Operation details
GET /v1/security/autodefense/blocks
Ban list entries with source autodefense
- operationId
listAutoDefenseBlocks- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseBlocks Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | query | string(uuid) | No | — |
|---|
ip | query | any | any | No | — |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseBlocks Responses| Status | Description |
|---|
200 | Ban list entries with source autodefense. Fields：items: array<BlockEntry> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/blocks/{block_id}/release
Unblock (Lua and kernel), optionally whitelist and report a false positive
- operationId
releaseAutoDefenseBlock- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
releaseAutoDefenseBlock Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
block_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
releaseAutoDefenseBlock Request body| Name | Type | Required | Description |
|---|
whitelist | boolean | No | 解除并加白 (IP |
|---|
allow_until | object | No | When the 解除并加白 entry expires (absent = permanent; only with whitelist; after now and within 365 days). An entry already listed keeps the longer expiry. |
|---|
false_positive | boolean | No | 标记误判; reason is then required and a false_positive_report is audited. |
|---|
reason | string | No | — |
|---|
Responses
releaseAutoDefenseBlock Responses| Status | Description |
|---|
200 | What the release undid. Fields：site_id: string(uuid) released_targets: array<string> shadowed_signatures: array<string> whitelisted: array<string> allows: array<SiteAllow> observe_until?: string(date-time) false_positive_id?: string(uuid) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/events
Attack event timeline, newest first
- operationId
listAutoDefenseEvents- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseEvents Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | query | string(uuid) | No | — |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseEvents Responses| Status | Description |
|---|
200 | Attack events. Fields：items: array<Event> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/false-positives
False positive reports
- operationId
listAutoDefenseFalsePositives- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseFalsePositives Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | query | string(uuid) | No | — |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseFalsePositives Responses| Status | Description |
|---|
200 | False positive reports. Fields：items: array<FalsePositive> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/false-positives
Report a verdict or signature as a false positive (the signature is withdrawn at once)
- operationId
reportAutoDefenseFalsePositive- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
reportAutoDefenseFalsePositive Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
Request body
application/json · Required：Yes
reportAutoDefenseFalsePositive Request body| Name | Type | Required | Description |
|---|
site_id | string(uuid) | Yes | — |
|---|
verdict_id | string(uuid) | No | — |
|---|
signature_id | string | No | — |
|---|
reason | object | Yes | — |
|---|
Responses
reportAutoDefenseFalsePositive Responses| Status | Description |
|---|
201 | The recorded report. Fields：id: string(uuid) site_id: string(uuid) tenant_scope_id: string(uuid) verdict_id?: string(uuid) block_id?: string(uuid) signature_id?: string target?: string reason: string reported_by: string created_at: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/metrics
Per site report figures of the last 30 days (mitigations, false positive reports, attack events)
- operationId
listAutoDefenseSiteMetrics- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSiteMetrics Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
Responses
listAutoDefenseSiteMetrics Responses| Status | Description |
|---|
200 | Report figures per live site of the tenant (at most 500). Fields：items: array<SiteMetrics> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/signatures
Automatic rules (signatures)
- operationId
listAutoDefenseSignatures- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSignatures Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | query | string(uuid) | No | — |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseSignatures Responses| Status | Description |
|---|
200 | Automatic rules. Fields：items: array<Signature> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/signatures/{signature_id}/revoke
禁用此签名
- operationId
revokeAutoDefenseSignature- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
revokeAutoDefenseSignature Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
signature_id | path | string | Yes | SHA-256 of the canonical conditions, first 16 hex digits (contract 3.4). |
|---|
Request body
application/json · Required：No
Responses
revokeAutoDefenseSignature Responses| Status | Description |
|---|
200 | One automatic rule. Fields：id: string site_id: string(uuid) tenant_scope_id: string(uuid) conditions: array<object> stage: string: shadow / challenge / block / standby cover_permille: integer fpr_ppm: integer hits: integer reason: string managed: boolean solidified_kind?: string: waf / cc solidified_rule_id?: string(uuid) solidified_pack_id?: string solidified_version?: string revoked: boolean origin: string: node / control origin_node_id?: string(uuid) evaluation: object scope: string: site / tenant / none created_at: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/signatures/{signature_id}/solidify
固化为我的规则: becomes a user WAF/CC rule and leaves automatic management
- operationId
solidifyAutoDefenseSignature- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Description (from the contract)
Writes the signature as the tenant's user-layer rule pack user/<tenant>/autodefense-<id> (one rule: waf block or cc JS challenge), enables it on the site and publishes the site's rule pack mounts with the three-layer conflict check. 409 autodefense_rule_conflict: the pack conflicts with the site's other enabled packs (nothing is written); 422 autodefense_not_compilable: a condition a user rule cannot match (ua, header order, behaviour buckets; cc has no JA4 / IP library match). The automatic signature is then withdrawn from every node.
