Version 2.1.1792967583 · latest Download OpenAPI Markdown

High-risk IP library

The platform-provided high-risk IP library (paid item rules update, synced hourly): status, platform-wide handling policy, entry lookup, whitelisting a single entry and today's visits that hit it; read-only for tenants.

intelProtectionAuthentication: User (some parameters admin only)5 endpoints

Get high-risk IP library status

GET/api/v2/intel

Authentication: User (some parameters admin only)

Whitelist a high-risk IP

POST/api/v2/intel/allow

Authentication: Admin only

Request body application/json

Field	Type	Required	Description
ip	string	Required	Address or network.
reason	string	—	Why it is whitelisted (kept on the whitelist entry); defaults to a fixed note when omitted.

List high-risk IP library entries

GET/api/v2/intel/ips

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
ip	string	—	A single address returns the entry covering it; anything else filters by substring of the CIDR text (admins only; tenants must give a single address).
level	IntelLevel	—	Filter by level. Values `["high","medium"]`
reason	IntelReason	—	Filter by type. Values `["scanner","exploit","cc"]`

Update high-risk IP library policy

PUT/api/v2/intel/policy

Authentication: Admin only

Request body application/json

Field	Type	Required	Description
action	IntelAction	Required	Handling: challenge (pass only after a JS check), block (ban on the site and answer 403), log (record only). Values `["challenge","block","log"]`
level	IntelLevel	Required	Level: high (exploit type or score >= 80); medium. Values `["high","medium"]`

High-risk IPs that visited today

GET/api/v2/intel/visitors

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
site_id	integer	—	Filter by site.

High-risk IP library object

Field	Type	Required	Description
action	IntelAction	Required	Handling: challenge (pass only after a JS check), block (ban on the site and answer 403), log (record only). Values `["challenge","block","log"]`
actions	IntelAction[]	—	Handling applied to it today.
added_at	string	—	When the entry was added (kept when the same IP is written again). read-only
cidr	string	—	Address or network (canonical form).
count	integer	—	Number of entries.
entry	IntelEntry	—	One entry of the high-risk IP library.
error	string	—	Why the latest sync failed (the version in use is kept); empty on success.
expires_at	string	—	Expiry time; empty = permanent. An expired entry stops matching by itself (nodes judge by their own clock, independent of the master); the master then removes it and the next config push carries the removal. Must be in the future when written.
first_seen_at	string	—	When it first entered the library; absent when the library does not say.
generated_at	string	—	When the library was generated (on the super admin side).
halt	string	—	Why updates are halted by the license (expired, disabled, or the super admin unreachable for long) (admins only; not a failure, separate from error; absent when not halted).
high	integer	—	Number of high-risk entries.
hits	integer	—	Hits today.
ip	string	Required	Address or network.
last_at	string	—	Time of the latest hit.
level	IntelLevel	—	Level: high (exploit type or score >= 80); medium. Values `["high","medium"]`
masters	integer	—	Number of controllers that reported it within 24 hours; absent when the library does not say.
medium	integer	—	Number of medium-risk entries.
policy	IntelPolicy	—	Platform-wide policy of the high-risk IP library; the site config field intel.action can override or turn it off.
reason	string	—	Why it is whitelisted (kept on the whitelist entry); defaults to a fixed note when omitted.
reported_at	string	—	When it was last reported.
score	integer	—	Risk score (1-100).
serving	boolean	—	Whether a library is being pushed to nodes (fetched at least once and not expired).
sites	integer	—	Number of sites involved.
source	IpListSource	—	Where the entry came from: manual (added by hand), import (bulk import), ip_detail (blacklisted/whitelisted from the IP detail page), api (written through the API). Values `["manual","import","ip_detail","api"]`
stale	boolean	—	The license no longer carries the library and the last version is over 24 hours old, so it is no longer served.
sub	string	—	Sub-type (for example WAF consecutive hits); absent when the library does not say.
synced_at	string	—	Time of the latest sync.
version	string	—	Version of the library being served; empty if none.