> For the complete documentation index, see [llms.txt](/llms.txt)

# GS2-Guard API Reference

Cheat prevention, WAF, and blocking policy feature




Provides a mechanism to protect the game from unauthorized access.

A `BlockingPolicyModel` can be configured per namespace in GS2-Guard, where the access control rules are described.
By referencing the target GS2-Guard namespace from the namespace of each GS2 microservice, the blocking policy is applied to API requests to that microservice.

All decisions are made based on the source IP address and region of the request. Five detection conditions are available.

1. Restriction by country/region (`locationDetection`)
List the target countries and regions in `locations`, and choose with `locationRestriction` whether to allow or deny access that matches.

2. Restriction by anonymous IP such as Tor or VPN (`anonymousIpDetection`)

3. Restriction by hosting provider IP (`hostingProviderIpDetection`)

4. Restriction by low-reputation IP (`reputationIpDetection`)

Conditions 2 through 4 only deny the matching access; there is no setting to allow it.

5. Restriction by IP address (`ipAddressesDetection`)
List the target IP addresses in `ipAddresses`, and choose with `ipAddressRestriction` whether to allow or deny access that matches.

Each detection condition takes either "disabled" or "enabled", and all of them are disabled by default.
The corresponding restriction (Restriction) is applied only while the detection condition is enabled.

How access that matches none of the detection conditions is handled is determined by `defaultRestriction`, which defaults to "Allow".
By setting `defaultRestriction` to "Allow" and combining "Deny" in individual conditions, you can build a blacklist-style policy.
Conversely, by setting `defaultRestriction` to "Deny" and allowing exceptions with `locations` or `ipAddresses`, you can build a whitelist-style policy.
`passServices` lists the microservices that the blocking policy is not applied to, such as GS2-Account and GS2-Auth.

GS2-Guard is not a service used on its own; it takes effect only once it is referenced from the namespace of another microservice.

[Introduction to Microservices / GS2-Guard](../../microservices/guard)



- [GS2-Guard Deploy/CDK Reference](/api_reference/guard/deploy/)
  
- [GS2-Guard SDK API Reference](/api_reference/guard/sdk/)