Parameters
solidifyAutoDefenseSignature Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
signature_id | path | string | Yes | SHA-256 of the canonical conditions, first 16 hex digits (contract 3.4). |
|---|
Request body
application/json · Required：Yes
solidifyAutoDefenseSignature Request body| Name | Type | Required | Description |
|---|
kind | string: waf / cc | Yes | — |
|---|
Responses
solidifyAutoDefenseSignature Responses| Status | Description |
|---|
200 | One automatic rule. Fields：id: string site_id: string(uuid) tenant_scope_id: string(uuid) conditions: array<object> stage: string: shadow / challenge / block / standby cover_permille: integer fpr_ppm: integer hits: integer reason: string managed: boolean solidified_kind?: string: waf / cc solidified_rule_id?: string(uuid) solidified_pack_id?: string solidified_version?: string revoked: boolean origin: string: node / control origin_node_id?: string(uuid) evaluation: object scope: string: site / tenant / none created_at: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites
Sites with mode, baseline maturity, circuit, overlay and the auto-mitigation grant
- operationId
listAutoDefenseSites- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSites Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseSites Responses| Status | Description |
|---|
200 | Sites of the tenant. Fields：items: array<Site> auto_mitigation_granted: boolean |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/mode
Batch 开始学习 / 仅观察 / 开始防护 / 关闭 / 恢复跟随平台 (follow); protect needs module.autodefense.auto; one audit event per site
- operationId
setAutoDefenseSiteModes- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense module.autodefense.auto
Parameters
setAutoDefenseSiteModes Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
Request body
application/json · Required：Yes
setAutoDefenseSiteModes Request body| Name | Type | Required | Description |
|---|
site_ids | array<string(uuid)> | Yes | — |
|---|
mode | string: off / learning / observe / protect / follow | Yes | The site's own mode; follow = 跟随平台 (the site takes the platform default_mode and changes with it). |
|---|
confirm | boolean | Yes | Batch operations need an explicit confirmation. |
|---|
Responses
setAutoDefenseSiteModes Responses| Status | Description |
|---|
200 | The sites and their mode before and after. Fields：items: array<object> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}
One site with its overlay
- operationId
getAutoDefenseSite- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
getAutoDefenseSite Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
getAutoDefenseSite Responses| Status | Description |
|---|
200 | One site with the snapshot delivery state of every node serving it. Fields：site_id: string(uuid) tenant_scope_id: string(uuid) domain: string tenant_name: string state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale current_level: integer last_event_reason?: string mode: string: off / learning / observe / protect follow_platform: boolean sensitivity: string: low / medium / high maturity: string: prior / hour / day / week cross_site: boolean circuit: Circuit observe_until?: string(date-time) last_event_at?: string(date-time) revision: integer updated_at: string(date-time) auto_mitigation_granted: boolean overlay: string: active / frozen / inactive max_level: Item modules: array<Module> drifts?: array<Drift> nodes: array<SiteNode> unsupported_nodes: array<string> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PATCH /v1/security/autodefense/sites/{site_id}
Sensitivity and cross-site federation (revision guarded)
- operationId
updateAutoDefenseSite- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
updateAutoDefenseSite Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
updateAutoDefenseSite Request body| Name | Type | Required | Description |
|---|
sensitivity | string: low / medium / high | No | — |
|---|
cross_site | boolean | No | — |
|---|
revision | integer | Yes | — |
|---|
Responses
updateAutoDefenseSite Responses| Status | Description |
|---|
