API reference: data types

AllowScope

What an allowlist entry exempts the address or range from.

Value	Meaning
`None`	Exempt from nothing. Not accepted when adding an entry; use Waf, Feeds or Both.
`Waf`	Never blocked by PortWall's own detection, automatic blocks, geo-blocking or manual blocks.
`Feeds`	Never blocked because a threat-intelligence feed lists it.
`Both`	Exempt from both the WAF side and the feeds.

AllowlistEntry

One allowlist entry: an address or range that PortWall will not block, what it is exempt from, and who added it.

Field	Type	Description
`ipOrCidr`	string	The IP address, or range in CIDR form such as 198.51.100.0/24, that is exempt. Also the key used to remove the entry. Always present.
`scope`	`AllowScope`	What the address is exempt from: Waf, Feeds or Both. Always present. One of `None`, `Waf`, `Feeds`, `Both`.
`reason`	string	Why it was added, for whoever reviews the list later. Empty if none was given. Always present.
`actor`	string	Who added the entry. Always present.
`addedAt`	date-time	When the entry was added. Always present.

AllowlistRequest

The request body for adding an address or range to the allowlist.

Field	Type	Description
`ipOrCidr`	string	The IP address, or range in CIDR form such as 198.51.100.0/24, that is exempt. Also the key used to remove the entry. Always present.
`scope`	`AllowScope`	What the address is exempt from: Waf, Feeds or Both. Always present. One of `None`, `Waf`, `Feeds`, `Both`.
`reason`	string	Why it was added, for whoever reviews the list later. Empty if none was given. Can be null.

ApiError

An error the caller can fix, in words a person can act on.

Field	Type	Description
`error`	string	What went wrong and what to change, in words. Always present.

ApiKeyCreated

A newly made API key, including the key itself, which is shown this once only.

Field	Type	Description
`id`	string	The key's identifier, used to revoke it. Always present.
`name`	string	The name given to the key. Always present.
`role`	string	What the key may do: Admin, Viewer or Tenant. Always present.
`tenantId`	string	For a Tenant key, the tenant it is limited to. Null for other keys.
`prefix`	string	The first characters of the key, which also show in the key list. Always present.
`key`	string	The full key. It is shown this once only and cannot be recovered; copy it now or create another. Always present.

ApiKeyView

An API key as listed. The key itself is never shown again; only its first characters are.

Field	Type	Description
`id`	string	The key's identifier, used to revoke it. Always present.
`name`	string	The name given to the key when it was created. Always present.
`role`	string	What the key may do: Admin (read and change), Viewer (read only) or Tenant (one tenant's own sites). Always present.
`tenantId`	string	For a Tenant key, the tenant it is limited to. Null for other keys.
`prefix`	string	The first characters of the key, to tell keys apart. It cannot be used to sign in. Always present.
`createdAt`	date-time	When the key was created. Always present.
`lastUsedAt`	date-time	When the key was last used. Null if it never has been.
`revoked`	boolean	True when the key has been revoked and no longer works. Always present.

AssignOwnerRequest

Request body that sets which tenant owns a site.

Field	Type	Description
`tenantId`	string	The tenant that should own the site. Null or empty removes the site's owner.

AuditEntry

One entry in the audit log: a change someone made to PortWall's configuration.

Field	Type	Description
`timestamp`	date-time	When the change was made. Always present.
`actor`	string	Who made the change: the user or API key, with the signed-in person noted when the console made the call for them. Always present.
`action`	string	What was done, as a short code such as block.create or allowlist.add. Always present.
`target`	string	What the change was made to, such as an IP address, a site or a feed ID. Always present.
`details`	string	Extra detail about the change, such as the duration or the new setting. Null when there is none.

BlockDto

One address (or range) that PortWall is blocking now, with why, where it is enforced and when it ends.

Field	Type	Description
`ip`	string	The blocked IP address, or the range when the block covers a range. Always present.
`reason`	string	Why the block exists: the text given when it was created by hand, or a short explanation for an automatic block. Always present.
`backend`	string	Where the block is enforced. WindowsFirewall (Windows) and Nftables (Linux appliance) drop the traffic at the network layer before it reaches the engine. SoftBlock refuses it in the engine, so the request still arrives there. IPSec is also possible where it has been set up. Always present.
`createdAt`	date-time	When the block was created. Always present.
`expiresAt`	date-time	When the block ends and the address is released. Empty for a permanent block, which stands until someone removes it. Can be null.
`category`	string	What created the block: Manual (someone added it), CorrelatedRisk (the address's attack score crossed the limit), RateLimit, ThreatIntel, Honeypot or BruteForce (repeated failed logins). Always present.
`country`	string	Two-letter ISO country code of the address. Null when the country database does not know it.
`actor`	string	Who created the block, for a manual block. Null for blocks PortWall created automatically.

BotCrawlerSourceView

One search engine's published list of crawler addresses and when PortWall last downloaded it.

Field	Type	Description
`id`	string	A short name for the search engine's list. Always present.
`label`	string	The search engine's name as shown in the console. Always present.
`fetchedAt`	date-time	When PortWall last downloaded this list. Null until the first download.
`ranges`	integer	How many address ranges the list holds. 0 until it has been downloaded. Always present.
`error`	string	Why the last download failed, in words. Null when it worked or has not been tried; the previous list is kept after a failure.

BotCrawlersView

The lists of search-engine crawler addresses that the browser check never challenges.

Field	Type	Description
`sources`	list of `BotCrawlerSourceView`	The search engines whose crawler addresses are never checked, each with its list status. Always present.
`total`	integer	The total number of crawler address ranges held across all lists. Always present.

BotProtectionDto

The bot-protection settings to save; fields you leave out keep their current value, except underAttackSites and exemptPaths, which are replaced (empty when left out).

Field	Type	Description
`underAttackAll`	boolean	True to show the browser check to every visitor of every site. Always present.
`underAttackSites`	list of string	Names of the sites whose visitors are all shown the browser check. Use names from sites. Not needed when underAttackAll is true. Can be null.
`exemptPaths`	list of string	Paths the browser check never applies to, on every site, for example /api/ or /webhooks/ (API clients and webhooks cannot run the check). Each starts with /, and has no spaces, quotes, braces, # or backslashes. /.well-known/ is always left out. Can be null.
`difficulty`	integer	How much work the browser check asks of a visitor's browser, from 16 (normal) to 22 (strongest). Default 18. Can be null.
`clearanceMinutes`	integer	How long, in minutes, a visitor who passed the check is left alone, from 5 to 1440 (24 hours). Default 30. Can be null.
`ja4`	boolean	True to record each visitor's TLS fingerprint, which lets PortWall recognise one bot that uses many addresses. Default false. Always present.
`botClusterAction`	`DetectionAction`	What happens to the addresses of one bot spread over many addresses once it is detected. Default Challenge. Can be null. One of `Alert`, `Challenge`, `Block`.
`credentialStuffingAction`	`DetectionAction`	What happens to the addresses behind a credential-stuffing attack on a login page once it is detected. Default Challenge. Can be null. One of `Alert`, `Challenge`, `Block`.
`flaggedMinutes`	integer	How long, in minutes, an address that a detection acted on stays challenged or blocked, from 5 to 10080 (7 days). Default 60. Can be null.

BotProtectionView

The bot-protection settings, with the sites you can choose from, the search-engine crawlers that are never checked, and the visitors currently sent to the browser check.

Field	Type	Description
`underAttackAll`	boolean	True to show the browser check to every visitor of every site. Always present.
`underAttackSites`	list of string	Names of the sites whose visitors are all shown the browser check. Use names from sites. Not needed when underAttackAll is true. Always present.
`exemptPaths`	list of string	Paths the browser check never applies to, on every site, for example /api/ or /webhooks/ (API clients and webhooks cannot run the check). Each starts with /, and has no spaces, quotes, braces, # or backslashes. /.well-known/ is always left out. Always present.
`difficulty`	integer	How much work the browser check asks of a visitor's browser, from 16 (normal) to 22 (strongest). Default 18. Always present.
`clearanceMinutes`	integer	How long, in minutes, a visitor who passed the check is left alone, from 5 to 1440 (24 hours). Default 30. Always present.
`ja4`	boolean	True to record each visitor's TLS fingerprint, which lets PortWall recognise one bot that uses many addresses. Default false. Always present.
`botClusterAction`	`DetectionAction`	What happens to the addresses of one bot spread over many addresses once it is detected. Default Challenge. Always present. One of `Alert`, `Challenge`, `Block`.
`credentialStuffingAction`	`DetectionAction`	What happens to the addresses behind a credential-stuffing attack on a login page once it is detected. Default Challenge. Always present. One of `Alert`, `Challenge`, `Block`.
`flaggedMinutes`	integer	How long, in minutes, an address that a detection acted on stays challenged or blocked, from 5 to 10080 (7 days). Default 60. Always present.
`sites`	list of string	The names of the sites on this installation, which you can use in underAttackSites. Read-only; ignored if you send it. Always present.
`crawlers`	`BotCrawlersView`	The search-engine crawler addresses that are never checked. Read-only. Always present.
`feedChallengeRanges`	integer	How many address ranges from threat-intelligence feeds are set to Challenge, and so are shown the browser check. Null when it cannot be read. Read-only.
`flagged`	list of `FlaggedVisitor`	The addresses that detections are challenging or blocking now, soonest to expire first (at most 200). Read-only. Always present.
`premium`	boolean	True when your licence includes bot protection. When false the settings are saved but take effect only once your edition includes it. Read-only. Always present.
`plan`	string	The name of your licence edition. Read-only. Always present.

