Web Application Firewall (WAF) Demo: API Settings

Domain:	example.com
API Key (for plugin):	key Refresh
API Key (API_KEY):	key
API Secret (API_SECRET):	Secret

Quick Links
You can copy the link of the buttons displayed here and create a bookmark in your browser to execute these actions whenever you want, without the need to access this dashboard.

Clear Cache (WAF API v1)

Whitelist IP (WAF API v1)

Audit Trails (WAF API v1)

Add IP to Dev. Mode (WAF API v1)

API v2 - Response Format

With the introduction of the second version for the Website Firewall API the structure of the responses was unified and now all of them are JSON-encoded. Every request you send will be responded with the same attributes and the values will only be changed when your request is executed successfully.

{
  'status': boolean,
  'messages': []string,
  'action': string,
  'request_time': timestamp,
  'verbose': boolean,
  'output': []object
}

Attribute	Type	Description
`status`	`boolean`	Either a one or a zero. This property indicates the success or fail of the operation, you will find an explanation of this accessing the messages property and looping through all the messages added there (if not empty).
`messages`	`[]string`	A list of messages collected through the execution of the action specified in the request.
`action`	`string`	The official name of the action executed, the old action names from the first API version will be available in this one but is recommended to change them and start using the values returned in this attribute.
`request_time`	`timestamp`	The Unix Time of the moment when the request reached our servers.
`verbose`	`boolean`	Either a one or a zero. This property indicates the state of the verbosing for the responses, you can modify it adding verbose a verbose parameter in the request to force the return of the output object instead of all the response properties.
`output`	`[]object`	If the request was processed by the API successfully then this attribute will be filled with data resulting from the operation executed internally by our services. If status is reporting an error then this attribute will be returned as empty.
`property`	`string`	This is not a property of the response but a parameter that you can use to filter the result of the operation and the data returned after you send the request. If set, this parameter will cause the response to be simplified automatically without the use of the parameter verbose. If the string passed as the value is found as an attribute of the output object then it will be shown in the response, if not found a null will be returned instead.

API v2 - Show Settings

This action allows you to retrieve from our service your current account settings for the domain associated with the API Key passed in the request. Note that not all the settings of your account will be returned only the ones that we consider as public data.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=show_settings'

Option	Type	Description
`domain`	`string`	The domain of the site.
`internal_ip_main`	`string`	The internal IP address of the site.
`proxy_active`	`integer`	One if the service is active, zero otherwise.
`whitelist_list`	`[]string`	A list with all the IP addresses whitelisted so far.
`blacklist_list`	`[]string`	A list with all the IP addresses blacklisted so far.
`security_level`	`string`	The security level chosen for your site.
`cache_mode`	`string`	The caching level chosen for your site.
`admin_access`	`string`	Admin panel access for your site (open, restricted).
`comment_access`	`string`	Comments access for your site (open, restricted).
`internal_domain_ip`	`string`	Firewall IP.
`internal_domain_debug_list`	`[]string`	Debug URL.
`compression_mode`	`string`	Compression.
`brotli`	`string`	Brotli.
`force_https`	`string`	Protocol Redirection.
`spdy_mode`	`string`	HTTP/2 Support.
`max_upload_size`	`string`	Maximum Upload Size.
`force_sec_headers`	`string`	Add Additional Security Headers.
`unfiltered_html`	`string`	Stop unfiltered HTML from being sent to your site.
`block_php_upload`	`string`	Stop upload of PHP or executable content.
`behind_cdn`	`string`	Site is behind CDN.
`http_flood_protection`	`string`	Flood protection.
`detect_adv_evasion`	`string`	Advanced evasion detection.
`aggressive_bot_filter`	`string`	Aggressive bot filter.