200 | One site. Fields：site_id: string(uuid) tenant_scope_id: string(uuid) domain: string tenant_name: string state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale current_level: integer last_event_reason?: string mode: string: off / learning / observe / protect follow_platform: boolean sensitivity: string: low / medium / high maturity: string: prior / hour / day / week cross_site: boolean circuit: Circuit observe_until?: string(date-time) last_event_at?: string(date-time) revision: integer updated_at: string(date-time) auto_mitigation_granted: boolean overlay: string: active / frozen / inactive max_level: Item modules: array<Module> drifts?: array<Drift> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/allows
白名单: the site's allow list as the nodes get it (ACL allow rules = user, 解除并加白 = release, admin sign-in sources = admin_login); never mitigated
- operationId
listAutoDefenseSiteAllows- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSiteAllows Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
listAutoDefenseSiteAllows Responses| Status | Description |
|---|
200 | The site's allow list in CIDR order. Fields：items: array<SiteAllow> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/allows/remove
移出白名单: remove one 解除并加白 entry (ACL allows are edited in the ACL policy; admin sign-in sources expire)
- operationId
removeAutoDefenseSiteAllow- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
removeAutoDefenseSiteAllow Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
removeAutoDefenseSiteAllow Request body| Name | Type | Required | Description |
|---|
cidr | string | No | The 解除并加白 entry (IP address or network). |
|---|
ja4 | string | No | The 解除并加白 entry (JA4 fingerprint). |
|---|
Responses
removeAutoDefenseSiteAllow Responses| Status | Description |
|---|
200 | The removed allow list entry. Fields：cidr?: string ja4?: string source: string: user / release / admin_login until?: string(date-time) created_by?: string created_at?: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/circuit/resume
恢复自动防护: close the site circuit the nodes reported open (Q6: a second break within 24 hours needs a person)
- operationId
resumeAutoDefenseSiteCircuit- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense module.autodefense.auto
Parameters
resumeAutoDefenseSiteCircuit Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：No
Responses
resumeAutoDefenseSiteCircuit Responses| Status | Description |
|---|
200 | One site. Fields：site_id: string(uuid) tenant_scope_id: string(uuid) domain: string tenant_name: string state: string: normal / surge / protect_origin / attack / cooldown / circuit_open / baseline_stale current_level: integer last_event_reason?: string mode: string: off / learning / observe / protect follow_platform: boolean sensitivity: string: low / medium / high maturity: string: prior / hour / day / week cross_site: boolean circuit: Circuit observe_until?: string(date-time) last_event_at?: string(date-time) revision: integer updated_at: string(date-time) auto_mitigation_granted: boolean overlay: string: active / frozen / inactive max_level: Item modules: array<Module> drifts?: array<Drift> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/drifts/confirm
确认基线漂移: confirm the site's pending baseline drifts (node baselines are not changed)
- operationId
confirmAutoDefenseSiteDrifts- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
confirmAutoDefenseSiteDrifts Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：No
Responses
confirmAutoDefenseSiteDrifts Responses| Status | Description |
|---|
200 | The drifts the confirmation changed (empty when none was pending). Fields：items: array<Drift> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/modules
Modules site (site.max_level), bot, cc, scan, waf with every item state 自动/人工
- operationId
listAutoDefenseSiteModules- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSiteModules Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
listAutoDefenseSiteModules Responses| Status | Description |
|---|
200 | Modules with their items. Fields：items: array<Module> auto_mitigation_granted: boolean overlay: string: active / frozen / inactive |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/modules/{module}/history
Item changes, newest first: node adjustments, 人工 locks, 恢复自动, range edits
- operationId
