# Replace the cloned login page detection configuration

Replaces your organization's cloned login page detection configuration with
the configuration you send. Any rule you don't include is deleted.
A rule with an `id` updates the existing rule with that `id`. A rule without
an `id` is created. Rules are evaluated in the order you send them, and the
first rule that matches wins.
To change part of the configuration, retrieve it first, apply your changes,
and send the complete configuration back.

Endpoint: PUT /v1/controls/clonedLoginPageDetection/configuration
Version: v1
Security: x-api-key

## Security:

  - `x-api-key` (unknown)
    apiKey in header x-api-key

## Request body:

  - `application/json` (unknown)
    The complete set of rules to save.

## Request fields (application/json):

  - `globals` (object, required)
    Control-wide settings that apply across every rule.

  - `globals.ignoredHosts` (array)
    Hosts ignored by cloned login page detection. Can be a domain (example.com), wildcard (*.example.com), hostname (myhost), or IP address (10.0.1.1).
    Example: ["*.internal.example.com","build-server","10.0.1.1"]

  - `rules` (array, required)
    Complete list of Cloned Login Page Detection rules.

  - `rules.id` (string)
    The rule's unique identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `rules.name` (string, required)
    A short name to help you recognise the rule.
    Example: Warn Finance on cloned login pages

  - `rules.enabled` (boolean, required)
    Whether the rule is active.
    Example: true

  - `rules.mode` (string, required)
    What happens when a cloned login page is detected.
    Enum: "MONITOR", "BLOCK", "WARN", "OFF"

  - `rules.title` (string)
    Heading shown to the user. Required when mode is BLOCK or WARN, and must be omitted when mode is MONITOR or OFF.
    Example: Suspicious login page

  - `rules.subtext` (string)
    Message shown to the user. Markdown is supported. Required when mode is BLOCK or WARN, and must be omitted when mode is MONITOR or OFF.
    Example: This page looks like a cloned login page. Do not enter your credentials.

  - `rules.ignoreButtonText` (string)
    Label for the button that lets the user proceed anyway. Required when mode is WARN, and must be omitted for all other modes.
    Example: Proceed anyway

  - `rules.criteria` (object)
    Restrict the rule to apply only under the specified conditions.

  - `rules.criteria.employeeIds` (object)
    Match specific employees by their employee identifier.
    Example: {"matches":["8c4f1d2e-9a0b-4c1d-8e2f-3a4b5c6d7e8f"]}

  - `rules.criteria.employeeIds.matches` (array, required)
    One or more values to match.

  - `rules.criteria.employeeIds.action` (string)
    Apply the rule to the matched values (INCLUDE) or to everything except them (EXCLUDE). Defaults to INCLUDE when omitted.
    Enum: "INCLUDE", "EXCLUDE"

  - `rules.criteria.employeeGroups` (object)
    Match employees by the groups they belong to.
    Example: {"matches":["Finance","Engineering"]}

## Request examples:

  - `Remove all rules` (unknown)

  - `Warn the Finance group on cloned login pages` (unknown)

  - `Block cloned login pages for everyone` (unknown)

## Response 200:

  - `200` (unknown)
    OK

## Response 200 fields (application/json):

  - `globals` (object, required)
    Control-wide settings that apply across every rule.

  - `globals.ignoredHosts` (array)
    Hosts ignored by cloned login page detection. Can be a domain (example.com), wildcard (*.example.com), hostname (myhost), or IP address (10.0.1.1).
    Example: ["*.internal.example.com","build-server","10.0.1.1"]

  - `rules` (array, required)
    Complete list of Cloned Login Page Detection rules.

  - `rules.id` (string)
    The rule's unique identifier.
    Example: c478966c-f927-411c-b919-179832d3d50c

  - `rules.name` (string, required)
    A short name to help you recognise the rule.
    Example: Warn Finance on cloned login pages

  - `rules.enabled` (boolean, required)
    Whether the rule is active.
    Example: true

  - `rules.mode` (string, required)
    What happens when a cloned login page is detected.
    Enum: "MONITOR", "BLOCK", "WARN", "OFF"

  - `rules.title` (string)
    Heading shown to the user. Required when mode is BLOCK or WARN, and must be omitted when mode is MONITOR or OFF.
    Example: Suspicious login page

  - `rules.subtext` (string)
    Message shown to the user. Markdown is supported. Required when mode is BLOCK or WARN, and must be omitted when mode is MONITOR or OFF.
    Example: This page looks like a cloned login page. Do not enter your credentials.

  - `rules.ignoreButtonText` (string)
    Label for the button that lets the user proceed anyway. Required when mode is WARN, and must be omitted for all other modes.
    Example: Proceed anyway

  - `rules.criteria` (object)
    Restrict the rule to apply only under the specified conditions.

  - `rules.criteria.employeeIds` (object)
    Match specific employees by their employee identifier.
    Example: {"matches":["8c4f1d2e-9a0b-4c1d-8e2f-3a4b5c6d7e8f"]}

  - `rules.criteria.employeeIds.matches` (array, required)
    One or more values to match.

  - `rules.criteria.employeeIds.action` (string)
    Apply the rule to the matched values (INCLUDE) or to everything except them (EXCLUDE). Defaults to INCLUDE when omitted.
    Enum: "INCLUDE", "EXCLUDE"

  - `rules.criteria.employeeGroups` (object)
    Match employees by the groups they belong to.
    Example: {"matches":["Finance","Engineering"]}

## Response 400:

  - `400` (unknown)
    Bad Request

## Response 403:

  - `403` (unknown)
    Forbidden (read-only API key)

## Response 404:

  - `404` (unknown)
    Not Found