BruteForceSettings

The brute-force detection settings: which logs PortWall reads for failed sign-ins, and how many failures lead to a temporary block.

Field	Type	Description
`sources`	list of `BruteForceSource`	The logs to read for failed sign-ins. Send the whole list when you save (at most 50); a source you leave out is removed. Always present.
`authFailurePoints`	number	Risk points added for each failed sign-in, from above 0 up to 1000. Default 4. Always present.
`escalationThreshold`	number	The risk score at which an address is blocked. It must be above 0; default 20. Lower it to block sooner, raise it to allow more failures. Always present.
`baseBlockTtlMinutes`	integer	How long, in minutes, a block lasts when the address has just reached the threshold, from 1 to 10080 (7 days). Default 30. Blocks last longer as the score grows, up to maxBlockTtlMinutes. Always present.
`maxBlockTtlMinutes`	integer	The longest a block can last, in minutes. It must be at least baseBlockTtlMinutes and no more than 10080 (7 days). Default 240. Blocks always expire. Always present.

BruteForceSettingsSaved

The brute-force settings as saved, and what PortWall did to be able to read each enabled log.

Field	Type	Description
`settings`	`BruteForceSettings`	The brute-force settings as now saved. Always present.
`logAccess`	list of any JSON	One entry for each enabled log folder, saying whether PortWall could be given permission to read it. A failure here does not undo the save. Always present.

BruteForceSource

One log that PortWall reads to find failed sign-ins (Windows accounts, IIS FTP, SQL Server, a mail server and so on).

Field	Type	Description
`id`	string	A short name that identifies the source, for example windows-auth or mail. It must be unique in the list and must not be empty. Keep the same id for a source you are editing. Always present.
`kind`	`BruteForceSourceKind`	Which kind of log this source reads. Always present. One of `WindowsSecurityLog`, `IisFtpLog`, `ServiceLog`.
`label`	string	The name shown for the source in the console. Always present.
`enabled`	boolean	Whether PortWall reads this source. A disabled source is kept in the list but not read. Changes take effect within about 30 seconds. Always present.
`site`	string	The name that failures from this source appear under in the attack feed, for example windows-auth, ftp or mail. Required. Always present.
`path`	string	Where the log is. For a ServiceLog source it is the log file, or the folder holding the logs when glob is set; for an IisFtpLog source it is the FTP log folder. Required when the source is enabled; not used by WindowsSecurityLog. Can be null.
`pattern`	string	A regular expression that matches one failed-sign-in line in the log. It must capture the attacker's address in a named group (by default called ip) and may capture the user name in another. Required for an enabled ServiceLog source; not used by the other kinds. Can be null.
`ipGroup`	string	The name of the group in pattern that captures the client address. Empty means ip. ServiceLog sources only. Can be null.
`userGroup`	string	The name of the group in pattern that captures the user name, if the log has one. Empty means user. ServiceLog sources only. Can be null.
`glob`	string	A file name pattern, such as u_ex.log or hmailserver_.log, for a log that starts a new file each day. When set, path is the folder and PortWall follows the newest matching file. Leave empty for a service that keeps writing to one fixed file, such as SQL Server's ERRORLOG. Can be null.

BruteForceSourceKind

Which kind of log a brute-force source reads.

Value	Meaning
`WindowsSecurityLog`	Failed Windows sign-ins (RDP, SMB, network logon, and FTP or mail servers that use Windows accounts), read from the Windows Security log. One source covers them all and needs no path.
`IisFtpLog`	The IIS FTP log folder, for FTP users who are not Windows accounts (those never reach the Security log).
`ServiceLog`	Any other text log, such as SQL Server's or a mail server's, matched with a regular expression you give that captures the attacker's address.

BulkSiteModeUpdate

A request to put many sites, or every site, into one WAF mode in a single call.

Field	Type	Description
`mode`	`EngineMode`	The mode to put the sites in: Off, DetectionOnly or On. Off is meant for a named site that cannot work with the WAF. Always present. One of `Off`, `DetectionOnly`, `On`.
`sites`	list of string	The names of the sites to change. Leave out or send null for every site.

Campaign

An attacker seen hitting many different customers (tenants) on this installation, which points to a coordinated sweep rather than one noisy site.

Field	Type	Description
`id`	string	The campaign's ID, made from the key kind and value (for example Ip:203.0.113.5). Always present.
`keyKind`	`CampaignKeyKind`	What identifies the attacker: an IP address, a TLS fingerprint (Ja4) or a network operator (Asn). Always present. One of `Ip`, `Ja4`, `Asn`.
`keyValue`	string	The attacker's identifier: the IP address, the JA4 fingerprint, or the network number such as AS64500. Always present.
`firstSeen`	date-time	When PortWall first saw this campaign. Always present.
`lastSeen`	date-time	When PortWall last saw it, which is also when its counts were last updated. Always present.
`distinctTenants`	integer	How many different customers (tenants) the attacker hit. A site with no tenant counts as its own. Always present.
`distinctSites`	integer	How many different sites the attacker hit. Always present.
`eventCount`	integer	How many flagged requests from this attacker were counted in the detection window. Always present.
`maxSeverity`	`RuleSeverity`	The most serious rule severity among those requests. Always present. One of `Notice`, `Warning`, `Error`, `Critical`.
`status`	`CampaignStatus`	Whether the campaign is still active. Always present. One of `Active`, `Retired`.
`enforced`	boolean	True when PortWall acted on it automatically: it blocked the address or throttled the fingerprint. Once true it stays true. Always present.

CampaignKeyKind

What ties a campaign's attacks together.

Value	Meaning
`Ip`	The campaign is one IP address.
`Ja4`	The campaign is one TLS fingerprint, which finds an attacker who keeps changing IP address.
`Asn`	The campaign is one network operator (autonomous system), which finds a botnet spread over many addresses. It is reported only and never blocked automatically.

CampaignStatus

Whether a campaign is still going on.

Value	Meaning
`Active`	Seen recently, within the detection window.
`Retired`	No longer active; kept as a record.

CmsProfile

A ready-made set of protections for a common kind of website application.

Value	Meaning
`None`	No preset.
`WordPress`	Limits how often one visitor can use xmlrpc, login, comments and sign-up, and blocks pingback and multicall abuse and the listing of user names.
`Forum`	Limits how often one visitor can use a forum's login, posting and registration pages, as on phpBB.

ConfigApplyStatus

Where PortWall stands in applying saved changes in the background; poll it until your change is in force.

Field	Type	Description
`state`	string	applying while changes are still being applied, idle when nothing is waiting. Always present.
`requested`	integer	A counter of the changes asked for since PortWall started. A save returns the number its change was given (applySeq). Always present.
`completed`	integer	A counter of the changes applied so far. A change is in force once this reaches the applySeq its save returned. Always present.
`outcome`	string	How the latest apply ended: applied, deferred (saved, and taken up as soon as it can be), failed (see message), or none before the first apply. Always present.
`message`	string	Why the latest apply was deferred or failed. Null when it was applied or nothing has been applied yet.
`completedAt`	date-time	When the latest apply finished. Null until the first apply after PortWall started.
`reason`	string	A short label for the change that was last asked for, such as the site it was for. Null before the first change.

ConfigImportBody

A configuration file to restore, and how to restore it.

Field	Type	Description
`dryRun`	boolean	True to report what would change without changing anything. Default false, which applies the import. Always present.
`skipHostSpecific`	boolean	True to leave out settings that belong to the original server, such as its network addresses, for example when moving to a new server. Default false. Always present.
`bundle`	any JSON	The content of the file you downloaded from GET /api/config/export, sent as it was. Always present.

ConfigImportResult

What a configuration import did, or, for a dry run, what it would do.

Field	Type	Description
`applied`	boolean	True when the import was applied; false for a dry run. Always present.
`sourceServer`	string	The name of the server the bundle was exported from, or unknown. Always present.
`sourceVersion`	string	The PortWall version that exported the bundle, or unknown. Always present.
`schemaVersion`	integer	The layout version of the bundle; 0 when it does not say. Always present.
`sections`	list of `ConfigSectionChange`	The parts of the configuration found in the bundle and what happened to each. Parts the bundle does not contain are left out. Always present.
`notes`	list of string	Things to know after the import, such as settings that were skipped or secrets you must enter again. Always present.

ConfigSectionChange

What an import did, or would do, to one part of the configuration.

Field	Type	Description
`section`	string	The name of the part of the configuration, for example feed-enablement. Always present.
`present`	boolean	True when the bundle contains this part. Always present.
`added`	integer	How many items were new on this server. 0 for a part that is a single set of settings. Always present.
`updated`	integer	How many items already existed and were replaced. A single set of settings reports 1. Always present.

CreateApiKeyRequest

The details of an API key to create.

Field	Type	Description
`name`	string	A name to recognise the key by, 1 to 80 characters. Required. Can be null.
`role`	string	What the key may do: Admin (read and change), Viewer (read only) or Tenant (one tenant's own sites). Required. Can be null.
`tenantId`	string	The tenant a Tenant key is limited to. Required for role Tenant; ignored for other roles. Can be null.

CreateBlockRequest

The request body for blocking an address by hand, saying how long the block lasts.

