Apply a one-click fix

POST

/recommendations/fix

curl --request POST \
  --url 'https://api.nsin.ir/recommendations/fix?domain=example.com' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "apply": "waf_enforce" }'

• Production

Runs the fix a recommendation offers in action.apply (or alt.apply). The server re-reads the problem first: if it is gone the answer is already_done, and if the item no longer offers this fix the answer is 409 with the fresh list. Otherwise it applies the change through the same code as the feature’s own endpoint, tells the edges, checks that the change took effect, and returns the domain’s new checklist.

Fixes: attack_enforce, attack_ignore, under_attack_on (6-hour timer), under_attack_off, auto_attack_rules_on/_off, auto_under_attack_on/_off, waf_restore, waf_enable, waf_enforce, waf_dry_run, login_rate_limit (a per-IP limit of 10 POSTs a minute on wp-login.php and xmlrpc.php, answered with a check), login_rate_limit_off (send the rule_id from the fix’s undo; a rule edited since is left alone). The _off and waf_dry_run fixes are undos and need no recommendation.

Needs the permission of the change itself: rules.edit for attack and WAF fixes, domain.settings for the switches.

Authorizations

• bearerAuth
• apiKeyAuth

Parameters

Query Parameters

domain

required

string

The domain name (for example example.com). These endpoints take the domain as a query parameter rather than a path segment.

Example

example.com

Request Body ^required

Media type application/json

object

apply

required

The fix name from the recommendation’s action.

string

rule_id

Only for login_rate_limit_off: the rule id from the fix’s undo.

integer

Example

{
  "apply": "waf_enforce"
}

Responses

200

Applied, or already done.

Media type application/json

object

result

string

Allowed values: applied already_done

message

string

undo

Present when the change can be undone in one call.

object

apply

string

label

string

rule_id

Send back with the undo (login_rate_limit_off).

integer

data

The domain’s checklist after the change.

Array<object>

object

Example

{
  "result": "applied"
}

400

Missing domain or apply, or an unknown fix.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

401

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example invalidKey

{
  "error": "invalid API key"
}

403

Missing permission, or the plan does not include it (upgrade_required).

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

404

No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

409

The item no longer offers this fix (the attack ended, someone else fixed it). data is the fresh list.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

500

The fix failed or did not take effect.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}