API v2 - Advanced Settings

This endpoint can be used to modify the value of all the settings available in the dashboard. Notice that some data might be restricted in which case you will have to contact our support team for assistance. In the example request the parameter SETTING is one of the names listed in the table below, you can modify multiple settings with the same request adding more parameters with the names that you want to modify.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=update_setting' \
--data 'SETTING=VALUE'

Setting	Description	Values
`new_internal_ip`	Adds a new item to the list of hosting addresses. You must also send the type (if alternate or backup) using a parameter named "new_internal_ip_type" and an additional flag to tell the API to process the HTTP request named "manage_internal_ip". You can add a note to the address using the parameter "hosting_ip_notes". Additional to the notes, you can also add a tag, which is a unique identifier for the region where the address is going to be used, you can do this via another parameter named "new_internal_ip_tag".	`IPv4, IPv6, TLD`
`delete_internal_ip`	Deletes an item from the list of hosting addresses.	`true`
`pause_internal_ip`	Pauses an item from the list of hosting addresses.	`true`
`play_internal_ip`	Un-pauses an item from the list of hosting addresses.	`true`
`securitylevel`	Modifies the security level.	`high, paranoid`
`adminaccess`	Modifies the administration access mode.	`open, restricted`
`force_sec_headers`	Enables or disables the HTTP security headers.	`enabled, disabled`
`commentaccess`	Enables or disables the ability to leave comments.	`open, restricted`
`unfiltered_html`	Enables or disables the ability HTML filters.	`allow_unfilter, block_unfilter`
`block_php_upload`	Enables or disables the ability to upload files.	`allow_uploads, block_uploads`
`detect_adv_evasion`	Enables or disables the detection of advanced evasion.	`enabled, disabled`
`ids_monitoring`	Enables or disables the intrusion detection system.	`enabled, disabled`
`aggressive_bot_filter`	Enables or disables aggressive filters against robots.	`enabled, disabled`
`http_flood_protection`	Enables or disables the HTTP flood protection.	`js_filter, disabled`
`docache`	Modifies the cache mode for the website.	`docache, nocache, sitecache, nocacheatall`
`compression_mode`	Enables or disables the data compression.	`enabled, disabled`
`brotli`	Enables or disables brotli support.	`enabled, disabled`
`failover_time`	Configures the time in seconds for a fail-over.	`5, 10, 30, 60`
`forwardquerystrings_mode`	Enables or disables the HTTP query strings forwarding.	`enabled, disabled`
`force_https`	Configures the HTTP protocol redirection.	`http, https, null`
`spdy_mode`	Enables or disables the HTTP2 support.	`enabled, disabled`
`max_upload_size`	Configures the maximum size for uploaded files in megabytes.	`5m, 10m, 50m, 100m, 200m, 400m`
`behind_cdn`	Configures the CDN being used by the website.	`none, behind_akamai, behind_cloudflare, behind_maxcdn, behind_cdn`
`block_attacker_country`	Denies access to the top attacker countries via GeoIP.	`enabled, disabled`
`domain_alias`	Adds a new item to the list of domain aliases.	`TLD`
`remove_domain_alias[]`	Deletes an item from the list of domain aliases.	`[]TLD`
`whitelist_dir`	Adds a new item to the list of whitelisted URLs. You must also send the pattern that will be used to match the URL, the parameter is named "whitelist_dir_pattern" and accepts these values: matches, begins_with, ends_with, equals. The API only accepts one URL and one pattern per request.	`URL`
`remove_whitelist_dir[]`	Deletes an item from the list of whitelisted URLs.	`[]URL`
`blacklist_dir`	Adds a new item to the list of blacklisted URLs. You must also send the pattern that will be used to match the URL, the parameter is named "blacklist_dir_pattern" and accepts these values: matches, begins_with, ends_with, equals. The API only accepts one URL and one pattern per request.	`URL`
`remove_blacklist_dir[]`	Deletes an item from the list of blacklisted URLs.	`[]URL`
`noncache_dir`	Adds a new item to the list of non-cacheable URLs. You must also send the pattern that will be used to match the URL, the parameter is named "noncache_dir_pattern" and accepts these values: matches, begins_with, ends_with, equals. The API only accepts one URL and one pattern per request.	`URL`
`remove_noncache_dir[]`	Deletes an item from the list of non-cacheable URLs.	`[]URL`
`block_from_viewing[]`	Configures the countries that will be blocked from sending a GET request to the website. Notice that this option overrides the value of the setting, this means that you can not add individual countries to the list but the complete list of countries that will be blocked. You must send another parameter named "update_geo_blocking" with any value in order to force the API to process the request.	`US, CA, BR, etc`
`block_from_posting[]`	Configures the countries that will be blocked from sending a POST request to the website. Notice that this option overrides the value of the setting, this means that you can not add individual countries to the list but the complete list of countries that will be blocked. You must send another parameter named "update_geo_blocking" with any value in order to force the API to process the request.	`US, CA, BR, etc`
`block_useragent`	Adds a new item to the list of blocked user-agents.	`string`
`remove_block_useragent[]`	Deletes an item from the list of blocked user-agents.	`[]string`
`block_referer`	Adds a new item to the list of blocked HTTP referers.	`string`
`remove_block_referer[]`	Deletes an item from the list of blocked HTTP referers.	`[]string`
`block_cookie`	Adds a new item to the list of blocked browser cookies.	`string`
`remove_block_cookie[]`	Deletes an item from the list of blocked browser cookies.	`[]string`
`ahttp_method`	Adds a new item to the list of allowed HTTP methods.
`remove_ahttp_method[]`	Deletes an item from the list of allowed HTTP methods.	`[]string`
`twofactorauth_path`	Adds a new item to the list of protected pages via 2Factor-Auth. You must also specify which protection will be applied to the page, the parameter is named "twofactorauth_type" and accepts these values: password, googleauth, captcha, ip. If you choose to protect the URL with "IP" the firewall will expect that the address is among the whitelisted IP addresses. The API only accepts one URL and one pattern per request.	`URL`
`item_twofactorauth_path`	Deletes an item from the list of protected pages. If you also include the parameter "twofactorauth_update_pwd" in the request, the API will not delete the URLs from the list, but instead will re-generate the keys. This applies to the URLs protected by a password or by Google Auth.	`[]URL`
`origin_protocol_port`	Configures the port number for the connection.	`80, 443`

