Version 2.1.1792967583 · latest Download OpenAPI Markdown

Network-wide URL protection settings

Platform-wide default switch and thresholds for network-wide URL protection; admin only. Per-site switch and thresholds live in the site security settings.

url-guard-settingsProtectionAuthentication: Admin only2 endpoints

Get network-wide URL protection settings

GET/api/v2/url-guard-settings

Authentication: Admin only

Update network-wide URL protection settings

PUT/api/v2/url-guard-settings

Authentication: Admin only

Request body application/json

Field	Type	Required	Description
action	string	Required	Action on the URL once triggered - challenge, block or per-IP rate limit. Values `["challenge","block","limit"]`
baseline_ratio	integer	—	Triggering also requires this many times the usual level (usual = the URL's average QPS over the past hour, excluding the last minute). The panel asks for at least 1, default 5; 0 = ignore the multiple (legacy configs lack the field and keep the old rule). Applies to new triggers only - renewing an active rule looks at QPS alone. Omit on update to keep the stored value.
enabled	boolean	Required	Global default switch, used by sites that do not set their own.
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
gate	string	—	WAF enhanced (waf_enhanced) gate - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; still effective, settings read-only), basic (not purchased or fallen back, nothing is pushed); ignored on update. Values `["full","readonly","basic"]`
gate_expired_at	string	—	Administrator responses with gate_reason=expired only - when the platform WAF Enhanced license expired; not present in tenant responses.
gate_owner	WafGateOwner	—	The owner of the site, in administrator responses only; tenant responses carry no one else's information.
gate_packages	string[]	—	Administrator responses only - names of the owner's unexpired packages (at most 20); not present in tenant responses.
gate_reason	WafGateReason	—	Why WAF Enhanced (waf_enhanced) is not in effect; absent when gate is full or readonly. package = the platform is licensed but the owner has no unexpired package that includes WAF Enhanced; license = the platform has not enabled it (never licensed, revoked by the provider, or the license was disabled); expired = the platform license has expired and its read-only buffer period (License.readonly_days, default 7 days) has passed, so it fell back to basic. Values `["package","license","expired"]`
hold_s	integer	Required	Seconds the rule is held; it is renewed while still over the threshold and lapses once traffic drops.
kind	string	—	Challenge type for action=challenge (default js); must be empty for other actions. Values `["js","redirect","delay_jump","cookie","captcha","slide","click","rotate"]`
max_per_site	integer	Required	Max rules in effect at the same time per site.
qps	integer	Required	Trigger only when the network-wide total QPS of a URL is at least this (and at least baseline_ratio times its usual level).
rate	integer	—	Max requests per IP per 10 seconds for action=limit; must be 0 for other actions.
updated_at	string	—	Version in the response (null if never changed); ignored on update - use expected_updated_at for the optimistic lock.

Network-wide URL protection settings object

Field	Type	Required	Description
action	string	—	Action on the URL once triggered - challenge, block or per-IP rate limit. Values `["challenge","block","limit"]`
baseline_ratio	integer	—	Triggering also requires this many times the usual level (usual = the URL's average QPS over the past hour, excluding the last minute). The panel asks for at least 1, default 5; 0 = ignore the multiple (legacy configs lack the field and keep the old rule). Applies to new triggers only - renewing an active rule looks at QPS alone. Omit on update to keep the stored value.
enabled	boolean	—	Global default switch, used by sites that do not set their own.
expected_updated_at	string	—	Optimistic lock - the updated_at as the caller read it (use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
gate	string	—	WAF enhanced (waf_enhanced) gate - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; still effective, settings read-only), basic (not purchased or fallen back, nothing is pushed); ignored on update. read-onlyValues `["full","readonly","basic"]`
gate_expired_at	string	—	Administrator responses with gate_reason=expired only - when the platform WAF Enhanced license expired; not present in tenant responses. read-only
gate_owner	WafGateOwner	—	The owner of the site, in administrator responses only; tenant responses carry no one else's information. read-only
gate_packages	string[]	—	Administrator responses only - names of the owner's unexpired packages (at most 20); not present in tenant responses. read-only
gate_reason	WafGateReason	—	Why WAF Enhanced (waf_enhanced) is not in effect; absent when gate is full or readonly. package = the platform is licensed but the owner has no unexpired package that includes WAF Enhanced; license = the platform has not enabled it (never licensed, revoked by the provider, or the license was disabled); expired = the platform license has expired and its read-only buffer period (License.readonly_days, default 7 days) has passed, so it fell back to basic. read-onlyValues `["package","license","expired"]`
hold_s	integer	—	Seconds the rule is held; it is renewed while still over the threshold and lapses once traffic drops.
kind	string	—	Challenge type for action=challenge (default js); must be empty for other actions. Values `["js","redirect","delay_jump","cookie","captcha","slide","click","rotate"]`
max_per_site	integer	—	Max rules in effect at the same time per site.
qps	integer	—	Trigger only when the network-wide total QPS of a URL is at least this (and at least baseline_ratio times its usual level).
rate	integer	—	Max requests per IP per 10 seconds for action=limit; must be 0 for other actions.
updated_at	string	—	Version in the response (null if never changed); ignored on update - use expected_updated_at for the optimistic lock. read-only