List sites, a page at a time
GET /api/sites
Needs a Viewer or Admin key.
q filters by name. Pages hold up to 200 (take); skip moves through them.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
q |
query | string | |
skip |
query | integer | |
take |
query | integer |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | PagedResultOfSitePolicy |
Reply fields
| Field | Type | Description |
|---|---|---|
items |
list of SitePolicy |
The records on this page. Always present. |
total |
integer | How many records match in all, across every page. Always present. |
offset |
integer | How many records were skipped before this page (the skip you asked for, never below 0). Always present. |
limit |
integer | The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present. |
hasMore |
boolean | True when more records follow this page. Ask for the next page by adding limit to the skip. Always present. |
hasPrevious |
boolean | True when records come before this page (offset above 0). Always present. |
List every site
GET /api/sites/all
Needs a Viewer or Admin key.
mode is Off, DetectionOnly (attacks are logged, nothing is blocked) or On (blocking).
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of SitePolicy |
Reply fields
| Field | Type | Description |
|---|---|---|
siteName |
string | The site's name, as it appears in PortWall and in the URL of the site endpoints. Always present. |
mode |
EngineMode |
What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Always present. One of Off, DetectionOnly, On. |
paranoiaLevel |
integer | How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. Always present. |
anomalyThreshold |
integer | The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. Always present. |
failMode |
FailMode |
What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Always present. One of Open, Closed. |
exclusions |
list of RuleExclusion |
The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Always present. |
tenantId |
string | The tenant (hosting customer) that owns the site. Empty when the site belongs to no tenant. Set it with PUT /api/sites/{name}/owner; saving the site's settings does not change it. Can be null. |
runtime |
SiteRuntime |
The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Always present. One of Unknown, DotNet, Php, ClassicAsp, Static. |
cmsProfile |
CmsProfile |
A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Always present. One of None, WordPress, Forum. |
loginPath |
string | The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Always present. |
loginSuccessStatuses |
string | Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Always present. |
loginFailureBodyPattern |
string | Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Always present. |
cmsRateOverrides |
string | Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Always present. |
globalExclusionOptOuts |
list of string | The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Can be null. |
loginProtectionOff |
boolean | True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. Always present. |
Switch sites between watching and blocking
POST /api/sites/mode
Needs an Admin key.
Puts the sites named in sites (or every site, when sites is left out) in mode: Off, DetectionOnly or On.
Request body: BulkSiteModeUpdate
| Field | Type | Description |
|---|---|---|
mode |
EngineMode |
The mode to put the sites in: Off, DetectionOnly or On. Off is meant for a named site that cannot work with the WAF. Required. One of Off, DetectionOnly, On. |
sites |
list of string | The names of the sites to change. Leave out or send null for every site. Optional. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SiteModeResult |
| 400 | Bad Request | ApiError |
Reply fields
| Field | Type | Description |
|---|---|---|
mode |
EngineMode |
The mode the sites were switched to. Always present. One of Off, DetectionOnly, On. |
changed |
integer | How many sites actually changed. Sites already in that mode are not counted. Always present. |
total |
integer | How many sites the request covered. Always present. |
sites |
list of string | The names of the sites that changed. Always present. |
pending |
string | A note when the change is saved but cannot be applied yet. Empty when there is nothing waiting. Can be null. |
applying |
boolean | True when PortWall is applying the change in the background. Left out when no site needed changing. Can be null. |
applySeq |
integer | A number to wait for: the change is in force when completed from GET /api/config-apply/status reaches this number. Left out when no site needed changing. Can be null. |
Get one site's settings
GET /api/sites/{name}
Needs a Viewer or Admin key.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SitePolicy |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
siteName |
string | The site's name, as it appears in PortWall and in the URL of the site endpoints. Always present. |
mode |
EngineMode |
What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Always present. One of Off, DetectionOnly, On. |
paranoiaLevel |
integer | How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. Always present. |
anomalyThreshold |
integer | The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. Always present. |
failMode |
FailMode |
What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Always present. One of Open, Closed. |
exclusions |
list of RuleExclusion |
The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Always present. |
tenantId |
string | The tenant (hosting customer) that owns the site. Empty when the site belongs to no tenant. Set it with PUT /api/sites/{name}/owner; saving the site's settings does not change it. Can be null. |
runtime |
SiteRuntime |
The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Always present. One of Unknown, DotNet, Php, ClassicAsp, Static. |
cmsProfile |
CmsProfile |
A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Always present. One of None, WordPress, Forum. |
loginPath |
string | The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Always present. |
loginSuccessStatuses |
string | Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Always present. |
loginFailureBodyPattern |
string | Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Always present. |
cmsRateOverrides |
string | Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Always present. |
globalExclusionOptOuts |
list of string | The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Can be null. |
loginProtectionOff |
boolean | True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. Always present. |
Change one site's settings
PUT /api/sites/{name}
Needs an Admin key.