API v2 - Whitelist IP

Whitelists your current IP address (or another defined IP address) so it won't be blocked by some of our security rules. It will also have access your admin panels if you have it restricted to only trusted IP Addresses on the security settings. By default this endpoint will whitelist the IP address associated to the HTTP request of the client. If you want to specify a custom IP, you have to pass the parameter ip with a valid IPv4/IPv6 address. If an IP address isn't set your current IP is used.
```
curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=whitelist_ip' \
--data 'ip=IP_ADDRESS'
```
Note. The line --data 'ip=IP_ADDRESS' is optional, when it is not set, your current IP Address will be used.

API v2 - Remove Whitelist IP

Deletes your current IP (or another defined IP address) from the whitelist. By default this endpoint will delete the IP address associated to the HTTP request of the client. If you want to specify a custom IP, you have to pass the parameter ip with a valid IPv4/IPv6 address. If an IP address isn't set your current IP is used.
```
curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=delete_whitelist_ip' \
--data 'ip=IP_ADDRESS'
```
Note. The line --data 'ip=IP_ADDRESS' is optional, when it is not set, your current IP Address will be used.

API v2 - Blacklist IP

Blacklists an IP address, so it can't reach your website.
```
curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=blacklist_ip' \
--data 'ip=IP_ADDRESS'
```
Note. The line --data 'ip=IP_ADDRESS' is optional, when it is not set, your current IP Address will be used.

API v2 - Remove Blacklist IP

Deletes the defined IP address from the blacklist. The IP address has to be a valid IPv4/IPv6 address.
```
curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=delete_blacklist_ip' \
--data 'ip=IP_ADDRESS'
```

API v2 - Add Site

Adds one or more sites to your account.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 'under_ddos_attack=(0 or 1)' \
--data 'restrict_admin_access=(0 or 1)' \
--data 'use_sucuri_dns=(0 or 1)' \
--data 'a=add_site' \
--data 'domains=domain1.tld,domain2.tld,domainn.tld'

API v2 - Delete Site

Removes one site from your account.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 'a=delete_site' \
--data 'domain=domain.tld'

Note: The line --data 'ip=IP_ADDRESS' is optional, when it is not set, your current IP Address will be used.

API v2 - Clear Cache

This option can be used to clear the Website Firewall cache after any website changes have been made.
This will reflect live as soon as you click the clear cache button.

curl 'https://waf.sucuri.net/api?v2' \ --data 'k=API_KEY' \ --data 's=API_SECRET' \ --data 'a=clear_cache'

API v2 - Clear Cache per File

This option can be used to remove a file from the Website Firewall cache.
This will reflect live as soon as you click the clear cache button.

curl 'https://waf.sucuri.net/api?v2' \ --data 'k=API_KEY' \ --data 's=API_SECRET' \ --data 'a=clear_cache' \ --data 'file=FILE_PATH'
API v2 - Audit Trails

This action allows you to retrieve the latest audit log entries caught by our service. You will get a dump of all the blocked events for the date specified (or for the current day if you don't specify this parameter) allowing you to integrate our data in your own dashboard.