listAutoDefenseSiteModuleHistory- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSiteModuleHistory Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseSiteModuleHistory Responses| Status | Description |
|---|
200 | Item changes, newest first. Fields：items: array<HistoryEntry> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PUT /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field}
A person sets the item: it becomes manual and runs on this value until resumed (Q3)
- operationId
lockAutoDefenseSiteItem- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
lockAutoDefenseSiteItem Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
field | path | string | Yes | A field of the frozen registry of the module; waf.group:<slug> per rule group. |
|---|
Request body
application/json · Required：Yes
lockAutoDefenseSiteItem Request body| Name | Type | Required | Description |
|---|
value | integer | Yes | Within the field platform range; enum fields take the ordinal, bool 0 or 1. |
|---|
Responses
lockAutoDefenseSiteItem Responses| Status | Description |
|---|
200 | The locked item. Fields：field: string kind: string: int / enum / bool unit?: string enum?: array<string> state: string: auto / manual manual: integer auto?: integer min: integer max: integer platform_min: integer platform_max: integer effective: integer suggestion?: integer locked_by?: string locked_at?: string(date-time) resumed_by?: string resumed_at?: string(date-time) frozen_until?: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PUT /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/range
Narrow the item's automatic range (上下限); state and manual value unchanged
- operationId
setAutoDefenseSiteItemRange- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
setAutoDefenseSiteItemRange Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
field | path | string | Yes | A field of the frozen registry of the module; waf.group:<slug> per rule group. |
|---|
Request body
application/json · Required：Yes
setAutoDefenseSiteItemRange Request body| Name | Type | Required | Description |
|---|
min | integer | Yes | Within the field platform range, min <= max; bound to the manual value as the field requires. |
|---|
max | integer | Yes | — |
|---|
Responses
setAutoDefenseSiteItemRange Responses| Status | Description |
|---|
200 | The locked item. Fields：field: string kind: string: int / enum / bool unit?: string enum?: array<string> state: string: auto / manual manual: integer auto?: integer min: integer max: integer platform_min: integer platform_max: integer effective: integer suggestion?: integer locked_by?: string locked_at?: string(date-time) resumed_by?: string resumed_at?: string(date-time) frozen_until?: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/modules/{module}/items/{field}/resume
恢复自动 for one item
- operationId
resumeAutoDefenseSiteItem- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense module.autodefense.auto
Parameters
resumeAutoDefenseSiteItem Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
field | path | string | Yes | A field of the frozen registry of the module; waf.group:<slug> per rule group. |
|---|
Request body
application/json · Required：No
Responses
resumeAutoDefenseSiteItem Responses| Status | Description |
|---|
200 | Items that changed (empty when nothing was manual). Fields：items: array<Item> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PUT /v1/security/autodefense/sites/{site_id}/modules/{module}/mode
manual / auto / suggest; auto needs module.autodefense.auto
- operationId
setAutoDefenseSiteModuleMode- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense module.autodefense.auto
Parameters
setAutoDefenseSiteModuleMode Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
Request body
application/json · Required：Yes
setAutoDefenseSiteModuleMode Request body| Name | Type | Required | Description |
|---|
mode | string: manual / auto / suggest | Yes | — |
|---|
Responses
setAutoDefenseSiteModuleMode Responses| Status | Description |
|---|
200 | The module mode now in force. Fields：module: string mode: string: manual / auto / suggest |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/modules/{module}/resume
全部恢复自动: every manual item of the module returns to automatic
- operationId
