore parameter will apply.
in: query
name: insertAfter
required: false
schema:
type: number
- description: Specifies that the rules will be inserted before the specified rule index. If no section or category
is specified, the rules will be added to the section or category before the insertion point. insertBefore takes
precedence over insertAfter - if both are specified, the insertBefore parameter will apply.
in: query
name: insertBefore
required: false
schema:
type: number
- description: Specifies the section into which the rules will be added. If this parameter is not used the section will
be the default section. Only mandatory and default are allowed values. If a section is specified, a category cannot
be specified.
in: query
name: section
required: false
schema:
type: string
- description: Specifies the category into which the rules will be added. If a category is specified it must exist or
the request will fail. If a section is specified, a category cannot be specified.
in: query
name: category
required: false
schema:
type: string
- description: UUID of the ticket for tracking the configuration changes.
in: header
name: ticket-id
required: false
schema:
type: string
- description: The container id under which this specific resource is contained.
in: path
name: containerUUID
required: true
schema:
type: string
- $ref: '#/components/parameters/domainUUID'
name: domainUUID
requestBody:
content:
application/json:
examples:
? 'Example 1 : POST /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules ( Test
POST of Access rule )'
: value:
action: ALLOW
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
destinationZones:
objects:
- id: SecurityZoneUUID
name: Internal
type: SecurityZone
enabled: true
filePolicy:
id: filePolicyUuid
name: filePolicyName
type: FilePolicy
ipsPolicy:
id: ipsPolicyUuid
name: ipsPlicyName
type: IntrusionPolicy
logBegin: false
logEnd: false
logFiles: false
name: Rule1
newComments:
- comment1
- comment2
sendEventsToFMC: false
snmpConfig:
id: snmpConfigUuid
name: snmp_alert1
type: SNMPAlert
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name: AOL
type: ProtocolPortObject
sourceZones:
objects:
- id: SecurityZoneUUID
name: External
type: SecurityZone
syslogConfig:
id: syslogConfigUuid
name: syslog_alert1
type: SyslogAlert
type: AccessRule
urls:
urlCategoriesWithReputation:
- category:
id: URLCategoryUUID
name: Weapons
type: URLCategory
reputation: BENIGN_SITES_WITH_SECURITY_RISKS
type: UrlCategoryAndReputation
variableSet:
id: VariableSetUUID
name: Default Set
type: VariableSet
vlanTags:
objects:
- id: VlanTagUUID1
name: vlan_tag_1
type: VlanTag
- id: VlanTagUUID2
name: vlan_tag_2
type: VlanTag
? 'Example 2 : POST /fmc_config/v1/domain/DomainUUID/policy/accesspolicies/containerUUID/accessrules?bulk=true
( POST Bulk insert of Access rules )'
: value:
- action: ALLOW
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
destinationZones:
objects:
- id: SecurityZoneUUID
name: Internal
type: SecurityZone
enabled: true
filePolicy:
id: filePolicyUuid
name: filePolicyName
type: FilePolicy
ipsPolicy:
id: ipsPolicyUuid
name: ipsPlicyName
type: IntrusionPolicy
logBegin: false
logEnd: false
logFiles: false
name: Rule1
newComments:
- comment1
- comment2
sendEventsToFMC: false
snmpConfig:
id: snmpConfigUuid
name: snmp_alert1
type: SNMPAlert
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name: AOL
type: ProtocolPortObject
sourceZones:
objects:
- id: SecurityZoneUUID
name: External
type: SecurityZone
syslogConfig:
id: syslogConfigUuid
name: syslog_alert1
type: SyslogAlert
type: AccessRule
urls:
urlCategoriesWithReputation:
- category:
id: URLCategoryUUID
name: Weapons
type: URLCategory
reputation: BENIGN_SITES_WITH_SECURITY_RISKS
type: UrlCategoryAndReputation
variableSet:
id: VariableSetUUID
name: Default Set
type: VariableSet
vlanTags:
objects:
- id: VlanTagUUID1
name: vlan_tag_1
type: VlanTag
- id: VlanTagUUID2
name: vlan_tag_2
type: VlanTag
- action: ALLOW
destinationDynamicObjects:
objects:
- id: dynamicObjectUUID
name: destinationDynamicObject
type: DynamicObject
destinationPorts:
objects:
- id: ProtocolPortObjectUUID
name: Bittorrent
type: ProtocolPortObject
destinationZones:
objects:
- id: SecurityZoneUUID
name: Internal
type: SecurityZone
enabled: true
filePolicy:
id: filePolicyUuid
name: filePolicyName
type: FilePolicy
ipsPolicy:
id: ipsPolicyUuid
name: ipsPlicyName
type: IntrusionPolicy
logBegin: false
logEnd: false
logFiles: false
name: Rule2
newComments:
- comment1
- comment2
sendEventsToFMC: false
snmpConfig:
id: snmpConfigUuid
name: snmp_alert1
type: SNMPAlert
sourceDynamicObjects:
objects:
- id: dynamicObjectUUID
name: SourceDynamicObject
type: DynamicObject
sourcePorts:
objects:
- id: ProtocolPortObjectUUID
name:
# --- truncated at 32 KB (2097 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-secure-firewall/refs/heads/main/openapi/cisco-secure-firewall-policy-api-openapi.yml