Field	Type	Description
`ip`	string	The IPv4 or IPv6 address to block. An allowlisted address is refused with 409. Always present.
`ttlMinutes`	integer	How long to block for, in minutes. Between 1 minute and 1 year (525600); values outside that are adjusted to the nearest limit. Ignored when ttlHours or permanent is set. Always present.
`reason`	string	Why you are blocking it, shown in the block list and the audit log. Empty uses manual block. Can be null.
`ttlHours`	number	How long to block for, in hours; fractions are allowed (0.5 is 30 minutes). When set it is used instead of ttlMinutes. Limits are the same as for ttlMinutes. Can be null.
`permanent`	boolean	True to block until you remove it by hand; the block then has no expiry and any duration sent is ignored. Default false. Always present.

DetectionAction

What PortWall does to the addresses behind a bot cluster or credential stuffing.

Value	Meaning
`Alert`	Record the detection in the attack feed and send an alert; do nothing else to the addresses.
`Challenge`	Show the addresses the browser check for a while: a bot is stopped and a person passes in a moment.
`Block`	Block the addresses for a while.

EgressMode

Whether a site's outbound policy only reports connections it would stop, or stops them.

Value	Meaning
`Audit`	Outbound connections are not stopped; the ones the policy would stop are reported. Use it to learn what the site connects to.
`Enforce`	Outbound connections are denied by default: only the allowed remotes (and PortWall's essential destinations) can be reached.

EgressPolicy

A site's outbound (egress) policy: which remote addresses the site's application may connect out to, and whether that is only recorded or enforced.

Field	Type	Description
`siteName`	string	The site the policy belongs to. Always present.
`enabled`	boolean	True to apply the policy. False keeps it saved but applies no outbound rules. Always present.
`mode`	`EgressMode`	Audit records the outbound connections the policy would stop without stopping them; Enforce stops every connection not on the allowlist. Always present. One of `Audit`, `Enforce`.
`allowedRemotes`	list of string	The remote addresses or ranges (for example 203.0.113.5 or 10.0.0.0/24) the site may connect out to, such as its database and payment gateway. PortWall's own essential destinations are always allowed in addition. Always present.
`programPath`	string	The program whose outbound connections are controlled. Defaults to the IIS web worker process when not given. Always present.
`updatedBy`	string	Who last set the policy: the signed-in user or API key name. Can be null.
`updatedAt`	date-time	When the policy was last set. Always present.

EgressPolicyUpdate

The outbound policy to set for a site; the site name comes from the URL.

Field	Type	Description
`enabled`	boolean	True to apply the policy. False keeps it saved but applies no outbound rules. Always present.
`mode`	`EgressMode`	Audit records the outbound connections the policy would stop without stopping them; Enforce stops every connection not on the allowlist. Always present. One of `Audit`, `Enforce`.
`allowedRemotes`	list of string	The remote addresses or ranges (for example 203.0.113.5 or 10.0.0.0/24) the site may connect out to, such as its database and payment gateway. PortWall's own essential destinations are always allowed in addition. Can be null.
`programPath`	string	The program whose outbound connections are controlled. Defaults to the IIS web worker process when not given. Can be null.

EngineMode

Whether the WAF engine inspects a site's traffic and whether it blocks what it flags.

Value	Meaning
`Off`	The WAF does not inspect this site's requests.
`DetectionOnly`	The WAF inspects requests and records attacks in the Attack Feed but blocks nothing. The default for a new site.
`On`	The WAF inspects requests and blocks those that reach the anomaly threshold.

FailMode

What a site does with a request PortWall cannot fully inspect: a body larger than the WAF inspection limit, or an upload the scanner could not check.

Value	Meaning
`Open`	Let it through: the first part of an oversized body is inspected and the rest passed, and an upload the scanner could not check goes to the site.
`Closed`	Refuse it: a body larger than the inspection limit gets 413, and an upload the scanner could not check (scanner down, timed out, file too large to scan) gets 403.

FeedAction

What happens to addresses a threat-intelligence feed lists.

Value	Meaning
`Drop`	Addresses on the feed are blocked at the firewall.
`DetectionOnly`	Addresses on the feed are counted but not blocked, so you can try a feed before enforcing it.
`Challenge`	Addresses on the feed get the browser check instead of a hard block, which suits shared addresses; a real browser passes and a simple bot does not.

FeedFormat

The layout of a threat-intelligence feed's list.

Value	Meaning
`PlainList`	One address or range per line, with blank lines and comment lines ignored.
`SpamhausDrop`	The Spamhaus DROP layout, a range followed by a semicolon and a reference.

FeedStatus

A feed's switch, action and the outcome of its last refresh, as saved after you change the feed.

Field	Type	Description
`feedId`	string	The feed's ID. Always present.
`enabled`	boolean	Whether the feed is switched on. Always present.
`action`	`FeedAction`	What happens to addresses the feed lists: Drop, DetectionOnly or Challenge. Always present. One of `Drop`, `DetectionOnly`, `Challenge`.
`entryCount`	integer	How many addresses or ranges the last refresh loaded. 0 before the first refresh. Always present.
`lastRefreshedAt`	date-time	When the feed was last downloaded. Null until the first refresh.
`lastRefreshOk`	boolean	True when the last refresh worked. Always present.
`lastError`	string	Why the last refresh failed. Null when it worked or has not run yet.

FeedSubsystemUpdate

The request body for the threat-intelligence master switch.

Field	Type	Description
`enabled`	boolean	True to turn threat-intelligence feeds on, false to turn them all off. Always present.

FeedUpdate

The request body for turning one feed on or off and choosing what happens to addresses it lists.

Field	Type	Description
`enabled`	boolean	Whether this feed is switched on. A feed does nothing while the master switch is off, whatever this says. Always present.
`action`	`FeedAction`	What happens to addresses the feed lists: Drop, DetectionOnly or Challenge. Drop is the default for a feed that has not been set. Always present. One of `Drop`, `DetectionOnly`, `Challenge`.

FeedView

One built-in threat-intelligence feed with its licence, settings and the outcome of its last refresh.

Field	Type	Description
`id`	string	The feed's ID, used in the URL to change it. Always present.
`name`	string	The feed's display name. Always present.
`format`	`FeedFormat`	How the feed's list is laid out, so PortWall can read it. Always present. One of `PlainList`, `SpamhausDrop`.
`license`	string	The terms under which the feed's publisher allows it to be used. Always present.
`attribution`	string	The publisher to credit when you use the feed. Always present.
`commercialSafe`	boolean	True when the publisher's terms allow commercial use. Always present.
`refreshIntervalMinutes`	integer	How often PortWall downloads the feed again, in minutes. Always present.
`enabled`	boolean	Whether this feed is switched on. A feed does nothing while the master switch is off, whatever this says. Always present.
`action`	string	What happens to addresses the feed lists: Drop, DetectionOnly or Challenge. Drop is the default for a feed that has not been set. Always present.
`entryCount`	integer	How many addresses or ranges the last refresh loaded. 0 before the first refresh. Always present.
`lastRefreshedAt`	date-time	When the feed was last downloaded. Null until the first refresh.
`lastRefreshOk`	boolean	True when the last refresh worked. False before the first refresh or when it failed; see lastError. Always present.
`lastError`	string	Why the last refresh failed. Null when it worked or has not run yet.

FeedsView

The threat-intelligence feeds: the master switch, how many address ranges are being blocked, and each feed.

Field	Type	Description
`subsystemEnabled`	boolean	The threat-intelligence master switch. While it is off no feed is downloaded or enforced, whatever each feed's own setting. Always present.
`enforcedRanges`	integer	How many address ranges the feeds are blocking now, after your allowlist is taken out. Always present.
`feeds`	list of `FeedView`	Every built-in feed and its state. Always present.

FlaggedVisitor

One address that a detection has sent to the browser check or blocked, and until when.

Field	Type	Description
`address`	string	The visitor's IP address. Always present.
`until`	date-time	When the challenge or block on this address ends. Always present.
`reason`	string	Why the address was flagged, in words. Always present.

FlushTemporaryResult

The result of removing all temporary blocks.

Field	Type	Description
`removed`	integer	How many temporary blocks were removed. Permanent blocks are not counted and not removed. Always present.

ForensicHeader

One request header captured in a forensic snapshot.

Field	Type	Description
`name`	string	The header name. Always present.
`value`	string	The header value, with sensitive values masked. Always present.

ForensicSnapshot

A copy of the request that triggered a detection, kept so you can see what the attacker actually sent.

Field	Type	Description
`method`	string	The HTTP method of the request, for example GET or POST. Always present.
`uri`	string	The path and query string that was requested. Always present.
`protocol`	string	The HTTP version used, for example HTTP/1.1 or HTTP/2.0. Always present.
`headers`	list of `ForensicHeader`	A selection of the request's headers. Sensitive values such as cookies and authorisation headers are masked. Always present.
`bodySample`	string	The start of the request body, cut to a fixed size. Empty unless request-body capture has been turned on, which is off by default because bodies often hold personal data. Always present.
`bodyTruncated`	boolean	True when the body was longer than the sample kept. Always present.
`ja4`	string	The JA4 fingerprint of the client's TLS connection, which identifies the software making the request. Null when none was captured.

GeoBlockPolicy

A geo-blocking policy: which countries it covers, where and how it is enforced, and whether it only records or actually blocks.

