For Developers

Origin Policy Overview

By Dakota Gordon

Last Updated October 2nd, 2026

An Origin Policy defines network-level security and firewall rules evaluated whenever inbound requests reach Edlink resources. Origin policies allow teams to restrict access by IP address ranges (CIDRs), geographical regions (country codes), and proxy networks (commercial VPNs and Tor exit nodes).

Origin policies can be evaluated across multiple scopes within Edlink:

Team: Protects all general team operations and administrative resources.
Application: Restricts API calls made to a specific developer application integration.
Dashboard: Protects access to the Edlink management dashboard for team administrators and collaborators.
District: Scoped to specific district or institutional connections.

Evaluation Modes

Each origin policy operates under one of three evaluation modes:

enforcing: The policy actively blocks any requests that violate configured rules with an HTTP 403 Forbidden response.
monitoring: The policy evaluates incoming traffic and logs outcome decisions without blocking traffic, allowing you to test firewall rules before enforcing them.
disabled: The policy is inactive and skipped during request evaluation.

Fallback Outcomes & Proxy Controls

Origin policies define default outcomes when an incoming request does not match an explicit CIDR or Geo rule:

ip_default_outcome: Specifies whether an IP address is allowed or denied if it does not match any configured CIDR rule.
geo_default_outcome: Specifies whether a request is allowed or denied if its client location does not match any configured Geo rule.
vpn_outcome: Specifies the outcome (allowed or denied) when incoming traffic is detected from commercial VPN providers or datacenters.
tor_outcome: Specifies the outcome (allowed or denied) when incoming traffic is detected from Tor exit relays.

Child Rule Types

Origin policies evaluate two primary collections of granular rules:

CIDR Rules (OriginPolicyCidr): IPv4 or IPv6 network subnets (e.g. 192.168.1.0/24 or 10.0.0.0/8) with explicit allowed or denied outcomes and optional administrative labels.
Geo Rules (OriginPolicyGeo): ISO 3166-1 alpha-2 country codes (e.g. US, CA, GB) defining permitted or restricted nations.

Origin Policy Properties

Property	Type	Description
`id`	UUID	Unique identifier for the origin policy.
`created_date`	Date	Date when the origin policy was created.
`updated_date`	Date	Timestamp of the last policy update.
`type`	String	Declared policy scope: `team`, `application`, `dashboard`, or `district`.
`evaluation_mode`	String	Policy evaluation mode: `enforcing`, `monitoring`, or `disabled`.
`ip_default_outcome`	String	Default outcome for unmatched IP addresses: `allowed` or `denied`.
`geo_default_outcome`	String	Default outcome for unmatched geographical regions: `allowed` or `denied`.
`vpn_outcome`	String	Action taken for traffic from VPN proxies: `allowed` or `denied`.
`tor_outcome`	String	Action taken for traffic from Tor exit nodes: `allowed` or `denied`.
`team_id`	UUID	Unique identifier of the team that owns the policy.
`configuration`	Object	Scope-specific sidecar configuration (e.g. `application_id` for application-scoped policies).

Origin Policy CIDR Properties

Property	Type	Description
`id`	UUID	Unique identifier for the CIDR rule.
`network`	String	IPv4 or IPv6 CIDR block specification (e.g. `203.0.113.0/24`).
`outcome`	String	Evaluation outcome: `allowed` or `denied`.
`label`	String	Optional human-readable description for the network rule.
`system_controlled`	Boolean	Indicates whether the rule is managed automatically by Edlink.
`enabled`	Boolean	Whether the rule is actively considered during policy evaluation.

Origin Policy Geo Properties

Property	Type	Description
`id`	UUID	Unique identifier for the geographical restriction rule.
`country_code`	String	Two-letter ISO 3166-1 alpha-2 country code (e.g. `US`).

JSON Example

{
    "id": "7fa194a2-1982-4f91-8841-59128aa10234",
    "created_date": "2024-04-12T08:00:00.000Z",
    "updated_date": "2024-04-12T08:00:00.000Z",
    "type": "application",
    "evaluation_mode": "enforcing",
    "ip_default_outcome": "denied",
    "geo_default_outcome": "allowed",
    "vpn_outcome": "denied",
    "tor_outcome": "denied",
    "team_id": "6a9e99a8-e165-4d0d-9b7d-6062a4be682d",
    "configuration": {
        "application_id": "035d6dd6-1569-47b2-8ed8-63435be58078"
    }
}

Let's build something great together.

Talk to an Expert

Get Help With Your Integration

Create an Account