rules:
  # From OrchAdminProfile only.
  - path: /users
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
      LabelProfile: []
  - path: /users/orchadmin/dataloader
    methods: [POST]
    profiles:
      OrchAdminProfile: ['*']
  - path: /auth0/users/bulk
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
      LabelProfile: []
  - path: /auth0/users
    methods: [POST]
    profiles:
      OrchAdminProfile: ['*']
      LabelProfile: []
      SettingsProfile: ['*']
  # Other apps
  - path: /profile/identity/<str>
    methods: [POST]
    profiles:
      PodcastProfile: ['*']
  - path: /profile/profile_id/<int>/profile_type/<str>
    methods: [DELETE]
    profiles:
      PodcastProfile: ['*']
  - path: /profile/profile_id/<str>/profile_type/<str>
    methods: [DELETE]
    profiles:
      PodcastProfile: ['*']
  - path: /profile/uuid/<uuid>
    methods: [ GET ]
    profiles:
      AbacusProfile: ['*']
      PodcastProfile: [ '*' ]
      LabelProfile: [ '*' ]
      InsightsProfile: [ '*' ]
      SettingsProfile: [ '*' ]
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
  - path: /users/identity/<str>/can_unlink_social_account
    methods: [GET]
    profiles:
      LabelProfile: [analytics, administrator]
      InsightsProfile: [analytics, administrator]
      ArtistProfile: [analytics, administrator]
  - path: /users/identity/<str>/unlink_social_account
    methods: [PATCH]
    profiles:
      LabelProfile: [analytics, administrator]
      InsightsProfile: [analytics, administrator]
      ArtistProfile: [analytics, administrator]
  - path: /users/identity/<str>/device
    methods: [POST]
    profiles:
      LabelProfile: [analytics, administrator]
      InsightsProfile: [analytics, administrator]
      ArtistProfile: [analytics, administrator]
  - path: /users/account_managers
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
  - path: /users/closers
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
  # Catalog, Marketing, Analytics, Administrator and Accounting: allow GET session
  - path: /users/session/alw
    methods: [GET]
    profiles:
      LabelProfile: [catalog, marketing, analytics, administrator, accounting]
      OrchAdminProfile: ['*']
  # Same audience as /users/session/alw, used by graphql-user for the workstation account switcher
  - path: /users/<str>/session/<str>/linked-accounts
    methods: [GET]
    profiles:
      LabelProfile: [catalog, marketing, analytics, administrator, accounting]
      OrchAdminProfile: ['*']
  - path: /auth0/add/organization-members
    methods: [POST]
    profiles:
      SettingsProfile: ['*']
      PodcastProfile: ['*']
      CollaboratorsProfile: ['*']

  # from all apps
  - path: /auth0/users/<str>/all-accounts
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      LabelProfile: ['*']
      OrchAdminProfile: ['*']
      SettingsProfile: ['*']
      InsightsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
  - path: /auth0/users/<*>/picture
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      LabelProfile: ['*']
      SettingsProfile: ['*']
      InsightsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
      Account360Profile: ['*']
  - path: /auth0/reset-mfa/<str>
    methods: [DELETE]
    profiles:
      SettingsProfile: ['*']
  - path: /auth0/recovery
    methods: [POST]
    profiles:
      AbacusProfile: ['*']
      SettingsProfile: ['*']
      OrchAdminProfile: []
      LabelProfile: ['*']
      InsightsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
      Account360Profile: ['*']
  - path: /users/identity/<str>/applications
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      SettingsProfile: ['*']
      OrchAdminProfile: []
      LabelProfile: ['*']
      InsightsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
      Account360Profile: ['*']
  - path: /users/identity/<str>
    methods: [PATCH]
    profiles:
      SettingsProfile: ['*']
  - path: /users/identity/<str>/profiles
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      LabelProfile: ['*']
      InsightsProfile: ['*']
      SettingsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
      OrchAdminProfile: ['*']
      Account360Profile: ['*']
  - path: /auth0/organizations/<str>
    methods: [GET]
    profiles:
      SettingsProfile: ['*']
  - path: /auth0/invite/organization-member
    methods: [POST]
    profiles:
      SettingsProfile: ['*']
      CollaboratorsProfile: ['*']
  - path: /auth0/<str>/organizations
    methods: [GET]
    profiles:
      SettingsProfile: ['*']
      InsightsProfile: ['*']
  - path: /users/identity/<str>/zendesk_token/<str>
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      LabelProfile: ['*']
      OrchAdminProfile: ['*']
      SettingsProfile: ['*']
      InsightsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']

