Site IP lists
Permanent IP blacklist and whitelist of one site; blacklisted IPs are dropped and whitelisted IPs skip CC and other protections. The site's temporary whitelist on nodes can also be cleared.
site-ip-listsProtectionAuthentication: User (some parameters admin only)7 endpointsGet site IP blacklist and whitelist
GET
/api/v2/site-ip-lists/{site_id}Authentication: User (some parameters admin only)
Set site IP blacklist and whitelist
PUT
/api/v2/site-ip-lists/{site_id}Authentication: User (some parameters admin only)
Request body application/json
| Field | Type | Required | Description |
|---|---|---|---|
| black | string[] | — | Permanent blacklist (a match = connection dropped); the count is limited by protect.black_ip_max. |
| black_items | IpListItem[] | — | Blacklist entries with expiry, reason and source; expired entries are not returned. |
| expected_updated_at | string | — | Optimistic lock - the updated_at as the caller read it (when the read updated_at is null, i.e. never set, use 1970-01-01T00:00:00Z). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check. |
| white | string[] | — | Permanent whitelist (a match = CC and other protections are skipped); the count is limited by protect.white_ip_max. |
| white_items | IpListItem[] | — | Whitelist entries with expiry, reason and source; expired entries are not returned. |
Export site IP list entries
GET
/api/v2/site-ip-lists/{site_id}/exportAuthentication: User (some parameters admin only)
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
| list | string | Required | Which list to export. |
| source | IpListSource | — | Only export entries from this source; omit for all. |
| format | string | — | txt (default, one entry per line) or csv (with header, a source column and a UTF-8 BOM). |
Bulk import site IP list entries
POST
/api/v2/site-ip-lists/{site_id}/importAuthentication: User (some parameters admin only)
Request body application/json
| Field | Type | Required | Description |
|---|---|---|---|
| dry_run | boolean | — | true only checks the file and saves nothing. |
| expected_updated_at | string | — | Optimistic lock - the updated_at as the caller read it (when the read updated_at is null, i.e. never set, use 1970-01-01T00:00:00Z). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check. |
| list | string | Required | Which list to import into. |
| mode | string | — | merge adds to the current list (the imported row wins for the same IP); replace swaps the whole list for the imported rows. |
| text | string | Required | File content (txt/csv), one entry per line: IP/CIDR[,expiry][,reason]. |
IP detail
GET
/api/v2/site-ip-lists/{site_id}/ip-detailAuthentication: User (some parameters admin only)
Query parameters
| Field | Type | Required | Description |
|---|---|---|---|
| ip | string | Required | IPv4 or IPv6 address. |
Blacklist or whitelist from IP detail
POST
/api/v2/site-ip-lists/{site_id}/ip-detailAuthentication: User (some parameters admin only)
Request body application/json
| Field | Type | Required | Description |
|---|---|---|---|
| expires_at | string | — | Expiry time; empty = permanent. Must be in the future. |
| ip | string | Required | Normalized address (IPv4-mapped addresses shown as IPv4). |
| list | string | Required | Which list to import into. |
| reason | string | — | Reason (note), at most 200 characters. |
| scope | string | Required | site = this site's list; global = the global list (admins only). |
Clear site temporary whitelist
POST
/api/v2/site-ip-lists/{site_id}/tmp-white-clearAuthentication: User (some parameters admin only)
Site IP lists object
| Field | Type | Required | Description |
|---|---|---|---|
| added | integer | — | Entries added. |
| applied | boolean | — | Whether the import was saved (false for dry_run or when blocking issues exist). |
| black | string[] | — | Permanent blacklist (a match = connection dropped); the count is limited by protect.black_ip_max. |
| black_items | IpListItem[] | — | Blacklist entries with expiry, reason and source; expired entries are not returned. |
| block_denied | string | — | Why it cannot be blacklisted: private (private/loopback/link-local), node (a node IP; admins only), self (the caller's own IP), other (any other reason; tenants get this for node IPs so node addresses are not revealed); omitted when allowed. |
| dry_run | boolean | — | true only checks the file and saves nothing. |
| expected_updated_at | string | — | Optimistic lock - the updated_at as the caller read it (when the read updated_at is null, i.e. never set, use 1970-01-01T00:00:00Z). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check. |
| expires_at | string | — | Expiry time; empty = permanent. Must be in the future. |
| geo | GeoipLookup | — | IP geolocation lookup result. |
| global_black | IpListItem | — | IP list entry (in IP details, the entry that matches the IP; omitted when none matches). |
| global_white | IpListItem | — | IP list entry (in IP details, the entry that matches the IP; omitted when none matches). |
| ip | string | — | Normalized address (IPv4-mapped addresses shown as IPv4). |
| issues | IpListImportIssue[] | — | Per-line issues (at most 1000, ascending by line). |
| lines | integer | — | Number of valid entries (after de-duplication). |
| list | string | Required | Which list to import into. |
| mode | string | — | merge adds to the current list (the imported row wins for the same IP); replace swaps the whole list for the imported rows. |
| reason | string | — | Reason (note), at most 200 characters. |
| removed | integer | — | In replace mode, existing entries that are not in the new list (entries with the same IP count as updated, not removed). |
| scope | string | Required | site = this site's list; global = the global list (admins only). |
| site_black | IpListItem | — | IP list entry (in IP details, the entry that matches the IP; omitted when none matches). |
| site_id | integer | — | Site ID |
| site_white | IpListItem | — | IP list entry (in IP details, the entry that matches the IP; omitted when none matches). |
| task_id | integer | — | Id of the background task that pushes the change to nodes (poll progress with GET /tasks/{id}). |
| text | string | Required | File content (txt/csv), one entry per line: IP/CIDR[,expiry][,reason]. |
| updated | integer | — | Entries already in the list that were updated by the import. |
| updated_at | string | — | Updated at |
| white | string[] | — | Permanent whitelist (a match = CC and other protections are skipped); the count is limited by protect.white_ip_max. |
| white_items | IpListItem[] | — | Whitelist entries with expiry, reason and source; expired entries are not returned. |