resumeAutoDefenseSiteModule- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense module.autodefense.auto
Parameters
resumeAutoDefenseSiteModule Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
Request body
application/json · Required：No
Responses
resumeAutoDefenseSiteModule Responses| Status | Description |
|---|
200 | Items that changed (empty when nothing was manual). Fields：items: array<Item> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/modules/{module}/values
Each node's newest value of every item (in force or suggested) and its reason
- operationId
listAutoDefenseSiteModuleValues- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseSiteModuleValues Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
module | path | string: site / bot / cc / scan / waf | Yes | site holds the single item site.max_level (no module mode). |
|---|
Responses
listAutoDefenseSiteModuleValues Responses| Status | Description |
|---|
200 | Each node's newest value per item. Fields：items: array<NodeValue> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/release
一键解除: undo every automatic mitigation and hold the site in observe only (default 30 minutes)
- operationId
releaseAutoDefenseSite- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
releaseAutoDefenseSite Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
releaseAutoDefenseSite Request body| Name | Type | Required | Description |
|---|
observe_minutes | integer | No | 0 = no observe-only hold. |
|---|
reason | string | No | — |
|---|
Responses
releaseAutoDefenseSite Responses| Status | Description |
|---|
200 | What the release undid. Fields：site_id: string(uuid) released_targets: array<string> shadowed_signatures: array<string> whitelisted: array<string> allows: array<SiteAllow> observe_until?: string(date-time) false_positive_id?: string(uuid) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/releases/retry
重试: every serving node applies and answers the release again (retry + 1, at most 100; audited release_retry)
- operationId
retryAutoDefenseRelease- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
retryAutoDefenseRelease Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
retryAutoDefenseRelease Request body| Name | Type | Required | Description |
|---|
kind | string: ip / cidr / ja4 | Yes | — |
|---|
target | string | Yes | — |
|---|
Responses
retryAutoDefenseRelease Responses| Status | Description |
|---|
200 | The per node delivery of a single release. Fields：site_id: string(uuid) kind: string: ip / cidr / ja4 target: string released_at: string(date-time) retry: integer state: string: pending / applied / partial_failed / no_nodes nodes: array<object> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/releases/status
解除状态: per node delivery of the site's single release of one target (已保存 → 待节点 → 全部节点已生效 / 部分失败)
- operationId
getAutoDefenseReleaseStatus- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
getAutoDefenseReleaseStatus Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
kind | query | string: ip / cidr / ja4 | Yes | — |
|---|
target | query | string | Yes | — |
|---|
Responses
getAutoDefenseReleaseStatus Responses| Status | Description |
|---|
200 | The per node delivery of a single release. Fields：site_id: string(uuid) kind: string: ip / cidr / ja4 target: string released_at: string(date-time) retry: integer state: string: pending / applied / partial_failed / no_nodes nodes: array<object> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/sites/{site_id}/waf-adapt
Adaptive WAF (智能自动): exclusions by stage with merged evidence, typed parameters, grey zone challenge, rule advice
- operationId
getAutoDefenseSiteWAFAdapt- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：waf_adapt.read
Required features：module.autodefense
Parameters
getAutoDefenseSiteWAFAdapt Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
getAutoDefenseSiteWAFAdapt Responses| Status | Description |
|---|
200 | The site's adaptive WAF state. Fields：site_id: string(uuid) runtime: object automatic: boolean auto_granted: boolean waf_mode: string: manual / auto / suggest frozen: boolean grey_challenge: object grey_repeat: object revision: integer evaluated_at: string(date-time) | null settings: object exclusions: array<WAFExclusion> typed_params: array<object> rule_advice: array<object> limits: object node_limits: array<object> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/sites/{site_id}/waf-adapt/exclusions/{exclusion_id}/{action}
