nsindocs Search the docs⌘K
API
  1. Docs
  2. API reference
  3. Rules

Restore default protection

posthttps://api.nsin.ir/domains/{domain}/rules/waf/shield/restore

Auth: Authorization: Bearer nsin_… or X-Api-Key: nsin_… — see API keys.

Re-creates the default NSIN Shield rule after it was deleted, and clears the "dismissed" mark so the platform keeps it provisioned. Takes no body. Requires rules.edit and a plan that includes default protection.

Path parameters

  • domainstringrequiredpath

    The domain name (for example example.com) — not a numeric id.

Responses

200Shield status after the restore.

Content type: application/json

  • platform_enabledboolean

    Default protection is switched on across NSIN. When false the feature is paused for everyone: the managed rule is still listed and keeps its settings, but nothing enforces it and active is false. It starts applying again on its own — nothing to do.

  • plan_allowsboolean

    The domain's current plan includes default protection.

  • presentboolean

    A managed shield rule exists for this domain (it may be disabled).

  • rule_idinteger

    The shield rule's id, when it exists.

  • enabledboolean

    Whether the shield rule is switched on.

  • action_modestring

    The shield rule's action mode.

    One of: "enforce" "dry_run"
  • dismissedboolean

    The rule was deleted by the owner and will not be re-created unless restored.

  • dismissed_atstring (date-time)

    When the default rule was deleted. Absent unless dismissed.

  • activeboolean

    Present, enabled, shipped to the edge — and both plan_allows and platform_enabled are true. This is the only field that answers "is this rule actually protecting the domain right now?".

  • default_action_modestring

    The mode a restored rule is created with.

    One of: "enforce" "dry_run"
json
{
  "platform_enabled": true,
  "plan_allows": true,
  "present": true,
  "rule_id": 0,
  "enabled": true,
  "action_mode": "enforce",
  "dismissed": true,
  "dismissed_at": "2026-01-01T00:00:00Z",
  "active": true,
  "default_action_mode": "enforce"
}
401Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "invalid API key"
}
403The key is read-only, or the domain's plan does not include default protection.

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "read-only API key"
}
404No such domain, or your role on it does not permit this operation. The rules endpoints deliberately answer 404 rather than 403 for an insufficient role, so they never confirm that a domain exists to someone who cannot use it.

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "not found"
}
409Default protection is paused across NSIN (platform_enabled is false on the status). Nothing to do — try again once it resumes.

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "read-only API key"
}
429The key exceeded its request budget (300 requests per minute by default).

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "rate limit exceeded"
}

Example request

bash
curl -X POST "https://api.nsin.ir/domains/example.com/rules/waf/shield/restore" \
  -H "Authorization: Bearer $NSIN_API_KEY"
esc