Field	Type	Description
`id`	string	The policy's ID: a single word with no spaces, underscores or quotes, chosen when the policy was created. Always present.
`countries`	list of string	The countries the policy covers, as two-letter ISO codes (stored in upper case). At least one. Always present.
`protocol`	`GeoProtocol`	Which traffic a firewall policy covers: Any, Tcp or Udp. Only used by firewall policies. Always present. One of `Any`, `Tcp`, `Udp`.
`ports`	list of integer	The ports a firewall policy covers, from 1 to 65535. Empty means all ports, which needs protocol Any; a list needs Tcp or Udp. Not used by engine policies. Always present.
`mode`	`GeoMode`	Audit records what the policy would have done without blocking anything; Enforce blocks. Always present. One of `Audit`, `Enforce`.
`layer`	`GeoLayer`	Where the policy is enforced: Firewall drops the traffic at the network layer on any port; DataPlane blocks web requests in the engine. Default Firewall. Always present. One of `Firewall`, `DataPlane`.
`selector`	`GeoSelector`	Block refuses the listed countries; Allow admits only the listed countries and refuses everyone else. Allow needs layer DataPlane. Default Block. Always present. One of `Block`, `Allow`.
`response`	`GeoResponse`	How an engine policy answers: Deny refuses with 403 Forbidden; Challenge gives visitors from the listed countries the browser check (on an Allow policy, requests from elsewhere are refused with 429). Not used by firewall policies. Default Deny. Always present. One of `Deny`, `Challenge`.
`updatedBy`	string	Who last saved the policy. Null if not recorded.
`updatedAt`	date-time	When the policy was last saved. Always present.
`letCertificateChecksThrough`	boolean	For a firewall Block policy: leave ports 80 and 443 to the engine, which blocks the countries there but lets certificate checks through, so certificate issuing and renewal keep working. Default false. Always present.

GeoLayer

Where a geo-blocking policy is enforced.

Value	Meaning
`Firewall`	Blocks at the network layer, before the engine, on the ports and protocol you choose. Supports Block only.
`DataPlane`	Blocks web requests in the engine. Ports and protocol are ignored. The only layer that supports Allow.

GeoMode

Whether a geo-blocking policy blocks or only records.

Value	Meaning
`Audit`	Records what the policy would block but blocks nothing, so you can see the effect first.
`Enforce`	Blocks traffic from the countries.

GeoPolicyUpdate

The request body for creating or changing a geo-blocking policy; the policy ID comes from the URL.

Field	Type	Description
`countries`	list of string	The countries the policy covers, as two-letter ISO codes (stored in upper case). At least one. Always present.
`protocol`	`GeoProtocol`	Which traffic a firewall policy covers: Any, Tcp or Udp. Only used by firewall policies. Always present. One of `Any`, `Tcp`, `Udp`.
`ports`	list of integer	The ports a firewall policy covers, from 1 to 65535. Empty means all ports, which needs protocol Any; a list needs Tcp or Udp. Not used by engine policies. Can be null.
`mode`	`GeoMode`	Audit records what the policy would have done without blocking anything; Enforce blocks. Always present. One of `Audit`, `Enforce`.
`layer`	`GeoLayer`	Where the policy is enforced: Firewall drops the traffic at the network layer on any port; DataPlane blocks web requests in the engine. Default Firewall. Always present. One of `Firewall`, `DataPlane`.
`selector`	`GeoSelector`	Block refuses the listed countries; Allow admits only the listed countries and refuses everyone else. Allow needs layer DataPlane. Default Block. Always present. One of `Block`, `Allow`.
`response`	`GeoResponse`	How an engine policy answers: Deny refuses with 403 Forbidden; Challenge gives visitors from the listed countries the browser check (on an Allow policy, requests from elsewhere are refused with 429). Not used by firewall policies. Default Deny. Always present. One of `Deny`, `Challenge`.
`letCertificateChecksThrough`	boolean	For a firewall Block policy: leave ports 80 and 443 to the engine, which blocks the countries there but lets certificate checks through, so certificate issuing and renewal keep working. Default false. Always present.

GeoProtocol

Which traffic a firewall geo-blocking policy covers.

Value	Meaning
`Any`	All traffic, so no port list is allowed.
`Tcp`	TCP only, optionally limited to the ports listed.
`Udp`	UDP only, optionally limited to the ports listed.

GeoResponse

What a web request refused by geo-blocking receives.

Value	Meaning
`Deny`	Refuse the request with a 403 Forbidden.
`Challenge`	On a policy that blocks the listed countries, visitors from them get the browser check: a real browser passes in a moment, most attack tools do not. On a policy that admits only the listed countries, requests from elsewhere are refused with 429 Too Many Requests.

GeoSearchEnginesUpdate

The request body for letting search-engine crawlers through geo blocking.

Field	Type	Description
`letThrough`	boolean	True to let the crawlers of Google, Bing, Apple and DuckDuckGo through every geo policy (the default), false to block them like any other visitor from a blocked country. Always present.

GeoSelector

Whether a geo-blocking policy refuses the listed countries or admits only them.

Value	Meaning
`Block`	Refuse traffic from the listed countries.
`Allow`	Admit only the listed countries and refuse everywhere else; allowlisted addresses are still admitted. Needs layer DataPlane.

GeoSubsystemUpdate

The request body for the geo-blocking master switch.

Field	Type	Description
`enabled`	boolean	True to turn geo-blocking on, false to turn it off. While off no policy is enforced. Always present.

GrantRequest

Request body that gives a panel user a role on a site; the site is named in the URL.

Field	Type	Description
`userId`	string	The panel user who has access. Always present.
`role`	`SiteRole`	What the user may do with the site: look only, or also change its settings within the tenant policy. Always present. One of `Viewer`, `Manager`.

HealthView

The reply of the health check.

Field	Type	Description
`status`	string	Always ok while the management service is running. Always present.

LicenseView

The licence as this installation sees it: its state, its edition and which licensed features are in force. The key itself is never included.

Field	Type	Description
`licenseKeyMasked`	string	The licence key with all but its last characters hidden, so you can tell which key is in use. Empty when there is none. Always present.
`licenseKeyPresent`	boolean	True when a licence key is set. Always present.
`licenseKeyFromConsole`	boolean	True when the key in use was entered in the console or through this API; false when it comes from the server's configuration file. Always present.
`enabled`	boolean	False only when licensing is not turned on for this installation; then state is Licensed and the other fields are absent. Always present.
`state`	string	Licensed (everything active), Grace (the licence could not be confirmed recently; protection stays fully on for at most 72 hours) or Unlicensed (blocking is switched off). Always present.
`reason`	string	Why the licence is in this state, in words. Always present.
`installId`	string	This installation's ID. Quote it when you write to PortWall about a licence. Always present.
`enforcementActive`	boolean	Whether PortWall is blocking attacks. False when Unlicensed: attacks are still detected and recorded, but not blocked. Always present.
`scanningActive`	boolean	Whether uploaded-file scanning is allowed by the licence. Always present.
`tier`	string	The name of your edition, for example Windows Premium or Appliance Enterprise. Always present.
`premium`	boolean	True when your edition is Premium or higher. Always present.
`enterprise`	boolean	True when your edition is Enterprise, which adds API protection. Always present.
`herdImmunityActive`	boolean	True when this server receives protection from attacker data shared by other PortWall servers (herd immunity). Needs Premium or higher. Always present.
`herdImmunityContributing`	boolean	True when this server shares its attack data with other PortWall servers. A Standard server contributes without receiving. Always present.
`smartTuningActive`	boolean	True when the Smart Tuning Advisor, which suggests rule exclusions, is available. Always present.
`premiumThreatIntelActive`	boolean	True when Premium Threat Intelligence is available. Always present.
`managedCertRenewalActive`	boolean	True when PortWall may renew its managed TLS certificates. Always present.
`blockStatePreserved`	boolean	Always true: current blocks and your settings are kept when a licence lapses, and work again once it is renewed. Always present.

NotificationPreferences

Which events PortWall notifies you about; where the notifications go (email, webhooks) is set elsewhere.

Field	Type	Description
`enabled`	boolean	Master switch for notifications. When false, nothing is sent whatever else is set here. Always present.
`alertKinds`	list of `SecurityEventKind`	The event types that always notify, whatever their score. Unknown values are dropped and repeats removed when you save. Always present.
`minAnomalyScore`	integer	An event of any type notifies when its anomaly score is at or above this, from 0 to 1000. Default 20. Always present.
`crsHitMinScore`	integer	An extra minimum score for single WAF rule hits, which are the noisiest event type: a rule hit notifies only at or above this score. From 0 to 1000; 0 means no extra minimum, which is the default. Always present.
`kindsVersion`	integer	Bookkeeping: which version of the event-type list these settings were saved against. Send back the value that GET returned; PortWall sets the current value when you save. Always present.

OkResult

Confirmation that the request was carried out.

Field	Type	Description
`ok`	boolean	Always true when the request was carried out. Always present.

PagedResultOfQuarantineEntry

One page of a list of QuarantineEntry.

Field	Type	Description
`items`	list of `QuarantineEntry`	The records on this page. Always present.
`total`	integer	How many records match in all, across every page. Always present.
`offset`	integer	How many records were skipped before this page (the skip you asked for, never below 0). Always present.
`limit`	integer	The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present.
`hasMore`	boolean	True when more records follow this page. Ask for the next page by adding limit to the skip. Always present.
`hasPrevious`	boolean	True when records come before this page (offset above 0). Always present.

PagedResultOfScanRun

One page of a list of ScanRun.