A person's decision: adopt (采纳, a manual exclusion), reject (驳回), revoke (撤销), manual (设为人工), resume (恢复自动); module.autodefense only
- operationId
decideAutoDefenseSiteWAFExclusion- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：waf_adapt.manage
Required features：module.autodefense
Parameters
decideAutoDefenseSiteWAFExclusion Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
exclusion_id | path | string | Yes | WAFExclusionID (SHA-256 of "<rule>:<loc>:<name>", first 16 hex digits). |
|---|
action | path | string: adopt / reject / revoke / manual / resume | Yes | — |
|---|
Request body
application/json · Required：No
Responses
decideAutoDefenseSiteWAFExclusion Responses| Status | Description |
|---|
200 | The exclusion after the decision. Fields：id: string rule: integer rule_set: string rule_set_name: string param: object stage: string: candidate / shadow / suggested / active / rejected stage_since: string(date-time) until: string(date-time) | null manual: string: none / exclude / keep manual_by: string | null manual_at: string(date-time) | null rejections: integer reject_reason: string: false_positive / attack / unneeded | null permanent: boolean cooldown_until: string(date-time) | null value_type: string: number / ident / text / json / binary / url len_bucket: integer evidence: object flipped: integer flipped_attack: integer first_seen: string(date-time) last_seen: string(date-time) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PUT /v1/security/autodefense/sites/{site_id}/waf-adapt/grey-challenge
Grey zone challenge inherit / on / off (only 严格 / 极严格 tiers challenge)
- operationId
setAutoDefenseSiteGreyChallenge- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：waf_adapt.manage
Required features：module.autodefense
Parameters
setAutoDefenseSiteGreyChallenge Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
setAutoDefenseSiteGreyChallenge Request body| Name | Type | Required | Description |
|---|
value | string: inherit / on / off | Yes | — |
|---|
Responses
setAutoDefenseSiteGreyChallenge Responses| Status | Description |
|---|
200 | The grey zone challenge before and after. Fields：before: string: inherit / on / off value: string: inherit / on / off |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
PUT /v1/security/autodefense/sites/{site_id}/waf-adapt/grey-repeat
Repeated grey zone source threshold / window of the site (null = node defaults 20 / 60 s)
- operationId
setAutoDefenseSiteGreyRepeat- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：waf_adapt.manage
Required features：module.autodefense
Description (from the contract)
Only nodes declaring CAPABILITY_NAME_WAF_REPEAT_SITE use the site value; other nodes keep the defaults.
Parameters
setAutoDefenseSiteGreyRepeat Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
setAutoDefenseSiteGreyRepeat Request body| Name | Type | Required | Description |
|---|
value | GreyRepeat | null | Yes | — |
|---|
Responses
setAutoDefenseSiteGreyRepeat Responses| Status | Description |
|---|
200 | The repeat setting before and after (null = node defaults). Fields：before: GreyRepeat | null value: GreyRepeat | null |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/autodefense/verdicts
Recent individual verdicts
- operationId
listAutoDefenseVerdicts- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Required features：module.autodefense
Parameters
listAutoDefenseVerdicts Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
site_id | query | string(uuid) | No | — |
|---|
ip | query | any | any | No | — |
|---|
limit | query | integer | No | — |
|---|
Responses
listAutoDefenseVerdicts Responses| Status | Description |
|---|
200 | Verdicts. Fields：items: array<Verdict> |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
POST /v1/security/autodefense/verdicts/{verdict_id}/release
解除 / 解除并加白 / 标记误判
- operationId
releaseAutoDefenseVerdict- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.autodefense
Parameters
releaseAutoDefenseVerdict Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | Echoed in X-Request-ID and error.request_id; generated when absent. |
