List recent attacks on the tenant's sites
GET /api/my/events
Needs a Tenant key; answers only for that tenant's sites.
The latest 200, newest first.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of SecurityEventSummary |
Reply fields
| Field | Type | Description |
|---|---|---|
timestamp |
date-time | When the event was detected. Always present. |
source |
string | The IP address the event came from. 255.255.255.255 for operational incidents, which have no attacker address. Always present. |
site |
string | The site the event concerns, or a label such as host for events about the server itself. Always present. |
kind |
string | What sort of event this is, using the names listed under SecurityEventKind. Attack kinds appear in the attack feed; operational incidents are kept out of it. Always present. |
anomalyScore |
integer | How serious the event is; higher is worse. For a web request it is the total the OWASP Core Rule Set rules added up to, and 0 when no score applies. Always present. |
ruleIds |
string | The IDs of the rules that fired, separated by commas. Empty when the event did not come from a rule. Always present. |
correlationId |
string | An identifier tying the event to the request or detection it came from. May be empty. Always present. |
forensics |
ForensicSnapshot |
A copy of the request that caused the event. Null when none was captured, for example for events that are not web requests. |
hits |
list of RuleHit |
The individual rules that fired, with their severity and what they matched. Null or empty when none apply. |
country |
string | Two-letter ISO country code of the source, looked up when you read the feed. Null when unknown. |
sourceAllowlisted |
boolean | True when the source is on the allowlist now: the event was flagged and logged but the address is deliberately never blocked. Always present. |
verdict |
string | What PortWall did with the request: Block when it refused it, Allow when it logged it and let it through (the site's protection only reports, or the rules that fired do not refuse on their own). Null for events that are not web requests, and for events recorded before PortWall 1.2.49. |
responseStatus |
integer | The HTTP status PortWall answered the request with, for example 403 when it refused it. Null for events that are not web requests, and for events recorded before PortWall 1.2.49. |
Get what the host lets the tenant change
GET /api/my/policy
Needs a Tenant key; answers only for that tenant's sites.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | TenantSelfServicePolicy |
Reply fields
| Field | Type | Description |
|---|---|---|
allowedModes |
list of EngineMode |
The WAF modes a tenant may switch its sites to. A tenant asking for a mode not listed is refused. Always present. |
defaultMode |
EngineMode |
The mode a new tenant site starts in. Default: On (blocking). Always present. One of Off, DetectionOnly, On. |
allowParanoiaEdit |
boolean | Whether tenants may change the paranoia level of their sites. If false, only the host can. Default: true. Always present. |
paranoiaMin |
integer | Lowest paranoia level a tenant may choose, from 1 to 4. Default: 1. Always present. |
paranoiaMax |
integer | Highest paranoia level a tenant may choose, from 1 to 4 and not below the lowest. Default: 2. Always present. |
allowThresholdEdit |
boolean | Whether tenants may change the blocking sensitivity (the anomaly threshold) of their sites. If false, only the host can. Default: true. Always present. |
thresholdMin |
integer | Lowest blocking threshold a tenant may set, at least 1. A lower value blocks sooner. Default: 3. Always present. |
thresholdMax |
integer | Highest blocking threshold a tenant may set, not below the lowest. A higher value blocks later. Default: 7. Always present. |
exclusionPolicy |
TenantExclusionPolicy |
Whether tenants may add rule exclusions (to stop a rule blocking legitimate traffic) themselves, must ask the host, or may not at all. Default: SelfApply. Always present. One of SelfApply, RequestApproval, Disabled. |
maxTenantExclusions |
integer | Most rule exclusions a tenant may have on one site when exclusions are self-applied. Default: 25. Always present. |
allowTenantScan |
boolean | Whether tenants may start a malware scan of their own sites. Default: true. Always present. |
tenantScanMinIntervalMinutes |
integer | Least time, in minutes, between two scans of the same site; a scan started sooner is refused. 0 means no wait. Default: 360 (6 hours). Always present. |
maxScanFileSizeBytes |
integer | Largest file, in bytes, that a tenant's scan will check; bigger files are skipped. Default: 33554432 (32 MiB). Always present. |
quarantineAction |
TenantQuarantineAction |
What a tenant may do with a file that a scan quarantined. Default: RequestApproval. Always present. One of RequestApproval, ViewOnly, RestoreDelete. |
allowCmsProtection |
boolean | Whether tenants may choose a CMS protection profile for their sites and change their login protection and rate-limit settings. Default: true. Always present. |
rateLimitEventsFloor |
integer | Lowest requests-per-minute value a tenant may set for a CMS protection rate limit, so a tenant cannot lock out its own visitors. Default: 1. Always present. |
allowRuntimeEdit |
boolean | Whether tenants may say which runtime their site uses (PHP, .NET, classic ASP or static), which decides the file types uploads may carry. Default: true. Always present. |
allowManagedCert |