Field	Type	Description
`items`	list of `ScanRun`	The records on this page. Always present.
`total`	integer	How many records match in all, across every page. Always present.
`offset`	integer	How many records were skipped before this page (the skip you asked for, never below 0). Always present.
`limit`	integer	The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present.
`hasMore`	boolean	True when more records follow this page. Ask for the next page by adding limit to the skip. Always present.
`hasPrevious`	boolean	True when records come before this page (offset above 0). Always present.

PagedResultOfSecurityEventSummary

One page of a list of SecurityEventSummary.

Field	Type	Description
`items`	list of `SecurityEventSummary`	The records on this page. Always present.
`total`	integer	How many records match in all, across every page. Always present.
`offset`	integer	How many records were skipped before this page (the skip you asked for, never below 0). Always present.
`limit`	integer	The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present.
`hasMore`	boolean	True when more records follow this page. Ask for the next page by adding limit to the skip. Always present.
`hasPrevious`	boolean	True when records come before this page (offset above 0). Always present.

PagedResultOfSitePolicy

One page of a list of SitePolicy.

Field	Type	Description
`items`	list of `SitePolicy`	The records on this page. Always present.
`total`	integer	How many records match in all, across every page. Always present.
`offset`	integer	How many records were skipped before this page (the skip you asked for, never below 0). Always present.
`limit`	integer	The most records this page can hold (the take you asked for; at most 200, 50 when you gave none). Always present.
`hasMore`	boolean	True when more records follow this page. Ask for the next page by adding limit to the skip. Always present.
`hasPrevious`	boolean	True when records come before this page (offset above 0). Always present.

PatchStage

Whether a virtual patch only records what it matches or also blocks it.

Value	Meaning
`DetectionOnly`	The patch records matching requests and blocks nothing, even when the site is On. Use it to check the patch first.
`Blocking`	The patch refuses matching requests with a 403.

PatchStageRequest

A request to switch a virtual patch between detecting and blocking.

Field	Type	Description
`stage`	`PatchStage`	The stage to switch the patch to: DetectionOnly to record only, or Blocking to refuse matching requests. Always present. One of `DetectionOnly`, `Blocking`.

ProblemDetails

The standard error shape (RFC 7807) that some unexpected errors use, such as a server error that has no more specific reply.

Field	Type	Description
`type`	string	A web address that identifies the kind of problem, when there is one. Can be null.
`title`	string	A short summary of the problem. Can be null.
`status`	integer	The HTTP status code. Can be null.
`detail`	string	A longer explanation of this problem, when there is one. Can be null.
`instance`	string	A reference for this occurrence of the problem, when there is one. Can be null.

ProtectionFeatureView

The state of one protection: whether it is on, whether it is really enforcing, and what to do if it is not.

Field	Type	Description
`id`	string	A stable short name for the protection, for example geo or brute-force. Always present.
`name`	string	The protection's name as shown in the console. Always present.
`enabled`	boolean	Whether the protection is turned on. Always present.
`enforcing`	boolean	Whether a protection that is on is actually doing its job. Only meaningful when enabled is true. Always present.
`severity`	string	The overall verdict: Ok, Disabled (deliberately off), Warning (working but degraded) or Critical (on but not enforcing). Always present.
`detail`	string	The current state in plain words. Always present.
`fix`	string	What to do next when the protection is not working properly. Null when severity is Ok or Disabled.
`stats`	list of `ProtectionStat`	A few short figures for the protection, such as how many rules are loaded. Always present.
`page`	string	The console page where this protection is managed. Null if it has none.
`checkedAt`	date-time	When this protection was last checked. Null if it has not been.

ProtectionStat

One short figure shown on a protection's card, such as a count of rules.

Field	Type	Description
`label`	string	What the figure counts, for example firewall rules. Always present.
`value`	string	The figure, already formatted as text. Always present.

ProtectionStatusView

Whether every protection that is turned on is actually enforcing, as shown in the Overview's Protection status cards.

Field	Type	Description
`available`	boolean	False only for a short time after PortWall starts, before the first check has finished; the other fields are then empty. Always present.
`generatedAt`	date-time	When these checks were made. Null while available is false.
`summary`	string	One line saying how protection is doing, for example how many protections are on and enforcing. Always present.
`criticalCount`	integer	How many protections are turned on but not enforcing anything. Always present.
`warningCount`	integer	How many protections are enforcing but degraded. Always present.
`problemCount`	integer	criticalCount plus warningCount: the number of protections that need attention. Always present.
`allHealthy`	boolean	True when problemCount is 0. Protections that are deliberately off do not count as problems. False while available is false. Always present.
`features`	list of `ProtectionFeatureView`	Every protection and its state. Always present.
`problems`	list of `ProtectionFeatureView`	Only the protections that need attention, most serious first. Each has a fix. Always present.

QuarantineContent

A read-only preview of a quarantined file, so you can see what was caught without restoring it.

Field	Type	Description
`ok`	boolean	True if the file could be read. Always present.
`error`	string	Why the file could not be read. Null when ok is true.
`sha256`	string	SHA-256 hash of the file's content, as hex. Always present.
`originalPath`	string	Where the file was before it was quarantined. Always present.
`signature`	string	The name of the malware signature that matched the file. Always present.
`size`	integer	Size of the whole file in bytes. 0 if the file could not be read. Always present.
`truncated`	boolean	True if the file is larger than the preview, which holds only the first 64 KB. Always present.
`isBinary`	boolean	True if the file looks like binary data rather than text. Always present.
`text`	string	The start of the file, with each byte shown as one character. Empty if the file could not be read. Always present.

QuarantineDone

Reply confirming that the quarantined file was restored or deleted.

Field	Type	Description
`done`	boolean	True when the file was restored or deleted. Always present.

QuarantineEntry

A file that PortWall moved into quarantine because a scan found it malicious.

Field	Type	Description
`sha256`	string	SHA-256 hash of the file's content, as hex. It identifies the quarantined file in the API. Always present.
`originalPath`	string	Where the file was before it was quarantined, and where a restore puts it back. Always present.
`site`	string	The site the file belonged to. Null if it was not tied to a site.
`signature`	string	The name of the malware signature that matched the file. Always present.
`quarantinedAt`	date-time	When the file was quarantined. Always present.

QuarantineOp

What to do with a quarantined file.

Value	Meaning
`Restore`	Put the file back where it was found, as the original file.
`Delete`	Remove the file permanently.

QuarantineRequestDto

Request body that says whether to restore or delete a quarantined file.

Field	Type	Description
`op`	`QuarantineOp`	Whether to restore the file to where it came from, or delete it for good. Always present. One of `Restore`, `Delete`.

QuarantineRequested

Reply confirming that the request was sent to the host for approval.

Field	Type	Description
`requested`	boolean	True when the request was recorded for the host to decide. Always present.
`id`	string	The ID of the request. Always present.

ReportCount

A name and how many times it occurred, used for the top-10 and by-kind lists in a report.

Field	Type	Description
`key`	string	What is being counted, such as an address, rule ID, site, country or kind of event. Always present.
`count`	integer	How many times it occurred in the period. Always present.

ReportPeriod

The span of time a security report covers.

Field	Type	Description
`from`	date-time	Start of the period; events at or after this time are counted. Always present.
`to`	date-time	End of the period; events before this time are counted. Always present.
`label`	string	A short name for the period, for example Last 7 days. Always present.

RetryLater

Reply when a scan is refused because the site was scanned too recently.

Field	Type	Description
`error`	string	Why the scan was refused, in a sentence. Always present.
`retryAt`	date-time	The earliest time a new scan is allowed. Can be null.

RollbackResult

The result of rolling a site back to an earlier saved revision.

Field	Type	Description
`restored`	integer	The revision number whose settings were restored. Always present.
`newVersion`	integer	The new revision created by the rollback, holding the restored settings. Always present.

RuleExclusion

A narrow exception that stops one OWASP Core Rule Set rule from firing, optionally only on one path or for one parameter, with the reason it exists.

Field	Type	Description
`ruleId`	string	The OWASP Core Rule Set rule to switch off, as a number such as 942100 (shown in the Attack Feed). When limited to a route or parameter, one id or one range such as 941000-941999. Always present.
`route`	string	Limits the exclusion to requests whose path starts with this text, for example /checkout. Empty to apply on every path. Can be null.
`param`	string	Limits the exclusion to one field, such as a form field, cookie or header name, instead of the whole rule. Empty to exclude the rule entirely. Can be null.
`reason`	string	Why the exclusion exists, so it can be reviewed later. Must not contain double quotes, backticks, braces or line breaks. Always present.
`target`	string	Where the parameter lives: ARGS (query and form fields, the default when empty), ARGS_NAMES, REQUEST_COOKIES, REQUEST_COOKIES_NAMES, REQUEST_HEADERS or REQUEST_HEADERS_NAMES. Only used with param. Can be null.

RuleHit

One rule that fired on a request, with how serious it is and what it matched.

Field	Type	Description
`ruleId`	string	The ID of the rule that fired. Always present.
`severity`	`RuleSeverity`	How serious the rule considers the match. Always present. One of `Notice`, `Warning`, `Error`, `Critical`.
`owaspCategory`	string	The kind of attack the rule is for: an OWASP Top 10 code such as A03, an attack family such as attack-sqli, api-protection for an API protection finding, or empty when the rule has none. Always present.
`redactedMatch`	string	The part of the request that matched, shortened and with secrets removed. Always present.
`message`	string	A plain-language description of what the rule detected. May be empty. Always present.
`isApiProtection`	boolean	True when this is an API protection finding (a request outside your API specification, for example). These are shown in the feed but do not add to an address's score. Always present.
`isGeo`	boolean	True when the rule is a geo blocking rule: the request was refused, or logged, because of the country it came from. A request only geo blocking acted on is counted on the Geo Blocking page and is not listed in the attack feed. Always present.

