Citrix SecurSpaces™

Network policy fields

September 18, 2026

Contributed by:

The fields available in the expert-mode YAML editor for a Citrix SecurSpaces™ network policy. For how to reach the editor, see Create a network policy.

Policy fields

Field	Type	Required	Description
`name`	string	Yes	The policy name. Must not be empty.
`description`	string	Yes	What the policy does. Must not be empty.
`restrictedTraffic`	boolean	Yes	`true` restricts outbound traffic to attached resources and the allow list. `false` monitors traffic without blocking.
`customEndpointsEnabled`	boolean	No	Enables the custom-endpoints-via-proxy allow lists. Relevant only when the platform uses an external proxy.
`whitelistedDomains`	list of domain entries	No	Domains the workspace is allowed to reach.
`whitelistedIps`	list of strings	No	IPv4 addresses or CIDR ranges the workspace is allowed to reach.
`customEndpointsViaProxyDomains`	list of domain entries	No	Domains reachable through the external proxy. Used only when `customEndpointsEnabled` is `true`.
`customEndpointsViaProxyIps`	list of strings	No	IPv4 addresses or CIDR ranges reachable through the external proxy. Used only when `customEndpointsEnabled` is `true`.

Important:

The editor rejects any field that is not in this table. A policy containing an unrecognized field does not validate.

Domain entries

Each entry in whitelistedDomains and customEndpointsViaProxyDomains has this shape.

Field	Type	Description
`domain`	string	The domain to allow, for example `example.com`.
`includeSubdomains`	boolean	When `true`, the domain and all of its subdomains are allowed.

The two lists validate domain differently:

In whitelistedDomains, the value must be a plain domain name, such as example.com or pypi.internal.example.com. Use includeSubdomains to cover subdomains rather than writing a wildcard.
In customEndpointsViaProxyDomains, a leading prefix is accepted, so a value such as *.example.com validates.

IP address entries

whitelistedIps and customEndpointsViaProxyIps accept:

A single IPv4 address, for example 192.168.1.50.
An IPv4 CIDR range with a prefix length from /0 to /32, for example 10.0.0.0/24.

IPv6 addresses are not accepted.

Example

name: Backend services policy
description: Restrict workspaces to internal package mirrors and the corporate API.
restrictedTraffic: true
whitelistedDomains:
  - domain: pypi.internal.example.com
    includeSubdomains: false
  - domain: example.com
    includeSubdomains: true
whitelistedIps:
  - 10.0.0.0/24
  - 192.168.1.50
<!--NeedCopy-->

Note:

When customEndpointsEnabled is false, the custom-endpoints lists are ignored and cleared. Set those fields only when an external proxy is in use.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

Network policy fields

September 18, 2026

Contributed by:

September 18, 2026

Contributed by:

Network policy fields

Policy fields

Domain entries

IP address entries

Example

Related information

In this article