## High-risk IP library (`intel`)

The platform-provided high-risk IP library (paid item rules update, synced hourly): status, platform-wide handling policy, entry lookup, whitelisting a single entry and today's visits that hit it; read-only for tenants.

Authentication: User (some parameters admin only) · Docs: https://www-demo.kuxitong.com/en/docs/api/intel

### GET `/api/v2/intel`

Get high-risk IP library status · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/intel" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/intel/allow`

Whitelist a high-risk IP · Authentication: Admin only

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `ip` | string | Yes | Address or network. |
| `reason` | string |  | Why it is whitelisted (kept on the whitelist entry); defaults to a fixed note when omitted. |

```sh
curl -X POST "https://panel.example.com/api/v2/intel/allow" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"192.0.2.10"}'
```

### GET `/api/v2/intel/ips`

List high-risk IP library entries · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `ip` | string |  | A single address returns the entry covering it; anything else filters by substring of the CIDR text (admins only; tenants must give a single address). |
| `level` | IntelLevel |  | Filter by level. Values: ["high","medium"] |
| `reason` | IntelReason |  | Filter by type. Values: ["scanner","exploit","cc"] |

```sh
curl "https://panel.example.com/api/v2/intel/ips" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PUT `/api/v2/intel/policy`

Update high-risk IP library policy · Authentication: Admin only

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `action` | IntelAction | Yes | Handling: challenge (pass only after a JS check), block (ban on the site and answer 403), log (record only). Values: ["challenge","block","log"] |
| `level` | IntelLevel | Yes | Level: high (exploit type or score >= 80); medium. Values: ["high","medium"] |

```sh
curl -X PUT "https://panel.example.com/api/v2/intel/policy" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"challenge","level":"high"}'
```

### GET `/api/v2/intel/visitors`

High-risk IPs that visited today · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |
| `site_id` | integer |  | Filter by site. |

```sh
curl "https://panel.example.com/api/v2/intel/visitors" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

High-risk IP library object:

| Field | Type | Required | Description |
|---|---|---|---|
| `action` | IntelAction | Yes | Handling: challenge (pass only after a JS check), block (ban on the site and answer 403), log (record only). Values: ["challenge","block","log"] |
| `actions` | IntelAction[] |  | Handling applied to it today. |
| `added_at` | string |  | When the entry was added (kept when the same IP is written again). (read-only) |
| `cidr` | string |  | Address or network (canonical form). |
| `count` | integer |  | Number of entries. |
| `entry` | IntelEntry |  | One entry of the high-risk IP library. |
| `error` | string |  | Why the latest sync failed (the version in use is kept); empty on success. |
| `expires_at` | string |  | Expiry time; empty = permanent. An expired entry stops matching by itself (nodes judge by their own clock, independent of the master); the master then removes it and the next config push carries the removal. Must be in the future when written. |
| `first_seen_at` | string |  | When it first entered the library; absent when the library does not say. |
| `generated_at` | string |  | When the library was generated (on the super admin side). |
| `halt` | string |  | Why updates are halted by the license (expired, disabled, or the super admin unreachable for long) (admins only; not a failure, separate from error; absent when not halted). |
| `high` | integer |  | Number of high-risk entries. |
| `hits` | integer |  | Hits today. |
| `ip` | string | Yes | Address or network. |
| `last_at` | string |  | Time of the latest hit. |
| `level` | IntelLevel |  | Level: high (exploit type or score >= 80); medium. Values: ["high","medium"] |
| `masters` | integer |  | Number of controllers that reported it within 24 hours; absent when the library does not say. |
| `medium` | integer |  | Number of medium-risk entries. |
| `policy` | IntelPolicy |  | Platform-wide policy of the high-risk IP library; the site config field intel.action can override or turn it off. |
| `reason` | string |  | Why it is whitelisted (kept on the whitelist entry); defaults to a fixed note when omitted. |
| `reported_at` | string |  | When it was last reported. |
| `score` | integer |  | Risk score (1-100). |
| `serving` | boolean |  | Whether a library is being pushed to nodes (fetched at least once and not expired). |
| `sites` | integer |  | Number of sites involved. |
| `source` | IpListSource |  | Where the entry came from: manual (added by hand), import (bulk import), ip_detail (blacklisted/whitelisted from the IP detail page), api (written through the API). Values: ["manual","import","ip_detail","api"] |
| `stale` | boolean |  | The license no longer carries the library and the last version is over 24 hours old, so it is no longer served. |
| `sub` | string |  | Sub-type (for example WAF consecutive hits); absent when the library does not say. |
| `synced_at` | string |  | Time of the latest sync. |
| `version` | string |  | Version of the library being served; empty if none. |