RuleSeverity

How serious a WAF rule judges what it matched.

Value	Meaning
`Notice`	The lowest severity: unusual but rarely harmful on its own.
`Warning`	A suspicious request that may be harmless.
`Error`	A request that very likely carries an attack.
`Critical`	The highest severity: a clear attack.

ScanRun

One scan of a site's files for malware, with its progress and results.

Field	Type	Description
`id`	string	The scan's ID, used to follow it. Always present.
`site`	string	The site that was scanned. Null when a folder was scanned by path instead of by site.
`requestedBy`	string	Who started the scan: the name of the API key or user. Always present.
`status`	`ScanRunStatus`	Whether the scan is still going, finished, or failed. Always present. One of `Running`, `Completed`, `Failed`.
`startedAt`	date-time	When the scan started. Always present.
`completedAt`	date-time	When the scan finished. Null while it is still running.
`filesScanned`	integer	How many files were checked. Always present.
`filesSkipped`	integer	How many files were not checked, for example because they were over the size limit. Always present.
`errors`	integer	How many files could not be checked because of an error. Always present.
`threatsFound`	integer	How many malicious files the scan found. Always present.
`error`	string	Why the scan failed. Null unless the status is Failed.
`threats`	list of `ScanThreatInfo`	The malicious files found, each with its signature and whether it was quarantined. Empty when none were found. Always present.

ScanRunStatus

Where a file scan has got to.

Value	Meaning
`Running`	The scan is still going.
`Completed`	The scan finished and checked the files.
`Failed`	The scan stopped because of an error; the error field says why.

ScanStarted

Reply to starting a scan, giving the ID to follow it by.

Field	Type	Description
`runId`	string	The ID of the scan that was started. Find it in the site's list of scans. Always present.

ScanThreatInfo

One malicious file that a scan found.

Field	Type	Description
`path`	string	Full path of the malicious file on the server. Always present.
`signature`	string	The name of the malware signature that matched the file. Always present.
`quarantined`	boolean	True if the file was moved into quarantine; false if it was left in place on disk. Always present.

SearchEnginesState

Whether search-engine crawlers are let through geo blocking, after you changed it.

Field	Type	Description
`letThrough`	boolean	Whether search-engine crawlers are now let through. Always present.

SecurityEventKind

What kind of event was recorded: attacks in the attack feed, and the operational incidents PortWall reports.

Value	Meaning
`CrsHit`	A web request tripped one or more OWASP Core Rule Set rules. The most common entry in the attack feed.
`RateLimitTrip`	A source sent requests faster than a rate limit allows.
`Probe404`	A source asked for pages that do not exist, a pattern typical of scanning for weak spots.
`HoneypotTouch`	A source requested a decoy path that no real visitor would, which marks it as hostile.
`ScanResult`	A file scan found malware in an upload.
`FingerprintAnomaly`	A client's TLS fingerprint or behaviour looks like an automated tool rather than a real browser.
`ThreatIntelMatch`	A source matched a threat-intelligence list.
`SelfTamper`	A PortWall file, rule set or configuration was changed outside PortWall.
`AuthFailure`	A failed login attempt on a monitored service, counted towards brute-force detection.
`CredentialStuffing`	Many failed logins against one site from many sources, which suggests a credential-stuffing attack.
`PortScan`	One source tried many different ports on this server in a short time, read from the firewall's dropped-packet log.
`EgressAnomaly`	A site made outbound connections that look like beaconing or that its outbound policy does not allow.
`PrivilegeEscalation`	The identity a website runs as did something that suggests a takeover, such as creating a local user, joining the Administrators group or starting a shell. A critical incident for you to investigate; it usually has no attacker address and nothing is blocked.
`CampaignDetected`	One attacker was seen hitting many different customers, which indicates a coordinated sweep. See the campaigns list.
`BindingHazard`	Operational incident, not an attack, kept out of the attack feed: an IIS site is bound to all addresses or the public address, so it could receive traffic that bypasses PortWall.
`ManagedCertExpiring`	Operational incident, not an attack, kept out of the attack feed: a PortWall-managed certificate is close to expiry because renewal is failing.
`ManagedCertReverted`	Operational incident, not an attack, kept out of the attack feed: a site's hostname now points at a different server, so PortWall stopped trying to issue its managed certificate.
`LicenseWarning`	Operational incident, not an attack, kept out of the attack feed: the licence could not be verified but is still in its grace period, and protection continues unchanged.
`LicenseViolation`	Operational incident, not an attack, kept out of the attack feed: the licence grace period has run out, so PortWall is detecting but no longer blocking until the licence is renewed.
`DataPlaneWedged`	Operational incident, not an attack, kept out of the attack feed: the engine is running but has stopped answering, so sites are not being served.
`HostNotServing`	Operational incident, not an attack, kept out of the attack feed: nothing is answering on the server's web address, so every site is down.
`ManagedCertIssuerChanged`	Operational incident, not an attack, kept out of the attack feed: a managed certificate is now issued by a different certificate authority than before.
`PanelCertRenewed`	Operational incident, not an attack, kept out of the attack feed: your hosting panel renewed a site's certificate and PortWall now serves the new one. Informational.
`PanelCertExpiring`	Operational incident, not an attack, kept out of the attack feed: a certificate issued by your hosting panel is close to expiry and has not been replaced; only the panel can renew it.
`ConfigDiverged`	Operational incident, not an attack, kept out of the attack feed: the engine is not running the configuration PortWall has saved and repeated attempts to apply it have failed.
`EnforcementGap`	Operational incident, not an attack, kept out of the attack feed: a protection is turned on but is not enforcing anything. See Protection status.
`ExcludedCrsHit`	A rule fired, but every rule it matched is on your exclusion list, so it is treated as a suppressed false positive. The console lists these separately; they never appear in the attack feed and never cause a block.
`VirtualPatchAdded`	Operational notice, not an attack, kept out of the attack feed: a new PortWall virtual patch for a known vulnerability now protects your sites.
`DataPlaneSlow`	Operational notice, not an attack, kept out of the attack feed: the engine is serving but answering PortWall's health check slowly. PortWall does not restart it.

SecurityEventSummary

One entry in the attack feed: a single detection against a site, with its source, the rules that fired and, where captured, the request itself.

Field	Type	Description
`timestamp`	date-time	When the event was detected. Always present.
`source`	string	The IP address the event came from. 255.255.255.255 for operational incidents, which have no attacker address. Always present.
`site`	string	The site the event concerns, or a label such as host for events about the server itself. Always present.
`kind`	string	What sort of event this is, using the names listed under SecurityEventKind. Attack kinds appear in the attack feed; operational incidents are kept out of it. Always present.
`anomalyScore`	integer	How serious the event is; higher is worse. For a web request it is the total the OWASP Core Rule Set rules added up to, and 0 when no score applies. Always present.
`ruleIds`	string	The IDs of the rules that fired, separated by commas. Empty when the event did not come from a rule. Always present.
`correlationId`	string	An identifier tying the event to the request or detection it came from. May be empty. Always present.
`forensics`	`ForensicSnapshot`	A copy of the request that caused the event. Null when none was captured, for example for events that are not web requests.
`hits`	list of `RuleHit`	The individual rules that fired, with their severity and what they matched. Null or empty when none apply.
`country`	string	Two-letter ISO country code of the source, looked up when you read the feed. Null when unknown.
`sourceAllowlisted`	boolean	True when the source is on the allowlist now: the event was flagged and logged but the address is deliberately never blocked. Always present.
`verdict`	string	What PortWall did with the request: Block when it refused it, Allow when it logged it and let it through (the site's protection only reports, or the rules that fired do not refuse on their own). Null for events that are not web requests, and for events recorded before PortWall 1.2.49.
`responseStatus`	integer	The HTTP status PortWall answered the request with, for example 403 when it refused it. Null for events that are not web requests, and for events recorded before PortWall 1.2.49.

SecurityReport

A summary of the attacks PortWall saw and the blocks and quarantines it made over a period.

Field	Type	Description
`period`	`ReportPeriod`	The time span the report covers. Always present.
`generatedAt`	date-time	When the report was made. Always present.
`scope`	string	What the report covers: All sites, or the number of sites for a tenant. Always present.
`totalEvents`	integer	How many attacks and other security events were detected in the period. Counted from the most recent 20,000 events. Always present.
`criticalIncidents`	integer	How many of those events were serious kinds: privilege escalation, tampering with PortWall, credential stuffing, unusual outbound traffic, or a malicious file found by a scan. Always present.
`eventsByKind`	list of `ReportCount`	How many events there were of each kind, most frequent first. Always present.
`topSources`	list of `ReportCount`	The ten addresses that caused the most events, most frequent first. Always present.
`topRules`	list of `ReportCount`	The ten rules that matched most often, most frequent first. Always present.
`activeBlocks`	integer	How many addresses are blocked right now. Always 0 in a tenant report, because blocks apply to the whole server. Always present.
`blocksInPeriod`	integer	How many address blocks were created in the period. Always 0 in a tenant report. Always present.
`filesQuarantinedInPeriod`	integer	How many files were quarantined in the period. Always present.
`topSites`	list of `ReportCount`	The ten sites with the most events, most frequent first. Can be null.
`topCountries`	list of `ReportCount`	The ten countries (two-letter codes) the attacks came from, most frequent first. Empty when no country database is loaded. Can be null.