Note. The parameters date, query, offset and limit are optionals and currently they are not fully implemented so if you have an issue with one of them please report it to our development team.

curl 'https://waf.sucuri.net/api?v2' \ --data 'k=API_KEY' \ --data 's=API_SECRET' \ --data 'a=audit_trails' \ --data 'date=yyyy-mm-dd' \ --data 'query=Lorem+ipsum+dolor' \ --data 'format=(txt or json or csv)' \ --data 'offset=0' \ --data 'limit=50'

API v2 - Retrieve Protected Pages

This action allows you to retrieve the list of protected URLs set in the Access Control / Protected Pages

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=protected_pages' 

Field	Description
`path`	The protected path without the domain
`password`	The password generated automatically when it applies
`state`	It can be 'unused' or the type of protection applied
`provisioning_uri`	Only when the state is googleauth
`qrcode_image`	Only when the state is googleauth

API v2 - Add Protected Pages

This action allows you to add one or more protected URLs.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=update_setting' \
--data 'protected_page=URL' 

To add more than one, use the following:

protected_page[]=URL&protected_page[]=URL

API v2 - Update Password for Protected Pages

This action allows you to update the password automatically for some protected URLs.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=update_setting' \
--data 'protected_page_item[]=URL \
--data 'protected_page_update_pwd=1' 

API v2 - Remove Protected Pages

This action allows you to remove one or more protected URLs.

curl 'https://waf.sucuri.net/api?v2' \
--data 'k=API_KEY' \
--data 's=API_SECRET' \
--data 'a=update_setting' \
--data 'protected_page_remove[]=URL' 

CURL Request Generator

curl 'https://waf.sucuri.net/api?v2' \ --data 'k=API_KEY' \ --data 's=API_SECRET' \ --data 'a=ACTION' \ --data 'SETTING=VALUE'

Setting	Accepted values
period	day, week, month (default)
format	pdf (default), csv, html
emails	All emails separated by comma (account email when empty)

Bulk API action generator

action

	Sites
	example.com

curl 'https://waf.sucuri.net/api?v2' \
    --data 'k=API_KEY' \
    --data 's=API_SECRET' \
    --data 'a=ACTION' \
    --data 'SETTING=VALUE'

Re-Generate API Key

Quick Links
You can copy the link of the buttons displayed here and create a bookmark in your browser to execute these actions whenever you want, without the need to access this dashboard.

API v2 - Response Format

API v2 - Show Settings

API v2 - Advanced Settings

API v2 - Whitelist IP

API v2 - Remove Whitelist IP

API v2 - Blacklist IP

API v2 - Remove Blacklist IP

API v2 - Add Site

API v2 - Delete Site

API v2 - Clear Cache

API v2 - Clear Cache per File

API v2 - Audit Trails

API v2 - Retrieve Protected Pages

API v2 - Add Protected Pages

API v2 - Update Password for Protected Pages

API v2 - Remove Protected Pages

API v2 - Reports Settings

CURL Request Generator

Bulk API action generator

Sign Up For Your Account

Re-Generate API Key

Quick Links You can copy the link of the buttons displayed here and create a bookmark in your browser to execute these actions whenever you want, without the need to access this dashboard.

API v2 - Response Format

API v2 - Show Settings

API v2 - Advanced Settings

API v2 - Whitelist IP

API v2 - Remove Whitelist IP

API v2 - Blacklist IP

API v2 - Remove Blacklist IP

API v2 - Add Site

API v2 - Delete Site

API v2 - Clear Cache

API v2 - Clear Cache per File

API v2 - Audit Trails

API v2 - Retrieve Protected Pages

API v2 - Add Protected Pages

API v2 - Update Password for Protected Pages

API v2 - Remove Protected Pages

API v2 - Reports Settings

CURL Request Generator

Bulk API action generator

Quick Links
You can copy the link of the buttons displayed here and create a bookmark in your browser to execute these actions whenever you want, without the need to access this dashboard.