Laravel Security Rules API

openapi: 3.2.0
info:
  title: Forge Security Rules API
  version: 0.0.1
  description: Laravel Forge - API Documentation
servers:
- url: https://forge.laravel.com/api
security:
- http: []
- oauth2: []
tags:
- name: Security Rules
paths:
  /orgs/{organization}/servers/{server}/sites/{site}/security-rules:
    get:
      operationId: organizations.servers.sites.security-rules.index
      description: 'List all security rules associated with the site.


        Processing mode: sync'
      summary: List site security rules
      tags:
      - Security Rules
      parameters:
      - name: organization
        in: path
        required: true
        description: The organization slug
        schema:
          type: string
      - name: server
        in: path
        required: true
        description: The server ID
        schema:
          type: integer
      - name: site
        in: path
        required: true
        description: The site ID
        schema:
          type: integer
      - name: page[size]
        in: query
        description: The number of results that will be returned per page.
        schema:
          type: integer
          default: 30
      - name: page[cursor]
        in: query
        description: The cursor to start the pagination from.
        schema:
          type: string
      - name: filter[path]
        in: query
        description: The path for the security rule.
        schema:
          type: string
          examples:
          - /admin
      - name: filter[status]
        in: query
        description: The status of the security rule.
        schema:
          type: string
          examples:
          - installed
      - name: sort
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - path
            - -path
            - status
            - -status
            - created_at
            - -created_at
            - updated_at
            - -updated_at
        explode: false
      responses:
        '200':
          description: Paginated set of `SecurityRuleResource`
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/SecurityRuleResource'
                  links:
                    type: object
                    properties:
                      first:
                        type: string
                      last:
                        type: string
                      prev:
                        type: string
                      next:
                        type: string
                  meta:
                    type: object
                    properties:
                      path:
                        type:
                        - string
                        - 'null'
                        description: Base path for paginator generated URLs.
                      per_page:
                        type: integer
                        description: Number of items shown per page.
                        minimum: 0
                      next_cursor:
                        type:
                        - string
                        - 'null'
                        description: The "cursor" that points to the next set of items.
                      prev_cursor:
                        type:
                        - string
                        - 'null'
                        description: The "cursor" that points to the previous set of items.
                    required:
                    - path
                    - per_page
                    - next_cursor
                    - prev_cursor
                required:
                - data
                - links
                - meta
        '404':
          $ref: '#/components/responses/ModelNotFoundException'
        '403':
          $ref: '#/components/responses/AuthorizationException'
      security:
      - oauth2:
        - site:manage-security
      x-permissions:
      - site:manage-security
      x-mint:
        metadata:
          noindex: true
      x-processingMode: sync
    post:
      operationId: organizations.servers.sites.security-rules.store
      description: 'Add a new security rule to the site.


        Processing mode: async'
      summary: Create site security rule
      tags:
      - Security Rules
      parameters:
      - name: organization
        in: path
        required: true
        description: The organization slug
        schema:
          type: string
      - name: server
        in: path
        required: true
        description: The server ID
        schema:
          type: integer
      - name: site
        in: path
        required: true
        description: The site ID
        schema:
          type: integer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateSecurityRuleRequest'
      responses:
        '202':
          description: '`SecurityRuleResource`'
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/SecurityRuleResource'
                required:
                - data
        '404':
          $ref: '#/components/responses/ModelNotFoundException'
        '403':
          $ref: '#/components/responses/AuthorizationException'
        '422':
          $ref: '#/components/responses/ValidationException'
      security:
      - oauth2:
        - site:manage-security
      x-permissions:
      - site:manage-security
      x-mint:
        metadata:
          noindex: true
      x-processingMode: async
  /orgs/{organization}/servers/{server}/sites/{site}/security-rules/{securityRule}:
    get:
      operationId: organizations.servers.sites.security-rules.show
      description: 'Get a specific security rule associated with the site.


        Processing mode: sync'
      summary: Get site security rule
      tags:
      - Security Rules
      parameters:
      - name: organization
        in: path
        required: true
        description: The organization slug
        schema:
          type: string
      - name: server
        in: path
        required: true
        description: The server ID
        schema:
          type: integer
      - name: site
        in: path
        required: true
        description: The site ID
        schema:
          type: integer
      - name: securityRule
        in: path
        required: true
        description: The security rule ID
        schema:
          type: integer
      responses:
        '200':
          description: '`SecurityRuleResource`'
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/SecurityRuleResource'
                required:
                - data
        '404':
          $ref: '#/components/responses/ModelNotFoundException'
        '403':
          $ref: '#/components/responses/AuthorizationException'
      security:
      - oauth2:
        - site:manage-security
      x-permissions:
      - site:manage-security
      x-mint:
        metadata:
          noindex: true
      x-processingMode: sync
    put:
      operationId: organizations.servers.sites.security-rules.update
      description: 'Update an existing security rule for a site.