SetLicenseKeyRequest

The licence key to save for this installation.

Field	Type	Description
`licenseKey`	string	The licence key, as shown in the customer portal. Required; at most 200 characters. Can be null.

SetLicenseKeyResult

The result of saving a licence key.

Field	Type	Description
`saved`	boolean	True when the key was saved. Always present.
`licenseKeyMasked`	string	The saved key with all but its last characters hidden. Always present.
`activating`	boolean	True when a licence check was asked for at once, so the new state shows within moments on GET /api/license. False when the key was saved but the check waits for the next scheduled one. Always present.

SettingsSaved

The reply to saving settings that are applied in the background, with how to tell when they are in force.

Field	Type	Description
`saved`	boolean	True when the settings were stored. Always present.
`applying`	boolean	True when PortWall is applying the settings in the background. The change is in force once the apply status reports it completed. Always present.
`applySeq`	integer	A number to wait for: the settings are in force when completed from GET /api/config-apply/status reaches this number. Always present.
`pending`	string	A note when the settings are saved but cannot be applied yet. Empty when there is nothing waiting. Can be null.

SiteAccess

A site a tenant can reach, together with the tenant's role on it.

Field	Type	Description
`site`	`SitePolicy`	The site's settings, as the tenant sees them. Always present.
`role`	`SiteRole`	What the tenant may do with this site: look only, or also change its settings. Always present. One of `Viewer`, `Manager`.

SiteDeletedWithWarning

The reply when a site's PortWall settings were removed but the running configuration still contains the site.

Field	Type	Description
`deleted`	string	The name of the site whose PortWall settings were removed. Always present.
`warning`	string	Why the site is still in the running configuration and how to clear it. Always present.

SiteModeResult

The result of switching several sites to one mode: which sites changed, and how to tell when the change is in force.

Field	Type	Description
`mode`	`EngineMode`	The mode the sites were switched to. Always present. One of `Off`, `DetectionOnly`, `On`.
`changed`	integer	How many sites actually changed. Sites already in that mode are not counted. Always present.
`total`	integer	How many sites the request covered. Always present.
`sites`	list of string	The names of the sites that changed. Always present.
`pending`	string	A note when the change is saved but cannot be applied yet. Empty when there is nothing waiting. Can be null.
`applying`	boolean	True when PortWall is applying the change in the background. Left out when no site needed changing. Can be null.
`applySeq`	integer	A number to wait for: the change is in force when completed from GET /api/config-apply/status reaches this number. Left out when no site needed changing. Can be null.

SitePolicy

One site's protection settings: its WAF mode, rule strictness, exclusions, login protection and CMS preset.

Field	Type	Description
`siteName`	string	The site's name, as it appears in PortWall and in the URL of the site endpoints. Always present.
`mode`	`EngineMode`	What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Always present. One of `Off`, `DetectionOnly`, `On`.
`paranoiaLevel`	integer	How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. Always present.
`anomalyThreshold`	integer	The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. Always present.
`failMode`	`FailMode`	What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Always present. One of `Open`, `Closed`.
`exclusions`	list of `RuleExclusion`	The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Always present.
`tenantId`	string	The tenant (hosting customer) that owns the site. Empty when the site belongs to no tenant. Set it with PUT /api/sites/{name}/owner; saving the site's settings does not change it. Can be null.
`runtime`	`SiteRuntime`	The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Always present. One of `Unknown`, `DotNet`, `Php`, `ClassicAsp`, `Static`.
`cmsProfile`	`CmsProfile`	A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Always present. One of `None`, `WordPress`, `Forum`.
`loginPath`	string	The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Always present.
`loginSuccessStatuses`	string	Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Always present.
`loginFailureBodyPattern`	string	Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Always present.
`cmsRateOverrides`	string	Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Always present.
`globalExclusionOptOuts`	list of string	The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Can be null.
`loginProtectionOff`	boolean	True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. Always present.

SitePolicyRevision

A saved copy of a site's settings, kept each time the settings are saved so you can roll back to it.

Field	Type	Description
`version`	integer	The revision number. It counts up for each site and is the number you give to roll back. Always present.
`siteName`	string	The site the revision belongs to. Always present.
`at`	date-time	When the revision was saved. Always present.
`actor`	string	Who saved it: the signed-in user or API key name. Always present.
`policy`	`SitePolicy`	The site's settings exactly as they were in this revision. Always present.

SitePolicySaved

The reply to saving a site's settings: the settings as stored, the new revision number, and how to tell when the change is in force.

Field	Type	Description
`policy`	`SitePolicy`	The site's settings as stored. Always present.
`version`	integer	The revision number created by this save. Use it to roll back later. Always present.
`applying`	boolean	True when PortWall is applying the change in the background. The change is in force once the apply status reports it completed. Always present.
`applySeq`	integer	A number to wait for: the change is in force when completed from GET /api/config-apply/status reaches this number. Always present.
`pending`	string	A note when the change is saved but cannot be applied yet. Empty when there is nothing waiting. Can be null.

SitePolicyUpdate

The settings to save for one site. Send the whole object, as GET returns it, with your changes; the site name comes from the URL.

Field	Type	Description
`mode`	`EngineMode`	What the WAF does for this site: Off, DetectionOnly (record attacks, block nothing) or On (block). New sites start in DetectionOnly. Always present. One of `Off`, `DetectionOnly`, `On`.
`paranoiaLevel`	integer	How strict the OWASP Core Rule Set rules are, from 1 (default, fewest false positives) to 4 (strictest, more false positives). Raise it only after you have tuned exclusions. Always present.
`anomalyThreshold`	integer	The score a request must reach before it is blocked, from 1 to 1000 (default 5). A lower number blocks sooner; each rule that matches adds to the score. Always present.
`failMode`	`FailMode`	What happens to a request PortWall cannot fully inspect: Open lets it through; Closed refuses a body larger than the WAF inspection limit (413) and an upload the scanner could not check (403). Refuses only while mode is On. New sites have Open. Always present. One of `Open`, `Closed`.
`exclusions`	list of `RuleExclusion`	The rule exclusions that apply to this site only. Use them to stop a rule that blocks legitimate requests. Empty for none. Can be null.
`runtime`	`SiteRuntime`	The kind of server-side application the site runs. When set, uploads of executable files belonging to any other runtime are refused. Unknown applies no file-type rule. Always present. One of `Unknown`, `DotNet`, `Php`, `ClassicAsp`, `Static`.
`cmsProfile`	`CmsProfile`	A ready-made protection preset for the site's CMS or forum, which adds request-rate limits and attack blocks for it. None applies no preset. Always present. One of `None`, `WordPress`, `Forum`.
`loginPath`	string	The path of the site's login page, for example /wp-login.php. When set, only that page is watched for failed logins. Empty to let PortWall watch the pages that look like a login form. Always present.
`loginSuccessStatuses`	string	Comma-separated HTTP status codes that count as a successful login, for example 200 or 200,302, for an app or API that does not redirect after a login. A redirect always counts as a success. Needs a login path; empty for the default. Always present.
`loginFailureBodyPattern`	string	Text that appears only on the page a failed login returns, such as Invalid password. When set, the page text decides whether a login failed, not its status. Needs a login path; must not contain double quotes or backticks. Empty for the default. Always present.
`cmsRateOverrides`	string	Changes to the CMS preset's request-rate limits, as name=number pairs separated by commas, for example xmlrpc=15,login=30. Empty to use the preset's own limits. Always present.
`globalExclusionOptOuts`	list of string	The server-wide default exclusions this site does not use, each identified by its rule ID, route and parameter joined with a vertical bar. Empty for a site that uses all of them. Can be null.
`loginProtectionOff`	boolean	True to turn off login brute-force protection for this site. False (default) protects the site: its login path if one is set, otherwise the pages that look like a login form. Always present.

SiteRole

What a tenant's user or key may do on a site.

Value	Meaning
`Viewer`	May look at the site, its attacks and its settings, but not change anything.
`Manager`	May do everything a Viewer can, and also change the site's settings within the tenant policy.

SiteRuntime

The kind of server-side application a site runs, used to refuse uploads of files that site should never serve.

Value	Meaning
`Unknown`	No runtime is declared, so no file-type rule is applied to uploads.
`DotNet`	An ASP.NET site. Uploads of PHP, classic ASP and other runtimes' executable files are refused.
`Php`	A PHP site. Uploads of ASP.NET, classic ASP and other runtimes' executable files are refused.
`ClassicAsp`	A classic ASP site. Uploads of ASP.NET, PHP and other runtimes' executable files are refused.
`Static`	A static site that should serve no server-side code. Uploads of any executable file type are refused.

SwitchState

The state of a master switch after you changed it.

Field	Type	Description
`enabled`	boolean	Whether the switch is now on. Always present.

TenantErrors

Reply listing why the host's tenant policy refused a change.

Field	Type	Description
`errors`	list of string	One sentence for each reason the change was refused. Nothing was changed. Always present.

TenantExclusionPolicy

Whether tenants may add rule exclusions to their own sites.

Value	Meaning
`SelfApply`	Tenants add and remove their own rule exclusions, up to the limit.
`RequestApproval`	Tenants cannot change exclusions themselves; changes need the host's approval.
`Disabled`	Tenants cannot change exclusions at all; only the host can.

