#Website rules

Limit which sites a proxy may reach: a block list (the listed sites are blocked, everything else works) or an allow list (only the listed sites work, everything else is blocked). The rules are enforced on your box by the agent, so the box must run agent 1.3.0 or newer — agent_supported tells you; older agents keep the rules but do not apply them.

• Entries are cleaned up for you: lower-case, international names stored as punycode (bücher.example → xn--bcher-kva.example), a pasted URL keeps only its host, duplicates are dropped. At most 500 entries per proxy.
• Raw IP destinations: allow list → blocked unless that IP is listed; block list → allowed unless listed.
• A blocked HTTP request gets 403 with the body Blocked by proxy policy (header X-Hyp-Blocked: policy); a blocked HTTPS (CONNECT) request gets 403 before the tunnel opens; a blocked SOCKS5 connection is refused (reply code 2, "not allowed by ruleset").
• HTTPS is judged by the site name the client asks the proxy for. Nothing is decrypted, so an app that connects by IP (in block-list mode) or hides the real site behind a CDN cannot be told apart.
• Rotation, SMS and the dongle's own controls are never affected. Changes reach the box within one heartbeat (~15 s); open connections keep running until they close.

#Get the rules

Ability: read

curl 'https://proxykite.com/api/v1/proxies/7/rules' \
  -H "Authorization: Bearer $HYP_TOKEN" \
  -H 'Accept: application/json'

import os
import requests

r = requests.get(
    "https://proxykite.com/api/v1/proxies/7/rules",
    headers={"Authorization": f"Bearer {os.environ['HYP_TOKEN']}", "Accept": "application/json"},
    timeout=30,
)
print(r.status_code, r.json())

const res = await fetch('https://proxykite.com/api/v1/proxies/7/rules', {
  headers: {
    Authorization: `Bearer ${process.env.HYP_TOKEN}`,
    Accept: 'application/json',
  },
  signal: AbortSignal.timeout(30000),
});
console.log(res.status, await res.json());

<?php
$ch = curl_init('https://proxykite.com/api/v1/proxies/7/rules');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('HYP_TOKEN'),
        'Accept: application/json',
    ],
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
var_dump($status, json_decode($body, true));

Response 200

{"data": {"mode": "blocklist", "domains": ["facebook.com", "*.tiktok.com", "203.0.113.9"],
  "max_entries": 500, "agent_version": "1.3.0", "agent_supported": true}}

mode is off, blocklist or allowlist. With off the list is kept (so you can switch it back on) but nothing is blocked.

#Set the rules

Ability: manage · Who: the account owner or a team admin (not team viewers, not reseller sub-users).

curl -X PUT 'https://proxykite.com/api/v1/proxies/7/rules' \
  -H "Authorization: Bearer $HYP_TOKEN" \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{"mode":"allowlist","domains":["example.com","*.example.org"]}'

import os
import requests

r = requests.put(
    "https://proxykite.com/api/v1/proxies/7/rules",
    headers={"Authorization": f"Bearer {os.environ['HYP_TOKEN']}", "Accept": "application/json"},
    json={"mode": "allowlist", "domains": ["example.com", "*.example.org"]},
    timeout=30,
)
print(r.status_code, r.json())

const res = await fetch('https://proxykite.com/api/v1/proxies/7/rules', {
  method: 'PUT',
  headers: {
    Authorization: `Bearer ${process.env.HYP_TOKEN}`,
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({"mode":"allowlist","domains":["example.com","*.example.org"]}),
  signal: AbortSignal.timeout(30000),
});
console.log(res.status, await res.json());

<?php
$ch = curl_init('https://proxykite.com/api/v1/proxies/7/rules');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'PUT',
    CURLOPT_TIMEOUT => 30,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('HYP_TOKEN'),
        'Accept: application/json',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => '{"mode":"allowlist","domains":["example.com","*.example.org"]}',
]);
$body = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
var_dump($status, json_decode($body, true));

Response 200 — the rules object as in Get the rules.

422 validation_failed (fields.domains) names the entries that are not a domain, *.domain or IP, a list over 500 entries, or an empty allow list (it would block every site). fields.mode for an unknown mode.