How to restrict access to a specific AEAT procedure

Overview

This guide explains how to block access to a single procedure within the Agencia Estatal de Administración Tributaria (AEAT) site while keeping the rest of the AEAT available, using the modelo 190 as the example. It is useful for administrators who need to restrict one procedure without closing off the whole site.

Background

A procedure can be reached through more than one URL, so blocking a single one isn't enough. The modelo 190 has two routes:

• A direct URL, where the fiscal year is just a path segment — one pattern covers every year.
• An indirect route (for example, the modelo 303 dropdown), which loads the procedure through the AEAT's shared document-verification endpoint, identified by a per-year CSV — so you add one rule per year.

You capture both and combine them in a single site group. For the reasoning behind this pattern, see Scoping access to a specific procedure.

Before you begin

Make sure you have the following:

• A policy that already allows the AEAT site for the certificates and users involved. The deny policy you create here takes priority over it.
• Access to the modelo 190, so you can capture the URLs that reach it.

Step 1: Capture the procedure URLs

1. Sign in to the AEAT.

2. Find and open the modelo 190 (direct path). A single pattern covers every year:

   www1.agenciatributaria.gob.es/wlpl/PAIN-M190/*

3. Open the modelo 190 through the modelo 303. Copy the document-verification URL from the address bar. It follows this pattern:

   www1.agenciatributaria.gob.es/wlpl/KATA-APLI/cotejo/CotejoIdSv?CSV=YEAR_CSV

YEAR_CSV is your Código Seguro de Verificación for that fiscal year. Because it changes every year, capture a new URL for each year you want to block.

Step 2: Create the site group

1. Go to Policies > Sites > Add sites group.

2. In Sites group name, enter AEAT modelo 190.

3. For the direct path, select Site and add:

   www1.agenciatributaria.gob.es/wlpl/PAIN-M190/*

4. For the indirect path, select Regular expression and add one expression per year, each pinning that year's CSV:

   .*agenciatributaria\.gob\.es/wlpl/KATA\-APLI/cotejo/CotejoIdSv.*YEAR_CSV

   Replace YEAR_CSV with the same Código Seguro de Verificación you captured in Step 1.

5. Click Apply.

note

Add a new indirect expression for each fiscal year you block. The CotejoIdSv endpoint is shared by all document verifications, so the CSV must be exact — see Scoping access to a specific procedure.

Step 3: Create the deny policy

1. Go to Policies > New.
2. In General, enter Deny modelo 190 in Name, set Action to Deny, and set Priority higher than the policy that allows the AEAT (the lower the number, the higher the priority). Click Next.
3. In Certificates, add the relevant certificate or certificate group. Click Next.
4. In Who?, add the users or user groups. Click Next.
5. In Where?, click Add sites, select AEAT modelo 190, click Add > Next, then click Apply.

Step 4: Verify

1. Browse to the direct URL https://www1.agenciatributaria.gob.es/wlpl/PAIN-M190/E2025/index.zul. Access is blocked.
2. Reach the modelo 190 through the modelo 303 dropdown. Access is blocked.
3. Access another AEAT procedure. Access is allowed.

Each blocked attempt is recorded in Events.

Summary

You now have a site group that covers both routes to the modelo 190 and a high-priority policy that denies it, while the rest of the AEAT stays available.

Next steps

• To block a different AEAT procedure, capture its URLs the same way and repeat these steps.
• To understand why the direct path needs only one rule while the indirect path needs a rule per year, the allowlist alternative, and what falls outside Redtrust's control, see How Redtrust controls certificate use.