Network protection API
Manage protected service configuration and inspect attacks and actual traffic coverage.
Protected-service creation does not route production traffic. Complete ownership verification and traffic cutover before relying on protection.
Use the shared API contract for authentication, pagination, request headers, idempotency, and error responses.
List services
/organizations/{organization_id}/protected-servicesLists route readiness and origin health. Self-hosted DDoS services also include Connector status. Standard limit and cursor apply. Unknown filters return 422.
asset_idstringoptionalFilter by service asset.
statestringoptionalConfiguration state.
Returns a data array and pagination.next_cursor. Entries include stable IDs and the resource fields described for this collection.
Create an HTTP service
/organizations/{organization_id}/protected-servicesCreates a pending-verification HTTP service. Routed L3/L4 service admission uses the approved network onboarding workflow.
namestringrequiredDisplay name; does not change resource identity.
asset_idstringrequiredExisting service asset.
hostnamestringrequiredPublic DNS hostname; no wildcard unless separately approved.
originobjectrequiredOrigin connection and health-check settings. Origin TLS verification cannot be disabled.
edge_policy_idstringrequiredPublished edge policy authorized for this service.
Returns service ID, verification challenge, pending checks, and ETag. Domain verification is not complete merely because a challenge was issued.
Read a service
/organizations/{organization_id}/protected-services/{service_id}Returns frontend TLS, verification state, admitted edge route, origin health, assigned/applied policy revisions, and recent coverage timestamps.
Returns data and request_id.
Verify ownership
/organizations/{organization_id}/protected-services/{service_id}/verifyChecks the issued DNS or file challenge. Only control of the requested hostname is established.
Returns a verification operation. Failed challenge checks leave the service pending and do not change production routing.
Update an origin
/organizations/{organization_id}/protected-services/{service_id}Replaces the service origin after validation. Requires If-Match; the previous origin remains until replacement validation succeeds.
originobjectrequiredComplete replacement origin using the address, port, TLS server name, and health path fields from Create an HTTP service. Omitted nested fields are invalid.
Returns service data and an update operation. Origin validation failure preserves the prior origin.
List attacks
/organizations/{organization_id}/attacksReturns detection and mitigation times, affected services, active controls, observed rates with units, and reporting gaps. Standard limit and cursor apply. Unknown filters return 422.
service_idstringoptionalFilter by protected service.
activebooleanoptionalWhether to return active attacks. true selects observed active attacks; false selects ended attacks. Omission includes both.
Returns a data array and pagination.next_cursor. Entries include stable IDs and the resource fields described for this collection.
Read attack detail
/organizations/{organization_id}/attacks/{attack_id}Returns mitigation timeline, trigger basis, policy revisions, origin health, and capacity status. A drop counter is not application recovery evidence.
Returns data and request_id.
Retire a service
/organizations/{organization_id}/protected-services/{service_id}/retireRetires a protected service. Requires If-Match, completed route migration, and confirmed retirement review. Active routing dependencies return 409 route_in_use.
reasonstringrequiredAudited justification. Empty values are invalid.
Returns a retirement operation. Verify provider routing and drained traffic before deleting origin restrictions or Connector configuration.