Version 2.1.1792967583 · latest Download OpenAPI Markdown

Replay protection

Replay protection of one site: protected APIs need a one-time token or the app signature headers, otherwise the request is blocked or challenged; can be set for the site alone or restored to the scheme; part of WAF Enhanced.

site-replay-guardsProtectionAuthentication: User (some parameters admin only)3 endpoints

Get site replay protection settings

GET/api/v2/site-replay-guards/{site_id}

Authentication: User (some parameters admin only)

Set site replay protection

PUT/api/v2/site-replay-guards/{site_id}

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
action	ReplayGuardAction	—	Without a token or on replay: block = 403; challenge = JS challenge. Omitted = block. Values `["block","challenge"]`
app_salt	string	—	Signing salt (app key, 32-byte hex); with app_sign on but no salt, signed headers are never accepted.
app_sign	boolean	—	App signed-header mode - requests carrying the signature headers are checked by signature, no token needed.
bind_ip	boolean	—	Also bind the token to the client IP (a new IP invalidates it).
enabled	boolean	Required	Whether enabled.
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (when null, i.e. never set, use 1970-01-01T00:00:00Z). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
methods	ReplayGuardMethod[]	—	Protected methods; omitted = POST/PUT/PATCH/DELETE.
paths	ReplayGuardPath[]	—	Protected API paths, at most 64; empty = nothing protected.
ttl_s	integer	—	Token lifetime in seconds, also used for signed-header timestamps; omitted = 120.

Restore site replay protection to the scheme

DELETE/api/v2/site-replay-guards/{site_id}

Authentication: User (some parameters admin only)

Replay protection object

Field	Type	Required	Description
action	ReplayGuardAction	—	Without a token or on replay: block = 403; challenge = JS challenge. Omitted = block. Values `["block","challenge"]`
app_salt	string	—	Signing salt (app key, 32-byte hex); with app_sign on but no salt, signed headers are never accepted.
app_sign	boolean	—	App signed-header mode - requests carrying the signature headers are checked by signature, no token needed.
bind_ip	boolean	—	Also bind the token to the client IP (a new IP invalidates it).
enabled	boolean	—	Whether enabled.
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (when null, i.e. never set, use 1970-01-01T00:00:00Z). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
gate	string	—	WAF Enhanced status of the site's tenant: full = editable; readonly = expired but within the read-only buffer (License.readonly_days, 7 days by default), still in effect but read-only; basic = not subscribed or past the buffer, not in effect and settings kept. read-onlyValues `["full","readonly","basic"]`
gate_expired_at	string	—	Administrator responses with gate_reason=expired only - when the platform WAF Enhanced license expired; not present in tenant responses. read-only
gate_owner	WafGateOwner	—	The owner of the site, in administrator responses only; tenant responses carry no one else's information. read-only
gate_packages	string[]	—	Administrator responses only - names of the owner's unexpired packages (at most 20); not present in tenant responses. read-only
gate_reason	WafGateReason	—	Why WAF Enhanced (waf_enhanced) is not in effect; absent when gate is full or readonly. package = the platform is licensed but the owner has no unexpired package that includes WAF Enhanced; license = the platform has not enabled it (never licensed, revoked by the provider, or the license was disabled); expired = the platform license has expired and its read-only buffer period (License.readonly_days, default 7 days) has passed, so it fell back to basic. read-onlyValues `["package","license","expired"]`
methods	ReplayGuardMethod[]	—	Protected methods; omitted = POST/PUT/PATCH/DELETE.
paths	ReplayGuardPath[]	—	Protected API paths, at most 64; empty = nothing protected.
site_id	integer	—	Site ID read-only
source	ProtectSiteSource	—	Where the site's setting comes from: scheme = follows the scheme (changes when the scheme is saved); custom = set for this site alone (including turned off and rows migrated from before). read-onlyValues `["scheme","custom"]`
ttl_s	integer	—	Token lifetime in seconds, also used for signed-header timestamps; omitted = 120.
updated_at	string	—	Version (null if never set); use expected_updated_at on update. read-only