PortWall API reference

What this covers

This is the documented part of PortWall's management API: the endpoints PortWall supports for your scripts and integrations. For worked examples of common tasks, start with Using the PortWall API. The same description is available as an OpenAPI file for your own tools: openapi.json.

The console uses more endpoints than are documented here. Those are the console's own and can change in any release; build only on what this reference lists.

Where it answers

• On Windows, only on the server itself: http://127.0.0.1:5000. Run scripts on the PortWall server.
• On the Linux appliance, on the appliance itself at the same address, and from other machines at https://<appliance address>:9443, with the console's certificate.

Every path in this reference follows that address, for example http://127.0.0.1:5000/api/blocks.

Authentication and roles

Send an API key in the X-Api-Key header. Create keys on the console's API Keys page, or with the API keys endpoints. Each endpoint says which key it needs:

A missing, wrong or revoked key answers 401. A key whose role cannot do this answers 403.

Requests and replies

• Request and reply bodies are JSON. Field names are camelCase.
• Lists of choices are sent and returned as text, for example "mode": "DetectionOnly".
• Times are ISO 8601 with a time zone, for example 2026-10-27T09:14:00+00:00.
• A request the caller can fix answers 400 or 409 with { "error": "..." } saying what is wrong (the tenant API's settings changes answer with { "errors": [ ... ] }). A 403 or 404 carries the same error only where its endpoint shows one; most 404s have no body. How to read the reply in PowerShell is in Using the PortWall API.

Changes that apply in the background

Many changes are saved at once and put in force in the background. Their reply carries applying: true and a number, applySeq. The change is in force when GET /api/config-apply/status shows completed at or above that number; outcome then says applied, deferred (saved, taken up as soon as the engine can) or failed.

Compatibility

• A documented endpoint may gain fields, optional parameters and new values in any release. Write clients that ignore fields they do not know.
• Removing or renaming a documented endpoint or field, or changing what it means, is announced in the release notes and done no sooner than 60 days later.

The areas