  # from Workstation only.
  - path: /auth0/users/<str>
    methods: [GET]
    profiles:
      AbacusProfile: [administrator]
      OrchAdminProfile: []
      LabelProfile: ['*']
  - path: /auth0/send-verification-email
    methods: [POST]
    profiles:
      OrchAdminProfile: []
      LabelProfile: ['*']
      AbacusProfile: ['*']
      PodcastProfile: [ '*' ]
      InsightsProfile: [ '*' ]
      SettingsProfile: [ '*' ]
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
  - path: /users/roles/<str>
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
      LabelProfile: [analytics, administrator]
  - path: /ws/generate-jwt-token/feature-fm
    methods: [GET]
    profiles:
      OrchAdminProfile: []
      LabelProfile: [marketing, analytics, administrator]
  - path: /users/<str>/status
    methods: [PUT]
    profiles:
      OrchAdminProfile: []
      LabelProfile: [administrator]
  - path: /<str>/<str>/users
    methods: [GET]
    profiles:
      OrchAdminProfile: []
      LabelProfile: ['*']
  - path: /ws/agreements/vendor/<int>
    methods: [GET]
    profiles:
      OrchAdminProfile: []
      LabelProfile: ['*']
  - path: /ws/agreements/vendor/<int>
    methods: [POST]
    profiles:
      OrchAdminProfile: []
      LabelProfile: [marketing, administrator]
  - path: /users/identity/<str>
    methods: [GET]
    profiles:
      AbacusProfile: ['*']
      LabelProfile: ['*']
      InsightsProfile: ['*']
      SettingsProfile: ['*']
      MoneyhubProfile: ['*']
      CollaboratorsProfile: ['*']
      PublishingProfile: ['*']
      NRProfile: ['*']
      SongwhipProfile: ['*']
      ContentProfile: ['*']
      DistributionProfile: ['*']
      DocumentsProfile: ['*']
      AudienceProfile: ['*']
      PodcastProfile: ['*']
      OrchAdminProfile: ['*']
      Account360Profile: ['*']
  # All these endpoints dont have any headers in datadog logs. so dont allow from any context calls.
  # backend, script or auth0 calls only
  - path: /users/get-LabelProfile-users-by-email
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/<str>/minimum-details
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/<str>/session/<str>/raw
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/verify-login
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /auth0/users
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /auth0/users/<str>
    methods: [PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
      SettingsProfile: ['*']
  - path: /users/bulk-auth0-password-reset
    methods: [POST]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/auth0-update
    methods: [POST]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/LabelProfile/<str>
    methods: [PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/auth0/single-signon
    methods: [POST]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/auth0/email/<*>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
      SettingsProfile: ['*']
  - path: /users/auth0/<str>/primary
    methods: [PUT]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
      SettingsProfile: ['*']
  - path: /ws/users/roles/<int>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/<str>/auth0/deactivate/<str>
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/document
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /profile/profile_id/<int>/profile_type/<str>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /profile/profile_id/<str>/profile_type/<str>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /profile/profile_id/<int>/profile_type/<str>
    methods: [PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /profile/profile_id/<str>/profile_type/<str>
    methods: [PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity
    methods: [POST]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity/<str>
    methods: [PATCH, DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /ows/<str>/<str>/primary-contact
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity/<str>/device
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity/email
    methods: [GET, PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity/email/<*>
    methods: [GET]
    profiles:
      SettingsProfile: ['*']
      CollaboratorsProfile: ['*']
  - path: /users/identity/email/<*>/valid-invitation
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']
  - path: /users/identity/<str>/device/<str>
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/identity/<str>/profile/<str>/<int>
    methods: [POST, DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []

  # Not called in last 1 month. so log any access before we delete these endpoints.
  - path: /users/<str>/session/<str>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /auth0/users/<str>
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /auth0/reset-users/<str>
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /ws/generate-token/<str>
    methods: [GET]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /auth0/reset-user/<str>
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /ws/agreements/vendor
    methods: [DELETE]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /logout/identity/<str>
    methods: [POST]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /ows/users/identity/email
    methods: [PATCH]
    profiles:
      LabelProfile: []
      OrchAdminProfile: []
  - path: /users/product_managers
    methods: [GET]
    profiles:
      OrchAdminProfile: ['*']