Network policy fields

Last published : Oct 20, 2026
The fields available in the expert-mode YAML editor for a Citrix SecurSpaces™ network policy. For how to reach the editor, see Create a network policy.
Related information
Reference

Policy fields

Field Type Required Description
name string Yes The policy name. Must not be empty.
description string Yes What the policy does. Must not be empty.
restrictedTraffic boolean Yes true restricts outbound traffic to attached resources and the allow list. false monitors traffic without blocking.
customEndpointsEnabled boolean No Enables the custom-endpoints-via-proxy allow lists. Relevant only when the platform uses an external proxy.
whitelistedDomains list of domain entries No Domains the workspace is allowed to reach.
whitelistedIps list of strings No IPv4 addresses or CIDR ranges the workspace is allowed to reach.
customEndpointsViaProxyDomains list of domain entries No Domains reachable through the external proxy. Used only when customEndpointsEnabled is true.
customEndpointsViaProxyIps list of strings No IPv4 addresses or CIDR ranges reachable through the external proxy. Used only when customEndpointsEnabled is true.
Important:
The editor rejects any field that is not in this table. A policy containing an unrecognized field does not validate.

Domain entries

Each entry in whitelistedDomains and customEndpointsViaProxyDomains has this shape.
Field Type Description
domain string The domain to allow, for example example.com.
includeSubdomains boolean When true, the domain and all of its subdomains are allowed.
The two lists validate domain differently:
  • In whitelistedDomains, the value must be a plain domain name, such as example.com or pypi.internal.example.com. Use includeSubdomains to cover subdomains rather than writing a wildcard.
  • In customEndpointsViaProxyDomains, a leading prefix is accepted, so a value such as *.example.com validates.

IP address entries

whitelistedIps and customEndpointsViaProxyIps accept:
  • A single IPv4 address, for example 192.168.1.50.
  • An IPv4 CIDR range with a prefix length from /0 to /32, for example 10.0.0.0/24.
IPv6 addresses are not accepted.

Example

name: Backend services policy
description: Restrict workspaces to internal package mirrors and the corporate API.
restrictedTraffic: true
whitelistedDomains:
  - domain: pypi.internal.example.com
    includeSubdomains: false
  - domain: example.com
    includeSubdomains: true
whitelistedIps:
  - 10.0.0.0/24
  - 192.168.1.50
Note:
When customEndpointsEnabled is false, the custom-endpoints lists are ignored and cleared. Set those fields only when an external proxy is in use.