boolean | Whether tenants may turn on a PortWall-managed HTTPS certificate for their own sites that are not run through a hosting panel. Default: false. Always present. |
maxManagedCerts |
integer | Most managed certificates one tenant may have. 0 means no limit. Default: 0. Always present. |
List the tenant's quarantined files
GET /api/my/quarantine
Needs a Tenant key; answers only for that tenant's sites.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | PagedResultOfQuarantineEntry |
Reply fields
| Field | Type | Description |
|---|---|---|
items |
list of QuarantineEntry |
The records on this page. Always present. |
total |
integer | How many records match in all, across every page. Always present. |
offset |
integer | How many records were skipped before this page (the skip you asked for, never below 0). Always present. |
limit |
integer | The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present. |
hasMore |
boolean | True when more records follow this page. Ask for the next page by adding limit to the skip. Always present. |
hasPrevious |
boolean | True when records come before this page (offset above 0). Always present. |
Look at a quarantined file's content
GET /api/my/quarantine/{sha}/content
Needs a Tenant key; answers only for that tenant's sites.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
sha |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | QuarantineContent |
| 404 | Not Found | ApiError |
Reply fields
| Field | Type | Description |
|---|---|---|
ok |
boolean | True if the file could be read. Always present. |
error |
string | Why the file could not be read. Null when ok is true. |
sha256 |
string | SHA-256 hash of the file's content, as hex. Always present. |
originalPath |
string | Where the file was before it was quarantined. Always present. |
signature |
string | The name of the malware signature that matched the file. Always present. |
size |
integer | Size of the whole file in bytes. 0 if the file could not be read. Always present. |
truncated |
boolean | True if the file is larger than the preview, which holds only the first 64 KB. Always present. |
isBinary |
boolean | True if the file looks like binary data rather than text. Always present. |
text |
string | The start of the file, with each byte shown as one character. Empty if the file could not be read. Always present. |
Restore or delete a quarantined file
POST /api/my/quarantine/{sha}/request
Needs a Tenant key; answers only for that tenant's sites.
Depending on the host's policy this is done at once (200) or sent to the host for approval (202).
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
sha |
path | string | Required. |
Request body: QuarantineRequestDto
| Field | Type | Description |
|---|---|---|
op |
QuarantineOp |
Whether to restore the file to where it came from, or delete it for good. Required. One of Restore, Delete. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | QuarantineDone |
| 202 | Accepted | QuarantineRequested |
| 400 | Bad Request | ApiError |
| 403 | Forbidden | ApiError |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
done |
boolean | True when the file was restored or deleted. Always present. |
Get a security report for the tenant's sites
GET /api/my/reports/security
Needs a Tenant key; answers only for that tenant's sites.
What was attacked and blocked on the tenant's own sites over the last days.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
days |
query | integer | How many days to cover, 1 to 90. Default 7. |
format |
query | string | text for a plain-text summary instead of JSON. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SecurityReport |
Reply fields
| Field | Type | Description |
|---|---|---|
period |
ReportPeriod |
The time span the report covers. Always present. |
generatedAt |
date-time | When the report was made. Always present. |
scope |
string | What the report covers: All sites, or the number of sites for a tenant. Always present. |
totalEvents |
integer | How many attacks and other security events were detected in the period. Counted from the most recent 20,000 events. Always present. |
criticalIncidents |
integer | How many of those events were serious kinds: privilege escalation, tampering with PortWall, credential stuffing, unusual outbound traffic, or a malicious file found by a scan. Always present. |
eventsByKind |
list of ReportCount |
How many events there were of each kind, most frequent first. Always present. |
topSources |
list of ReportCount |
The ten addresses that caused the most events, most frequent first. Always present. |
topRules |
list of ReportCount |
The ten rules that matched most often, most frequent first. Always present. |
activeBlocks |
integer | How many addresses are blocked right now. Always 0 in a tenant report, because blocks apply to the whole server. Always present. |
blocksInPeriod |
integer | How many address blocks were created in the period. Always 0 in a tenant report. Always present. |
filesQuarantinedInPeriod |
integer | How many files were quarantined in the period. Always present. |
topSites |
list of ReportCount |
The ten sites with the most events, most frequent first. Can be null. |
topCountries |
list of ReportCount |
The ten countries (two-letter codes) the attacks came from, most frequent first. Empty when no country database is loaded. Can be null. |
List the tenant's sites
GET /api/my/sites
Needs a Tenant key; answers only for that tenant's sites.