|---|
verdict_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
releaseAutoDefenseVerdict Request body| Name | Type | Required | Description |
|---|
whitelist | boolean | No | 解除并加白 (IP |
|---|
allow_until | object | No | When the 解除并加白 entry expires (absent = permanent; only with whitelist; after now and within 365 days). An entry already listed keeps the longer expiry. |
|---|
false_positive | boolean | No | 标记误判; reason is then required and a false_positive_report is audited. |
|---|
reason | string | No | — |
|---|
Responses
releaseAutoDefenseVerdict Responses| Status | Description |
|---|
200 | What the release undid. Fields：site_id: string(uuid) released_targets: array<string> shadowed_signatures: array<string> whitelisted: array<string> allows: array<SiteAllow> observe_until?: string(date-time) false_positive_id?: string(uuid) |
|---|
default | ErrorEnvelope; entitlement_feature_denied carries error.capability.feature. |
|---|
↑ Back to list
GET /v1/security/cc-stats
Read the CC rule statistics of a site of the session tenant
- operationId
getSiteCCStats- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Parameters
getSiteCCStats Parameters| Name | In | Type | Required | Description |
|---|
site_id | query | string(uuid) | Yes | — |
|---|
range | query | string: 1h / 6h / 24h | No | 1h (1 minute steps, default), 6h (5 minutes) or 24h (15 minutes). |
|---|
Responses
getSiteCCStats Responses| Status | Description |
|---|
200 | The site's CC rule statistics. Fields：tenant_scope_id: string(uuid) range: string: 1h / 6h / 24h site_id: string(uuid) from: string(date-time) to: string(date-time) step_seconds: integer: 60 / 300 / 900 series: array<object> rules: array<object> top_clients: array<Top> top_paths: array<Top> |
|---|
400 | Error. |
|---|
401 | Error. |
|---|
403 | Error. |
|---|
404 | Error. |
|---|
405 | Error. |
|---|
503 | Error. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
GET /v1/security/escalate/sites/{site_id}
Read a site's attack escalation settings, thresholds in force and state
- operationId
getEscalateSite- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Parameters
getEscalateSite Parameters| Name | In | Type | Required | Description |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
getEscalateSite Responses| Status | Description |
|---|
200 | The site's settings, its package's ranges, the thresholds in force and its state. Fields：settings: object policy: Policy effective: object state: State |
|---|
400 | Error. |
|---|
401 | Error. |
|---|
403 | Error. |
|---|
404 | Error. |
|---|
409 | Error. |
|---|
503 | Error. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
PUT /v1/security/escalate/sites/{site_id}
Switch attack escalation on or off for a site and set its thresholds inside the package ranges
- operationId
putEscalateSite- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.escalate
Parameters
putEscalateSite Parameters| Name | In | Type | Required | Description |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Request body
application/json · Required：Yes
putEscalateSite Request body| Name | Type | Required | Description |
|---|
enabled | boolean | Yes | — |
|---|
thresholds | SiteThresholds | Yes | — |
|---|
revision | integer(int64) | Yes | — |
|---|
Responses
putEscalateSite Responses| Status | Description |
|---|
200 | The site's settings, its package's ranges, the thresholds in force and its state. Fields：settings: object policy: Policy effective: object state: State |
|---|
400 | Error. |
|---|
401 | Error. |
|---|
403 | Error. |
|---|
404 | Error. |
|---|
409 | Error. |
|---|
422 | Error. |
|---|
503 | Error. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
POST /v1/security/escalate/sites/{site_id}/cname-changed
Confirm the site's domain now points at the CNAME split off for escalation
- operationId
confirmEscalateCNAMEChange- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Required features：module.escalate
Description (from the contract)
A site on a package-mode (shared) CNAME gets a site-mode CNAME at its first escalation; until the owner points the domain at it the site's state shows pending_reason cname_change_required.