Send the whole settings object, as GET /api/sites/{name} returns it, with your changes. Each save is kept as a revision you can roll back to.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Request body: SitePolicyUpdate
| Field | Type | Description |
|---|---|---|
mode |
EngineMode |
What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Required. One of Off, DetectionOnly, On. |
paranoiaLevel |
integer | How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. |
anomalyThreshold |
integer | The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. |
failMode |
FailMode |
What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Required. One of Open, Closed. |
exclusions |
list of RuleExclusion |
The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Optional. |
runtime |
SiteRuntime |
The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Required. One of Unknown, DotNet, Php, ClassicAsp, Static. |
cmsProfile |
CmsProfile |
A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Required. One of None, WordPress, Forum. |
loginPath |
string | The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Required. |
loginSuccessStatuses |
string | Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Required. |
loginFailureBodyPattern |
string | Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Required. |
cmsRateOverrides |
string | Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Required. |
globalExclusionOptOuts |
list of string | The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Optional. |
loginProtectionOff |
boolean | True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SitePolicySaved |
| 400 | Bad Request | ApiError |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
policy |
SitePolicy |
The site's settings as stored. Always present. |
version |
integer | The revision number created by this save. Use it to roll back later. Always present. |
applying |
boolean | True when PortWall is applying the change in the background. The change is in force once the apply status reports it completed. Always present. |
applySeq |
integer | A number to wait for: the change is in force when completed from GET /api/config-apply/status reaches this number. Always present. |
pending |
string | A note when the change is saved but cannot be applied yet. Empty when there is nothing waiting. Can be null. |
Remove a site from PortWall
DELETE /api/sites/{name}
Needs an Admin key.
Removes PortWall's settings for the site. It does not touch the site itself.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SiteDeletedWithWarning |
| 204 | No Content | none |
| 404 | Not Found | none |
| 500 | Internal Server Error | application/problem+json |
Reply fields
| Field | Type | Description |
|---|---|---|
deleted |
string | The name of the site whose PortWall settings were removed. Always present. |
warning |
string | Why the site is still in the running configuration and how to clear it. Always present. |
List a site's saved revisions
GET /api/sites/{name}/revisions
Needs a Viewer or Admin key.
The latest 50, newest first.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of SitePolicyRevision |
Reply fields
| Field | Type | Description |
|---|---|---|
version |
integer | The revision number. It counts up for each site and is the number you give to roll back. Always present. |
siteName |
string | The site the revision belongs to. Always present. |
at |
date-time | When the revision was saved. Always present. |
actor |
string | Who saved it: the signed-in user or API key name. Always present. |
policy |
SitePolicy |
The site's settings exactly as they were in this revision. Always present. |
Roll a site back to a saved revision
POST /api/sites/{name}/rollback/{version}
Needs an Admin key.
Restores that revision's settings and records the result as a new revision.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
version |
path | integer | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | RollbackResult |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
restored |
integer | The revision number whose settings were restored. Always present. |
newVersion |
integer | The new revision created by the rollback, holding the restored settings. Always present. |
Updated 2026-10-27Something unclear or missing? Tell us.