        Processing mode: async'
      summary: Update site security rule
      tags:
      - Security Rules
      parameters:
      - name: organization
        in: path
        required: true
        description: The organization slug
        schema:
          type: string
      - name: server
        in: path
        required: true
        description: The server ID
        schema:
          type: integer
      - name: site
        in: path
        required: true
        description: The site ID
        schema:
          type: integer
      - name: securityRule
        in: path
        required: true
        description: The security rule ID
        schema:
          type: integer
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSecurityRuleRequest'
      responses:
        '202':
          description: Accepted
        '404':
          $ref: '#/components/responses/ModelNotFoundException'
        '403':
          $ref: '#/components/responses/AuthorizationException'
        '422':
          $ref: '#/components/responses/ValidationException'
      security:
      - oauth2:
        - site:manage-security
      x-permissions:
      - site:manage-security
      x-mint:
        metadata:
          noindex: true
      x-processingMode: async
    delete:
      operationId: organizations.servers.sites.security-rules.destroy
      description: 'Remove a security rule from the site.


        Processing mode: async'
      summary: Delete site security rule
      tags:
      - Security Rules
      parameters:
      - name: organization
        in: path
        required: true
        description: The organization slug
        schema:
          type: string
      - name: server
        in: path
        required: true
        description: The server ID
        schema:
          type: integer
      - name: site
        in: path
        required: true
        description: The site ID
        schema:
          type: integer
      - name: securityRule
        in: path
        required: true
        description: The security rule ID
        schema:
          type: integer
      responses:
        '202':
          description: Accepted
        '404':
          $ref: '#/components/responses/ModelNotFoundException'
        '403':
          $ref: '#/components/responses/AuthorizationException'
      security:
      - oauth2:
        - site:manage-security
      x-permissions:
      - site:manage-security
      x-mint:
        metadata:
          noindex: true
      x-processingMode: async
components:
  responses:
    ValidationException:
      description: Validation error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                description: Errors overview.
              errors:
                type: object
                description: A detailed description of each field that failed validation.
                additionalProperties:
                  type: array
                  items:
                    type: string
            required:
            - message
            - errors
    AuthorizationException:
      description: Authorization error
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                description: Error overview.
            required:
            - message
    ModelNotFoundException:
      description: Not found
      content:
        application/json:
          schema:
            type: object
            properties:
              message:
                type: string
                description: Error overview.
            required:
            - message
  schemas:
    SecurityRuleResource:
      type: object
      properties:
        id:
          type: string
        type:
          type: string
          enum:
          - securityRules
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the security rule.
              examples:
              - Restricted Access
            path:
              type:
              - string
              - 'null'
              description: The path for the security rule.
              examples:
              - /admin
            status:
              type:
              - string
              - 'null'
              description: The status of the security rule.
              examples:
              - installed
            created_at:
              type: string
              format: date-time
              description: The date and time the security rule was created.
              examples:
              - '2025-07-29T09:00:00Z'
            updated_at:
              type: string
              format: date-time
              description: The date and time the security rule was last updated.
              examples:
              - '2025-07-30T09:00:00Z'
          required:
          - name
          - path
          - status
          - created_at
          - updated_at
        links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/Link'
          required:
          - self
      required:
      - id
      - type
      - links
      title: SecurityRuleResource
    Link:
      type: object
      properties:
        href:
          type: string
          format: uri
        rel:
          type: string
        describedby:
          type: string
        title:
          type: string
        type:
          type: string
        hreflang:
          anyOf:
          - type: string
          - type: array
            items:
              type: string
        meta:
          type: object
      required:
      - href
      title: Link
    UpdateSecurityRuleRequest:
      type: object
      properties:
        name:
          type: string
          description: The name of the security rule.
          examples:
          - Restricted Access
          maxLength: 255
        path:
          type:
          - string
          - 'null'
          description: The path for the security rule.
          examples:
          - /admin
          maxLength: 255
        credentials:
          type: array
          description: The credentials for the security rule.
          items:
            type: object
            properties:
              username:
                type: string
                description: The usernames for the credential.
                examples:
                - admin
                maxLength: 50
              password:
                type: string
                description: The passwords for the credential.
                examples:
                - secret123
            required:
            - username
          minItems: 1
      required:
      - name
      - credentials
      title: UpdateSecurityRuleRequest
    CreateSecurityRuleRequest:
      type: object
      properties:
        name:
          type: string
          description: The name of the security rule.
          examples:
          - Restricted Access
          maxLength: 255
        path:
          type: string
          description: The path for the security rule.
          examples:
          - /admin
          maxLength: 255
        credentials:
          type: array
          description: The credentials for the security rule.
          items:
            type: object
            properties:
              username:
                type: string
                description: The usernames for the credential.
                examples:
                - admin
                maxLength: 50
              password:
                type: string
                description: The passwords for the credential.
                examples:
                - secret123
            required:
            - username
            - password
          minItems: 1
      required:
      - name
      - credentials
      title: CreateSecurityRuleRequest
  securitySchemes:
    http:
      type: http
      scheme: bearer
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://forge.laravel.com/oauth/authorize
          tokenUrl: https://forge.laravel.com/oauth/token
          scopes:
            organization:view: Allow members to view the organization
            organization:manage: Allow members to manage the organization
            organization:delete: Allow members to delete the organization
            server:view: Allow members to view servers
            server:create: Allow members to create servers
            server:delete: Allow members to delete servers
            server:archive: Allow members to archive servers
            server:transfer: Allow members to transfer servers to another Forge account
            server:manage-meta: Allow members to change server settings such as name and IP address
            server:manage-packages: Allow members to configure and remove server and site package authentication
            server:manage-php: Allow members to install and change PHP installations
            server:manage-logs: Allow members to clear server and site logs
            server:manage-network: Allow members to change the server‘s firewall
            server:manage-nginx-templates: Allow members to manage Nginx templates
            server:manage-services: Allow members to start, stop and restart services
            server:manage-password: Allow members to reset the sudo password
            server:create-keys: Allow members to add SSH keys to servers
            server:delete-keys: Allow members to remove SSH keys from servers
            server:create-monitors: Allow members to create server monitors
            server:delete-monitors: Allow members to delete server monitors
            server:create-databases: Allow members to create databases and database users
            server:delete-databases: Allow members to delete databases and database users
            server:create-backups: Allow members to create database backup configurations
            server:delete-backups: Allow members to delete database backup configurations
            server:create-daemons: Allow members to create daemons
            server:delete-daemons: Allow members to delete daemons
            server:create-schedulers: Allow members to create scheduled jobs
            server:delete-schedulers: Allow members to delete scheduled jobs
            server:web-terminal: Allow members to start web terminal sessions
            site:create: Allow members to create sites
            site:delete: Allow members to delete sites
            site:meta: Allow members to update site meta data such as domain name and aliases
            site:manage-commands: Allow members to run arbitrary commands from the site‘s root directory
            site:manage-deploys: Allow members to deploy the site and update the deployment script
            site:manage-nginx: Allow members to manage the site‘s Nginx configuration file
            site:manage-project: Allow members to install Git repositories, phpMyAdmin and WordPress applications
            site:manage-environment: Allow members to update the site‘s environment file
            site:manage-notifications: Allow members to configure deployment notifications
            site:manage-queues: Allow members to configure queue workers
            site:manage-redirects: Allow members to configure URL redirects
            site:manage-security: Allow members to configure HTTP Basic Authentication
            site:manage-ssl: Allow members to configure SSL and Let‘s Encrypt certificates
            site:manage-integrations: Allow members to manage site integrations
            site:manage-heartbeats: Allow members to manage heartbeats
            credential:view: Allow members to view credentials
            credential:manage: Allow members to manage credentials
            team:view: Allow members to view teams
            team:create: Allow members to create teams
            team:delete: Allow members to delete teams and team members
            recipe:view: Allow members to view recipes
            recipe:manage: Allow members to manage recipes
            billing:manage: Allow members to manage the organization's subscription
            storage:manage: Allow members to manage the organization's storage providers.
            integrations:manage: Allow members to manage the organization's integrations
            user:view: Allow members to view user details
            resources:view: Allow members to view resources
            resources:create-databases: Allow members to create managed database & cache clusters
            resources:delete-databases: Allow members to delete managed database & cache clusters
            resources:manage-databases: Allow members to manage managed database & cache clusters settings
            resources:create-buckets: Allow members to create object storage buckets
            resources:delete-buckets: Allow members to delete object storage buckets
            resources:manage-buckets: Allow members to manage object storage buckets and their access keys