---
title: Rule Conditions
url: https://docs.kaltura.com/docs/rich-media-cms-apis/content-management/access-control-rule-conditions
---

## Rule Conditions


### Condition Types

| Condition ObjectType | Type Value | Description |
|---------------------|------------|-------------|
| `KalturaIpAddressCondition` | IP_ADDRESS (3) | Match by IP address or CIDR range |
| `KalturaCountryCondition` | COUNTRY (2) | Match by country code (derived from IP) |
| `KalturaSiteCondition` | SITE (4) | Match by referring domain (wildcards supported) |
| `KalturaUserAgentCondition` | USER_AGENT (5) | Match by user-agent string (regex supported) |
| `KalturaAuthenticatedCondition` | AUTHENTICATED (1) | Require valid KS with specific privileges |
| `KalturaFieldMatchCondition` | FIELD_MATCH (6) | Match text field against values |
| `KalturaFieldCompareCondition` | FIELD_COMPARE (7) | Compare numeric field against values |
| `KalturaMatchMetadataCondition` | metadata.FieldMatch | Match metadata XML field text against values |
| `KalturaCompareMetadataCondition` | metadata.FieldCompare | Compare metadata XML field number against values |

All conditions support a `not` boolean field -- when `true`, the condition matches when the test FAILS (logical negation).

### IP Address Condition


```bash
# Block all IPs except internal network
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaIpAddressCondition" \
-d "accessControlProfile[rules][0][conditions][0][not]=true" \
-d "accessControlProfile[rules][0][conditions][0][values][0][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][0][value]=192.168.1.0/24"
```


### Country Condition


```bash
# Block viewers outside US and Canada
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaCountryCondition" \
-d "accessControlProfile[rules][0][conditions][0][not]=true" \
-d "accessControlProfile[rules][0][conditions][0][values][0][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][0][value]=US" \
-d "accessControlProfile[rules][0][conditions][0][values][1][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][1][value]=CA"
```


### Site/Domain Condition


```bash
# Allow only from publisher.com and subdomains
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaSiteCondition" \
-d "accessControlProfile[rules][0][conditions][0][not]=true" \
-d "accessControlProfile[rules][0][conditions][0][values][0][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][0][value]=*.publisher.com"
```


### User Agent Condition


```bash
# Match iPad devices (regex)
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaUserAgentCondition" \
-d "accessControlProfile[rules][0][conditions][0][values][0][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][0][value]=.*iPad.*"
```


### Authenticated Condition


```bash
# Require valid KS
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaAuthenticatedCondition"
```


This condition validates at the entry level when assigned to entry-specific access control.

### Metadata Conditions

Match or compare values from a custom metadata profile's XML fields. Metadata conditions use `profileId` (the metadata profile ID) and `xPath` (the field path within the XML).

**xPath formats:**

- Full path: `/metadata/myElementName`  
- Local-name function: `/*[local-name()='metadata']/*[local-name()='myElementName']`  
- Short form: `myElementName` (searched as `//myElementName`)  

**Match metadata text field:**


```bash
# Block if AudioLanguage is NOT French
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaMatchMetadataCondition" \
-d "accessControlProfile[rules][0][conditions][0][xPath]=AudioLanguage" \
-d "accessControlProfile[rules][0][conditions][0][profileId]=$METADATA_PROFILE_ID" \
-d "accessControlProfile[rules][0][conditions][0][not]=true" \
-d "accessControlProfile[rules][0][conditions][0][values][0][objectType]=KalturaStringValue" \
-d "accessControlProfile[rules][0][conditions][0][values][0][value]=French"
```


**Compare metadata numeric field (scheduling):**


```bash
# Allow if current time >= entry's ipadSunrise metadata field
-d "accessControlProfile[rules][0][conditions][0][objectType]=KalturaCompareMetadataCondition" \
-d "accessControlProfile[rules][0][conditions][0][comparison]=4" \
-d "accessControlProfile[rules][0][conditions][0][xPath]=ipadSunrise" \
-d "accessControlProfile[rules][0][conditions][0][profileId]=$METADATA_PROFILE_ID" \
-d "accessControlProfile[rules][0][conditions][0][value][objectType]=KalturaTimeContextField"
```


**Comparison operators:** 1=LESS_THAN, 2=LESS_THAN_OR_EQUAL, 3=GREATER_THAN, 4=GREATER_THAN_OR_EQUAL, 5=EQUAL

### Field Match and Compare Conditions

For generic field matching (not metadata-specific), use `KalturaFieldMatchCondition` and `KalturaFieldCompareCondition`. These use field objects:

**String field implementations:**

- `KalturaCountryContextField` -- current request's country  
- `KalturaIpAddressContextField` -- current request's IP  
- `KalturaUserAgentContextField` -- current request's user agent  
- `KalturaUserEmailContextField` -- current session's user email  

**Integer field implementations:**

- `KalturaTimeContextField` -- current server time (Unix timestamp)