Create Download Rule

Create a download rule for a repository. Download rules can block a matching download or hide matching package metadata from clients.

Allowed Roles: Workspace Admin or System Admin • Authentication Required • Local or remote repositories only

Notes: Requires the Download Rules feature (Pro self-hosted plan or higher); otherwise this endpoint returns 403. The server can enforce a maximum number of download rules per repository. Use the list endpoint first to inspect the supported fields and operators for the repository. Remote repositories cannot use hide mode with CVE scan fields; use block for those rules.

POST https://api.repoflow.io/1/workspaces/<workspace-ref>/repositories/<repository-ref>/download-rules

Path Parameters

workspace-refstringRequired

Workspace ID or name.

repository-refstringRequired

Repository ID or name.

Body

namestringRequired

Download rule name.

descriptionstring | nullOptional

Optional description.

isEnabledbooleanRequired

Whether the rule should be active.

targetType"package" | "version"Optional

Rule target. Recommended; when omitted, the server infers it from ruleJson when possible.

mode"block" | "hide"Required

block denies matching downloads. hide removes matching items from metadata and direct requests. hide is rejected for remote repositories when ruleJson uses CVE scan fields.

ruleJsonobjectRequired

Rule conditions. Supports condition leaves and and, or, not groups.

missingScanBehaviorOverride"wait_for_scan" | "deny_while_scanning" | "allow_while_scanning" | nullOptional

Optional per-rule override for rules that use CVE scan fields.

cveScanMaxAgeHoursnumber | nullOptional

Rule-level maximum accepted CVE scan age in hours. Use null to never expire existing scans for this rule.

Request

Command Line

curl -sS -X POST "https://api.repoflow.io/1/workspaces/<workspace-ref>/repositories/<repository-ref>/download-rules" \
  -H "Authorization: Bearer <admin-token>" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Block high CVEs",
    "description": "Block versions with at least one high CVE",
    "isEnabled": true,
    "targetType": "version",
    "mode": "block",
    "ruleJson": {
      "conditions": {
        "field": "highCveCount",
        "operator": "GREATER_THAN",
        "value": 0
      }
    },
    "missingScanBehaviorOverride": null,
    "cveScanMaxAgeHours": 168
  }'

Response

{
  "id": "c2c2c2c2-2222-4444-8888-111111111111",
  "repositoryId": "1910c2ac-62c9-4ffb-888a-84daec3aa3e1",
  "workspaceId": "0a8e6f52-3c44-4c9b-b0c5-9f2d7a1e6b3a",
  "name": "Block high CVEs",
  "description": "Block versions with at least one high CVE",
  "isEnabled": true,
  "targetType": "version",
  "mode": "block",
  "ruleJson": {
      "conditions": {
          "field": "highCveCount",
          "operator": "GREATER_THAN",
          "value": 0
      }
  },
  "missingScanBehaviorOverride": null,
  "cveScanMaxAgeHours": 168,
  "createdAt": "2026-05-04T08:00:00.000Z",
  "updatedAt": "2026-05-04T08:00:00.000Z",
  "enforcementCount": 0,
  "lastEnforcedAt": null
}