List blocked addresses
GET /api/blocks
Needs a Viewer or Admin key.
Every address blocked now, by any part of PortWall: permanent blocks first, then the newest. expiresAt is empty for a permanent block.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of BlockDto |
Reply fields
| Field | Type | Description |
|---|---|---|
ip |
string | The blocked IP address, or the range when the block covers a range. Always present. |
reason |
string | Why the block exists: the text given when it was created by hand, or a short explanation for an automatic block. Always present. |
backend |
string | Where the block is enforced. WindowsFirewall (Windows) and Nftables (Linux appliance) drop the traffic at the network layer before it reaches the engine. SoftBlock refuses it in the engine, so the request still arrives there. IPSec is also possible where it has been set up. Always present. |
createdAt |
date-time | When the block was created. Always present. |
expiresAt |
date-time | When the block ends and the address is released. Empty for a permanent block, which stands until someone removes it. Can be null. |
category |
string | What created the block: Manual (someone added it), CorrelatedRisk (the address's attack score crossed the limit), RateLimit, ThreatIntel, Honeypot or BruteForce (repeated failed logins). Always present. |
country |
string | Two-letter ISO country code of the address. Null when the country database does not know it. |
actor |
string | Who created the block, for a manual block. Null for blocks PortWall created automatically. |
Block an address
POST /api/blocks
Needs an Admin key.
Blocks an IPv4 or IPv6 address for ttlMinutes (or ttlHours), up to a year, or until removed when permanent is true. Takes effect within moments. An allowlisted address cannot be blocked (409).
Request body: CreateBlockRequest
| Field | Type | Description |
|---|---|---|
ip |
string | The IPv4 or IPv6 address to block. An allowlisted address is refused with 409. Required. |
ttlMinutes |
integer | How long to block for, in minutes. Between 1 minute and 1 year (525600); values outside that are adjusted to the nearest limit. Ignored when ttlHours or permanent is set. |
reason |
string | Why you are blocking it, shown in the block list and the audit log. Empty uses manual block. Optional. |
ttlHours |
number | How long to block for, in hours; fractions are allowed (0.5 is 30 minutes). When set it is used instead of ttlMinutes. Limits are the same as for ttlMinutes. Optional. |
permanent |
boolean | True to block until you remove it by hand; the block then has no expiry and any duration sent is ignored. Default false. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 201 | Created | BlockDto |
| 400 | Bad Request | ApiError |
| 409 | Conflict | ApiError |
Reply fields
| Field | Type | Description |
|---|---|---|
ip |
string | The blocked IP address, or the range when the block covers a range. Always present. |
reason |
string | Why the block exists: the text given when it was created by hand, or a short explanation for an automatic block. Always present. |
backend |
string | Where the block is enforced. WindowsFirewall (Windows) and Nftables (Linux appliance) drop the traffic at the network layer before it reaches the engine. SoftBlock refuses it in the engine, so the request still arrives there. IPSec is also possible where it has been set up. Always present. |
createdAt |
date-time | When the block was created. Always present. |
expiresAt |
date-time | When the block ends and the address is released. Empty for a permanent block, which stands until someone removes it. Can be null. |
category |
string | What created the block: Manual (someone added it), CorrelatedRisk (the address's attack score crossed the limit), RateLimit, ThreatIntel, Honeypot or BruteForce (repeated failed logins). Always present. |
country |
string | Two-letter ISO country code of the address. Null when the country database does not know it. |
actor |
string | Who created the block, for a manual block. Null for blocks PortWall created automatically. |
Remove all temporary blocks
POST /api/blocks/flush-temporary
Needs an Admin key.
Removes every block that has an expiry, for example after fixing the cause of a wave of automatic blocks. Permanent blocks are kept.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | FlushTemporaryResult |
Reply fields
| Field | Type | Description |
|---|---|---|
removed |
integer | How many temporary blocks were removed. Permanent blocks are not counted and not removed. Always present. |
Unblock an address
DELETE /api/blocks/{ip}
Needs an Admin key.
Removes the block on this address, whatever created it. The firewall releases it within moments.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
ip |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 204 | No Content | none |
| 400 | Bad Request | ApiError |
Updated 2026-10-27Something unclear or missing? Tell us.