Enforce an attack's rule

POST

/domains/{domain}/attacks/{attackId}/enforce

curl --request POST \
  --url https://api.nsin.ir/domains/example.com/attacks/1/enforce \
  --header 'Authorization: Bearer <token>'

• Production

Switches the attack’s rule from dry run to enforce (and on), and marks the attack mitigating. At most 3 attack rules are on per domain; the oldest is switched off to make room. Requires rules.edit.

Authorizations

• bearerAuth
• apiKeyAuth

Parameters

Path Parameters

domain

required

string

The domain name (for example example.com) — not a numeric id.

Example

example.com

attackId

required

integer

Responses

200

The attack.

Media type application/json

object

id

integer

domain_id

integer

domain_name

string

status

string

Allowed values: detected mitigating ended ignored

kind

volume: a flood, far more requests than usual. behaviour: the traffic suddenly behaves differently (for example no CSS/JS/image requests, no cookies, one HTTP version only), even at normal volume. A behaviour attack ends after 30 minutes without the change.

string

Allowed values: volume behaviour

drift

What changed (behaviour attacks; empty for floods), strongest first, at most 8.

Array<object>

object

feature

string

Allowed values: asset html api no_referer no_cookie many_cookie s2 s3 s4 s404 s5 post other_method h1 h2 h3 bot_low bot_high req_per_path req_per_ip

group

string

Allowed values: assets cookies status protocol bot paths ips

unit

share: 0–1 of requests. ratio: requests per path or per IP.

string

Allowed values: share ratio

normal

The usual value at this hour of day.

number

now

The value during the attack.

number

z

How unusual the change is (larger = stronger).

number

started_at

string format: date-time

ended_at

string format: date-time

nullable

calm_since

string format: date-time

nullable

peak_rpm

Highest requests per minute seen.

integer

baseline_rpm

Usual requests per minute for this hour of day.

number

signature

object

features

Array<object>

object

field

string

Allowed values: ja4h ja4 user_agent cookie header_set_hash path method asn country

key

The cookie name for cookie; else empty.

string

value

string

coverage

Share of the attack’s requests with this value (0–1).

number

baseline_share

Share of normal requests with this value (0–1).

number

expression

The rule’s conditions as text; empty without a rule.

string

attack_requests

integer

baseline_requests

integer

baseline_window

reference_day: the same time on the most normal recent day (behaviour attacks).

string

Allowed values: hour_before day_before reference_day none

coverage

Share of the attack the rule matches.

number

fp_estimate

Share of normal requests the rule would have hit; -1 = unknown.

number

rule_id

integer

nullable

rule

object

id

integer

name

string

enabled

boolean

action_mode

string

Allowed values: enforce dry_run

enforced_by

"", “user:” or “admin:”.

string

note

string

created_at

string format: date-time

updated_at

string format: date-time

Example

{
  "status": "detected",
  "kind": "volume",
  "drift": [
    {
      "feature": "asset",
      "group": "assets",
      "unit": "share"
    }
  ],
  "signature": {
    "features": [
      {
        "field": "ja4h"
      }
    ],
    "baseline_window": "hour_before"
  },
  "rule": {
    "action_mode": "enforce"
  }
}

401

Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example invalidKey

{
  "error": "invalid API key"
}

403

The key is read-only, your role on the domain lacks the required permission, or the domain’s plan does not include the feature.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

404

No such attack on this domain.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

409

The attack has no rule, or it has ended.

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Example

{
  "error": "read-only API key"
}

429

The key exceeded its request budget (300 requests per minute by default).

Media type application/json

The single error shape used by every endpoint.

object

error

required

Human-readable description of what went wrong.

string

Examples

Example limited

{
  "error": "rate limit exceeded"
}