TenantPolicyOverride

Changes to the tenant policy for one tenant; any field left null follows the tenant policy for all tenants.

Field	Type	Description
`tenantId`	string	The tenant this override is for. The tenant ID in the URL is used if the two differ. Always present.
`allowedModes`	list of `EngineMode`	The WAF modes this tenant may switch its sites to. Null follows the tenant policy; if set, it must list at least one mode.
`defaultMode`	`EngineMode`	The mode a new site of this tenant starts in. Null follows the tenant policy. One of `Off`, `DetectionOnly`, `On`.
`allowParanoiaEdit`	boolean	Whether this tenant may change the paranoia level of its sites. Null follows the tenant policy.
`paranoiaMin`	integer	Lowest paranoia level this tenant may choose, from 1 to 4. Null follows the tenant policy.
`paranoiaMax`	integer	Highest paranoia level this tenant may choose, from 1 to 4 and not below the lowest. Null follows the tenant policy.
`allowThresholdEdit`	boolean	Whether this tenant may change the blocking sensitivity of its sites. Null follows the tenant policy.
`thresholdMin`	integer	Lowest blocking threshold this tenant may set, at least 1. A lower value blocks sooner. Null follows the tenant policy.
`thresholdMax`	integer	Highest blocking threshold this tenant may set, not below the lowest. A higher value blocks later. Null follows the tenant policy.
`exclusionPolicy`	`TenantExclusionPolicy`	How this tenant may handle rule exclusions. Null follows the tenant policy. One of `SelfApply`, `RequestApproval`, `Disabled`.
`maxTenantExclusions`	integer	Most rule exclusions this tenant may have on one site. Null follows the tenant policy.
`allowTenantScan`	boolean	Whether this tenant may start a malware scan of its own sites. Null follows the tenant policy.
`tenantScanMinIntervalMinutes`	integer	Least time, in minutes, between two scans of the same site of this tenant. 0 means no wait. Null follows the tenant policy.
`maxScanFileSizeBytes`	integer	Largest file, in bytes, that this tenant's scans will check; bigger files are skipped. Null follows the tenant policy.
`quarantineAction`	`TenantQuarantineAction`	What this tenant may do with a quarantined file. Null follows the tenant policy. One of `RequestApproval`, `ViewOnly`, `RestoreDelete`.
`allowCmsProtection`	boolean	Whether this tenant may choose a CMS protection profile and change login protection and rate-limit settings. Null follows the tenant policy.
`rateLimitEventsFloor`	integer	Lowest requests-per-minute value this tenant may set for a CMS protection rate limit. Null follows the tenant policy.
`allowRuntimeEdit`	boolean	Whether this tenant may declare the runtime of its sites. Null follows the tenant policy.
`allowManagedCert`	boolean	Whether this tenant may turn on a PortWall-managed HTTPS certificate for its own sites. Null follows the tenant policy.
`maxManagedCerts`	integer	Most managed certificates this tenant may have. 0 means no limit. Null follows the tenant policy.

TenantQuarantineAction

What tenants may do with their own quarantined files.

Value	Meaning
`RequestApproval`	Tenants see their quarantined files and may ask to restore or delete one; the host decides.
`ViewOnly`	Tenants may only look at quarantined files; the host does all restoring and deleting.
`RestoreDelete`	Tenants may restore or permanently delete their own quarantined files with no approval.

TenantSelfServicePolicy

The host's rules for what a tenant may change on its own sites, as set for all tenants unless a tenant has its own override.

Field	Type	Description
`allowedModes`	list of `EngineMode`	The WAF modes a tenant may switch its sites to. A tenant asking for a mode not listed is refused. Always present.
`defaultMode`	`EngineMode`	The mode a new tenant site starts in. Default: On (blocking). Always present. One of `Off`, `DetectionOnly`, `On`.
`allowParanoiaEdit`	boolean	Whether tenants may change the paranoia level of their sites. If false, only the host can. Default: true. Always present.
`paranoiaMin`	integer	Lowest paranoia level a tenant may choose, from 1 to 4. Default: 1. Always present.
`paranoiaMax`	integer	Highest paranoia level a tenant may choose, from 1 to 4 and not below the lowest. Default: 2. Always present.
`allowThresholdEdit`	boolean	Whether tenants may change the blocking sensitivity (the anomaly threshold) of their sites. If false, only the host can. Default: true. Always present.
`thresholdMin`	integer	Lowest blocking threshold a tenant may set, at least 1. A lower value blocks sooner. Default: 3. Always present.
`thresholdMax`	integer	Highest blocking threshold a tenant may set, not below the lowest. A higher value blocks later. Default: 7. Always present.
`exclusionPolicy`	`TenantExclusionPolicy`	Whether tenants may add rule exclusions (to stop a rule blocking legitimate traffic) themselves, must ask the host, or may not at all. Default: SelfApply. Always present. One of `SelfApply`, `RequestApproval`, `Disabled`.
`maxTenantExclusions`	integer	Most rule exclusions a tenant may have on one site when exclusions are self-applied. Default: 25. Always present.
`allowTenantScan`	boolean	Whether tenants may start a malware scan of their own sites. Default: true. Always present.
`tenantScanMinIntervalMinutes`	integer	Least time, in minutes, between two scans of the same site; a scan started sooner is refused. 0 means no wait. Default: 360 (6 hours). Always present.
`maxScanFileSizeBytes`	integer	Largest file, in bytes, that a tenant's scan will check; bigger files are skipped. Default: 33554432 (32 MiB). Always present.
`quarantineAction`	`TenantQuarantineAction`	What a tenant may do with a file that a scan quarantined. Default: RequestApproval. Always present. One of `RequestApproval`, `ViewOnly`, `RestoreDelete`.
`allowCmsProtection`	boolean	Whether tenants may choose a CMS protection profile for their sites and change their login protection and rate-limit settings. Default: true. Always present.
`rateLimitEventsFloor`	integer	Lowest requests-per-minute value a tenant may set for a CMS protection rate limit, so a tenant cannot lock out its own visitors. Default: 1. Always present.
`allowRuntimeEdit`	boolean	Whether tenants may say which runtime their site uses (PHP, .NET, classic ASP or static), which decides the file types uploads may carry. Default: true. Always present.
`allowManagedCert`	boolean	Whether tenants may turn on a PortWall-managed HTTPS certificate for their own sites that are not run through a hosting panel. Default: false. Always present.
`maxManagedCerts`	integer	Most managed certificates one tenant may have. 0 means no limit. Default: 0. Always present.

UserSiteGrant

Permission given to one panel user to see or manage one site.

Field	Type	Description
`userId`	string	The panel user who has access. Always present.
`siteName`	string	The site the user has access to. Always present.
`role`	`SiteRole`	What the user may do with the site: look only, or also change its settings within the tenant policy. Always present. One of `Viewer`, `Manager`.

VirtualPatch

A targeted rule you wrote for one site that refuses requests exploiting a specific flaw, until the flaw is fixed at its source.

Field	Type	Description
`ruleId`	integer	The rule number PortWall gave the patch. Use it to switch the patch between detecting and blocking, or to delete it. Always present.
`siteName`	string	The site the patch belongs to. Always present.
`description`	string	What the patch protects against, for example the CVE or flaw it shields. Always present.
`targets`	string	Where the rule looks, as WAF variable names separated by a vertical bar, for example ARGS or REQUEST_HEADERS:User-Agent\|REQUEST_URI. Always present.
`operator`	string	How the pattern is compared with the target. It starts with @, for example @rx (regular expression), @contains or @streq (equals). Always present.
`pattern`	string	The text or regular expression the operator looks for in the targets. Always present.
`phase`	integer	When in the request the rule runs, from 1 to 5. Use 2 (after the request body is read) for most patches, or 1 to check the request headers first. Always present.
`stage`	`PatchStage`	DetectionOnly records matches and blocks nothing, even when the site is On; Blocking refuses matching requests with a 403. Always present. One of `DetectionOnly`, `Blocking`.
`expiresAt`	date-time	When the patch stops applying. Null for a patch that never expires.
`createdBy`	string	Who added the patch: the signed-in user or API key name. Always present.
`createdAt`	date-time	When the patch was added. Always present.

VirtualPatchRequest

The details of a new virtual patch to add to a site; PortWall assigns the rule number.

Field	Type	Description
`description`	string	What the patch protects against. Required; must not contain quotes, backticks or line breaks. Always present.
`targets`	string	Where the rule looks, as WAF variable names separated by a vertical bar, for example ARGS or REQUEST_HEADERS:User-Agent\|REQUEST_URI. Required; no double quotes, backticks or line breaks. Always present.
`operator`	string	How the pattern is compared with the target. Must start with @, for example @rx, @contains or @streq. Required. Always present.
`pattern`	string	The text or regular expression the operator looks for. Required; no double quotes, backticks or line breaks. Always present.
`phase`	integer	When in the request the rule runs, from 1 to 5. Use 2 (after the request body is read) for most patches. Always present.
`stage`	`PatchStage`	Start with DetectionOnly to see what the patch matches in the attack feed, then switch it to Blocking. Always present. One of `DetectionOnly`, `Blocking`.
`expiresInMinutes`	integer	Minutes from now after which the patch stops applying. Leave out, or send 0 or less, for a patch that never expires. Can be null.

Updated 2026-10-27Something unclear or missing? Tell us.