Restricting Open URLs¶

This feature enhances the existing Restrict Opening URLs security policy by moving from a binary allow-all or block-all model to a flexible allowlist-based approach. Administrators can maintain a high level of security (Data Loss Prevention) while selectively permitting specific, necessary actions — such as making phone calls or opening corporate documentation.

When the Restrict Opening URLs setting is set to Restricted (Allowlisted), only URLs that match an allowlist entry are permitted to open in external applications or browsers. All other URLs are blocked.

For client-side enforcement, see the platform-specific guides: * Print Data and Opening URLs Restriction for Android * Print Data and Opening URLs Restriction for iOS

Opening URLs Settings¶

The Restrict Opening URLs dropdown in mobile services cockpit maps to the following backend behavior:

Setting	Backend value	Allowlist section
Unrestricted	`"openingURLs": "unrestricted"`	Hidden
Blocked (All)	`"openingURLs": "blocked"` with empty allowlist	Hidden
Restricted (Allowlisted)	`"openingURLs": "blocked"` with allowlist entries	Visible and active

Note

The allowlist management section is only visible when Restrict Opening URLs is set to Restricted (Allowlisted). Selecting Blocked (All) preserves the previous all-or-nothing security posture without exposing the allowlist interface.

Configure the URL Allowlist¶

In mobile services cockpit, select Mobile Applications > Native/MDK.
Select an application, navigate to the Settings tab, and select Client Settings.
On the Client Configuration tab, under Application Management Policies, set Restrict Opening URLs to Restricted (Allowlisted). This displays the allowlist section.
Select to open the Add Allowlist dialog.
Select a Type from the dropdown and enter a Value in the text field.
Select OK to add the entry.
Repeat steps 4 to 6 for each additional entry. A maximum of 50 entries is allowed.
Select Save.

Allowlist Entry Types¶

Each allowlist entry requires a Type and a Value. The placeholder text in the Value field changes dynamically based on the selected type.

Type	Description	Example value
Scheme	Allows all URLs using the specified protocol handler. The value must contain exactly one colon character.	`mailto:`, `tel:`, `sms:`
URL	Allows a specific URL or URL pattern. Wildcards (`*`) are supported. IPv6 addresses are supported.	`https://help.sap.com/*`, `https://[2001:db8::1]/`
Regex	Allows URLs matching the specified compilable regular expression.	`^https://.\.sap\.com/.$`

Validation¶

The following validation rules apply to allowlist entries. If any entry fails validation, an error message is displayed and the configuration is not saved.

A maximum of 50 entries is allowed.
For Scheme entries: The value must match a standard protocol handler format and contain exactly one colon character. Error message: Invalid scheme format. Please enter a valid protocol handler containing exactly one colon (e.g., mailto:).
For URL entries: The value must be a valid, absolute URL. IPv6 addresses are supported. Error message: Invalid URL format. Please enter a valid, complete URL (e.g., https://sap.com/ or https://[2001:db8::1]/).
For Regex entries: The value must be a valid, compilable regular expression. Error message: Invalid regular expression. Please check your syntax and enter a valid pattern.

JSON Representation¶

The allowlist is stored as part of the application configuration under securityPolicy within settingsExchange. The following example shows a security policy configuration with allowlist entries:

{
  "securityPolicy": {
    "clipboard": "blocked",
    "openingURLs": "blocked",
    "openUrlAllowlist": [
      { "type": "scheme", "value": "tel:" },
      { "type": "url", "value": "https://help.sap.com/*" },
      { "type": "regex", "value": "^https://.*\\.sap\\.com/.*$" }
    ]
  }
}

Well-Known Configuration¶

The allowlist is delivered to mobile clients as part of the well-known instance configuration endpoint GET /mobileservices/v1/.well-known/instance/configuration. The response includes the allowlist under featureVectorPolicies:

{
  "featureVectorPolicies": {
    "open-urls-disabled": true,
    "open-urls-allowlist": [
      { "type": "scheme", "value": "tel:" },
      { "type": "url", "value": "https://help.sap.com/*" },
      { "type": "regex", "value": "^https://.*\\.sap\\.com/.*$" }
    ]
  }
}

If openingURLs is not set to blocked, the open-urls-disabled value is false and the allowlist is not enforced by the client.

Last update: September 14, 2026