Country access policy (GeoIP)

Allow or deny requests by client country (GeoIP), with optional country-header enrichment for the backend.


Type	`geoBlock`
Category	Security

Fields

Field	Type	Required	Default	Description
`action`	one of `ALLOW`, `DENY`	yes	`ALLOW`	ALLOW = allowlist (only these countries pass); DENY = blocklist.
`countries`	list of text	yes	—	ISO 3166-1 alpha-2 codes, e.g. US, FR, DE.
`allowUnknown`	true/false	no	`true`	When the country can't be resolved (no GeoIP database, private IP), allow the request. Off = block (fail-closed).
`addCountryHeader`	text	no	—	Inject the resolved country to the backend under this header, e.g. X-Country-Code.
`statusCode`	number	no	`403`	HTTP status returned for a blocked request.
`message`	text	no	—	Response body for a blocked request.