Parameters
confirmEscalateCNAMEChange Parameters| Name | In | Type | Required | Description |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
confirmEscalateCNAMEChange Responses| Status | Description |
|---|
200 | Whether a confirmation was recorded, and the site. Fields：recorded: boolean site: SiteResponse |
|---|
400 | Error. |
|---|
401 | Error. |
|---|
403 | Error. |
|---|
404 | Error. |
|---|
409 | Error. |
|---|
503 | Error. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
GET /v1/security/escalate/sites/{site_id}/events
List a site's level history, newest first (100 rows)
- operationId
listEscalateSiteEvents- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Parameters
listEscalateSiteEvents Parameters| Name | In | Type | Required | Description |
|---|
site_id | path | string(uuid) | Yes | — |
|---|
Responses
listEscalateSiteEvents Responses| Status | Description |
|---|
200 | Level history, newest first. Fields：items: array<Event> |
|---|
400 | Error. |
|---|
401 | Error. |
|---|
403 | Error. |
|---|
404 | Error. |
|---|
503 | Error. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
POST /v1/security/ja4-blocks
Create a tenant-scoped JA4 block from one authoritative ranking snapshot
- operationId
createTenantJA4BlockWorkflow- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.manage
Parameters
createTenantJA4BlockWorkflow Parameters| Name | In | Type | Required | Description |
|---|
X-Request-ID | header | string | No | — |
|---|
Idempotency-Key | header | string | Yes | — |
|---|
If-Match | header | string | Yes | — |
|---|
X-Step-Up-Token | header | string | Yes | Single-use proof consumed by the configured step-up verifier; never persisted. |
|---|
Request body
application/json · Required：Yes
createTenantJA4BlockWorkflow Request body| Name | Type | Required | Description |
|---|
site_id | string(uuid) | Yes | — |
|---|
ja4 | string | Yes | — |
|---|
snapshot_at | string(date-time) | Yes | — |
|---|
duration_seconds | integer | Yes | — |
|---|
reason | string | Yes | — |
|---|
Responses
createTenantJA4BlockWorkflow Responses| Status | Description |
|---|
202 | Durable workflow created or exact idempotent replay returned. Fields：id: string(uuid) tenant_scope_id: string(uuid) site_id: string(uuid) ja4_sha256: string snapshot_at: string(date-time) duration_seconds: integer reason: string phase: string: queued / policy_ready / edge_pending / active / failed / expired revision: integer policy_id?: string(uuid) policy_revision?: integer binding_id?: string(uuid) binding_revision?: integer edge_publication_id?: string(uuid) rollout_id: string(uuid) edge_state: string: / pending / active / failed / rolled_back attempt_count: integer last_error_code?: string replayed?: boolean |
|---|
400 | Stable error response. |
|---|
401 | Stable error response. |
|---|
403 | Stable error response. |
|---|
409 | Stable error response. |
|---|
412 | Stable error response. |
|---|
428 | Stable error response. |
|---|
503 | Stable error response. |
|---|
What to do on failure
400 Fix the parameters or body per the field list; do not retry unchanged.401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.409 Read the current state first; a retry of the same operation keeps the original Idempotency-Key and body.412 The revision changed: read the latest ETag, decide again, then send the new If-Match.428 A precondition is missing: read the resource and send If-Match (or the required proof).503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list
GET /v1/security/ja4-blocks/{workflow_id}
Get fixed JA4 block policy, binding, publication, and rollout state
- operationId
getTenantJA4BlockWorkflow- Auth
- Session: the Bearer session of a signed-in control plane user, used by the customer in their own control plane; a plugin must never ask for it.
- Required permissions
All of：security_policies.read
Parameters
getTenantJA4BlockWorkflow Parameters| Name | In | Type | Required | Description |
|---|
workflow_id | path | string(uuid) | Yes | — |
|---|
X-Request-ID | header | string | No | — |
|---|
Responses
getTenantJA4BlockWorkflow Responses| Status | Description |
|---|
200 | Fixed workflow state; raw access events are never returned. Fields：id: string(uuid) tenant_scope_id: string(uuid) site_id: string(uuid) ja4_sha256: string snapshot_at: string(date-time) duration_seconds: integer reason: string phase: string: queued / policy_ready / edge_pending / active / failed / expired revision: integer policy_id?: string(uuid) policy_revision?: integer binding_id?: string(uuid) binding_revision?: integer edge_publication_id?: string(uuid) rollout_id: string(uuid) edge_state: string: / pending / active / failed / rolled_back attempt_count: integer last_error_code?: string replayed?: boolean |
|---|
401 | Stable error response. |
|---|
403 | Stable error response. |
|---|
404 | Stable error response. |
|---|
503 | Stable error response. |
|---|
What to do on failure
401 Check the credential format and whether it expired or was rotated.403 Check the key scopes, the owner’s current permissions and the tenant scope; never switch to a more privileged account.404 The resource does not exist or belongs to another tenant.503 A dependency is unavailable: retry later with the original Idempotency-Key.
↑ Back to list