Every site the tenant owns or has been given, with role: Viewer may only look, Manager may change settings.
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | list of SiteAccess |
Reply fields
| Field | Type | Description |
|---|---|---|
site |
SitePolicy |
The site's settings, as the tenant sees them. Always present. |
role |
SiteRole |
What the tenant may do with this site: look only, or also change its settings. Always present. One of Viewer, Manager. |
Get one of the tenant's sites
GET /api/my/sites/{name}
Needs a Tenant key; answers only for that tenant's sites.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SiteAccess |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
site |
SitePolicy |
The site's settings, as the tenant sees them. Always present. |
role |
SiteRole |
What the tenant may do with this site: look only, or also change its settings. Always present. One of Viewer, Manager. |
Change one of the tenant's sites
PUT /api/my/sites/{name}
Needs a Tenant key; answers only for that tenant's sites.
Send the whole settings object, as GET returns it under site, with your changes. The host's tenant policy (GET /api/my/policy) sets what may change; a refused change answers 400 with the reasons.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Request body: SitePolicyUpdate
| Field | Type | Description |
|---|---|---|
mode |
EngineMode |
What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Required. One of Off, DetectionOnly, On. |
paranoiaLevel |
integer | How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. |
anomalyThreshold |
integer | The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. |
failMode |
FailMode |
What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Required. One of Open, Closed. |
exclusions |
list of RuleExclusion |
The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Optional. |
runtime |
SiteRuntime |
The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Required. One of Unknown, DotNet, Php, ClassicAsp, Static. |
cmsProfile |
CmsProfile |
A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Required. One of None, WordPress, Forum. |
loginPath |
string | The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Required. |
loginSuccessStatuses |
string | Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Required. |
loginFailureBodyPattern |
string | Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Required. |
cmsRateOverrides |
string | Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Required. |
globalExclusionOptOuts |
list of string | The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Optional. |
loginProtectionOff |
boolean | True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | SiteAccess |
| 400 | Bad Request | TenantErrors |
| 403 | Forbidden | none |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
site |
SitePolicy |
The site's settings, as the tenant sees them. Always present. |
role |
SiteRole |
What the tenant may do with this site: look only, or also change its settings. Always present. One of Viewer, Manager. |
Scan a site's files for malware
POST /api/my/sites/{name}/scan
Needs a Tenant key; answers only for that tenant's sites.
Starts a scan of the site's files. The host's policy decides whether scans are allowed and how often; when it is too soon, the reply says when to try again.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 202 | Accepted | ScanStarted |
| 403 | Forbidden | ApiError |
| 404 | Not Found | none |
| 429 | Too Many Requests | RetryLater |
Reply fields
| Field | Type | Description |
|---|---|---|
runId |
string | The ID of the scan that was started. Find it in the site's list of scans. Always present. |
List a site's scans
GET /api/my/sites/{name}/scans
Needs a Tenant key; answers only for that tenant's sites.
Parameters
| Name | In | Type | Notes |
|---|---|---|---|
name |
path | string | Required. |
Replies
| Status | Meaning | Body |
|---|---|---|
| 200 | OK | PagedResultOfScanRun |
| 404 | Not Found | none |
Reply fields
| Field | Type | Description |
|---|---|---|
items |
list of ScanRun |
The records on this page. Always present. |
total |
integer | How many records match in all, across every page. Always present. |
offset |
integer | How many records were skipped before this page (the skip you asked for, never below 0). Always present. |
limit |
integer | The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present. |
hasMore |
boolean | True when more records follow this page. Ask for the next page by adding limit to the skip. Always present. |
hasPrevious |
boolean | True when records come before this page (offset above 0). Always present. |
Updated 2026-10-27Something unclear or missing? Tell us.