API reference: virtual patches

List a site's own virtual patches

GET /api/sites/{name}/patches

Needs a Viewer or Admin key.

Parameters

Name	In	Type	Notes
`name`	path	string	Required.

Replies

Status	Meaning	Body
200	OK	list of `VirtualPatch`

Reply fields

Field	Type	Description
`ruleId`	integer	The rule number PortWall gave the patch. Use it to switch the patch between detecting and blocking, or to delete it. Always present.
`siteName`	string	The site the patch belongs to. Always present.
`description`	string	What the patch protects against, for example the CVE or flaw it shields. Always present.
`targets`	string	Where the rule looks, as WAF variable names separated by a vertical bar, for example ARGS or REQUEST_HEADERS:User-Agent\|REQUEST_URI. Always present.
`operator`	string	How the pattern is compared with the target. It starts with @, for example @rx (regular expression), @contains or @streq (equals). Always present.
`pattern`	string	The text or regular expression the operator looks for in the targets. Always present.
`phase`	integer	When in the request the rule runs, from 1 to 5. Use 2 (after the request body is read) for most patches, or 1 to check the request headers first. Always present.
`stage`	`PatchStage`	DetectionOnly records matches and blocks nothing, even when the site is On; Blocking refuses matching requests with a 403. Always present. One of `DetectionOnly`, `Blocking`.
`expiresAt`	date-time	When the patch stops applying. Null for a patch that never expires.
`createdBy`	string	Who added the patch: the signed-in user or API key name. Always present.
`createdAt`	date-time	When the patch was added. Always present.

POST /api/sites/{name}/patches

Needs an Admin key.

Start a new patch in stage DetectionOnly, check the attack feed for what it matches, then switch it to Blocking.

Parameters

Name	In	Type	Notes
`name`	path	string	Required.

Request body: VirtualPatchRequest

Field	Type	Description
`description`	string	What the patch protects against. Required; must not contain quotes, backticks or line breaks. Required.
`targets`	string	Where the rule looks, as WAF variable names separated by a vertical bar, for example ARGS or REQUEST_HEADERS:User-Agent\|REQUEST_URI. Required; no double quotes, backticks or line breaks. Required.
`operator`	string	How the pattern is compared with the target. Must start with @, for example @rx, @contains or @streq. Required. Required.
`pattern`	string	The text or regular expression the operator looks for. Required; no double quotes, backticks or line breaks. Required.
`phase`	integer	When in the request the rule runs, from 1 to 5. Use 2 (after the request body is read) for most patches.
`stage`	`PatchStage`	Start with DetectionOnly to see what the patch matches in the attack feed, then switch it to Blocking. Required. One of `DetectionOnly`, `Blocking`.
`expiresInMinutes`	integer	Minutes from now after which the patch stops applying. Leave out, or send 0 or less, for a patch that never expires. Optional.

Replies

Reply fields

Field	Type	Description
`ruleId`	integer	The rule number PortWall gave the patch. Use it to switch the patch between detecting and blocking, or to delete it. Always present.
`siteName`	string	The site the patch belongs to. Always present.
`description`	string	What the patch protects against, for example the CVE or flaw it shields. Always present.
`targets`	string	Where the rule looks, as WAF variable names separated by a vertical bar, for example ARGS or REQUEST_HEADERS:User-Agent\|REQUEST_URI. Always present.
`operator`	string	How the pattern is compared with the target. It starts with @, for example @rx (regular expression), @contains or @streq (equals). Always present.
`pattern`	string	The text or regular expression the operator looks for in the targets. Always present.
`phase`	integer	When in the request the rule runs, from 1 to 5. Use 2 (after the request body is read) for most patches, or 1 to check the request headers first. Always present.
`stage`	`PatchStage`	DetectionOnly records matches and blocks nothing, even when the site is On; Blocking refuses matching requests with a 403. Always present. One of `DetectionOnly`, `Blocking`.
`expiresAt`	date-time	When the patch stops applying. Null for a patch that never expires.
`createdBy`	string	Who added the patch: the signed-in user or API key name. Always present.
`createdAt`	date-time	When the patch was added. Always present.

DELETE /api/sites/{name}/patches/{ruleId}

Needs an Admin key.

Parameters

Name	In	Type	Notes
`name`	path	string	Required.
`ruleId`	path	integer	Required.

Replies

Status	Meaning	Body
204	No Content	none
404	Not Found	none

PUT /api/sites/{name}/patches/{ruleId}/stage

Needs an Admin key.

Parameters

Name	In	Type	Notes
`name`	path	string	Required.
`ruleId`	path	integer	Required.

Request body: PatchStageRequest

Field	Type	Description
`stage`	`PatchStage`	The stage to switch the patch to: DetectionOnly to record only, or Blocking to refuse matching requests. Required. One of `DetectionOnly`, `Blocking`.

Replies

Status	Meaning	Body
204	No Content	none
404	Not Found	none

Updated 2026-10-27Something unclear or missing? Tell us.