URI restriction using data group list

Try this:

when HTTP_REQUEST {
    if { ( string tolower [HTTP::host]] equals "sample.com" ) and ( [string tolower [HTTP::uri]] starts_with "/xyz-ws" ) } {
        if { [class match [IP::client_addr] equals my_internal_ips] } {
            return
        } else {
            drop
        }
    }
}

Thank you for your answer Kevin but wont that irule redirect all connections with my_internal_ips to sample.com/xyz-ws and then drop any other connection? What I want to do is allow all connections with my_internal_ips to access any URL's on that server ie sample.com/abc, sample.com/def and then redirect any other connections with other IP (public) to /xyz-ws only.

The above basically says:

if the URI is /xyz-ws
    if the client is internal - allow
    if the client is external - drop
else
    allow all

In other words, it only does the IP evaluation if the client requests this specific URL. You didn't mention a redirect in the original post.

Yes sorry Kevin you are right I did not explain it very well in the original post. I am looking to do a URI redirect based on source IP. if the source IP is my_internal_ip then these connections have access to all URLs on the backend server. But, external IP can only access the specific URL http://sample.com/xyz-ws if the URI is /xyz-ws if the client is internal allow if the client is external allow

if the URI is /anythingelse if the client is internal allow if the client is internal drop

Okay then:

when HTTP_REQUEST {
    if { [class match [IP::client_addr] equals my_internal_ips] } {
        return
    } else {
        if { [string tolwer [HTTP::uri]] equals "/xyz-ws" } {
            return
        } else {
            HTTP::redirect "https://[HTTP::host]/xyz-ws"
        }
    }
}

*if the URI is /anythingelse if the client is internal allow if the client is external drop

when HTTP_REQUEST {
    if { [class match [IP::client_addr] equals my_internal_ips] } {
        return
    } else {
        if { [string tolwer [HTTP::uri]] equals "/xyz-ws" } {
            return
        } else {
            drop
        }
    }
}

This says, for all internal clients, return and allow. For external clients, if the URI is /xyz-ws, return and allow, else drop.

That is what I am looking for kevin. Thank you very much for your input and sorry for the initial confusion.