Switch Under Attack Mode
const url = 'https://api.nsin.ir/domains/example.com/under-attack';const options = { method: 'PUT', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"enabled":true,"bypass_paths":["/api/*","/app/*"],"auto_off_minutes":360}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PUT \ --url https://api.nsin.ir/domains/example.com/under-attack \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "enabled": true, "bypass_paths": [ "/api/*", "/app/*" ], "auto_off_minutes": 360 }'While Under Attack Mode is on, every visitor solves a short check
before reaching the site — except on bypass_paths (mobile-app and
API paths that cannot run a browser) and verified good bots (search
engines). A solved check is remembered for the edge’s default
clearance time.
The switch keeps one managed captcha rule on the domain
(managed_by: under_attack, priority 1, zone-wide, path_excludes =
bypass_paths). Rule endpoints list it but refuse to edit, delete,
toggle or reorder it (403); it does not count against any rule limit.
Switching off removes it.
Every field is optional; a missing one keeps its value.
auto_off_minutes (0 = never, 60, 360 or 1440) restarts the auto-off
timer from now while the mode is on; switching on without it starts
with no timer. Switching on needs a plan with under_attack_allowed
(every plan by default); switching off is always allowed. The change
reaches the edge with the next records sync. Requires
domain.settings.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”The domain name (for example example.com) — not a numeric id.
Example
example.comRequest Body required
Section titled “Request Body required ”object
Wildcard path patterns, each starting with / (* matches any
characters; /api/* also matches /api). Replaces the list.
Switch off after this many minutes, counted from now; 0 = never.
Example
{ "enabled": true, "bypass_paths": [ "/api/*", "/app/*" ], "auto_off_minutes": 360}Responses
Section titled “ Responses ”The new state.
object
Paths never challenged. Kept while the mode is off, for next time.
When the mode was switched on. Null when off.
When the mode switches itself off. Null when off or with no timer.
The domain’s plan includes Under Attack Mode (under_attack_allowed).
Example generated
{ "enabled": true, "bypass_paths": [ "example" ], "since": "2026-04-15T12:00:00Z", "until": "2026-04-15T12:00:00Z", "allowed": true}An invalid auto_off_minutes or bypass path.
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Example
{ "error": "read-only API key"}Missing, malformed, revoked or expired API key. (A valid key whose
account has been deactivated gets 403 account is inactive instead.)
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "invalid API key"}The domain’s plan does not include Under Attack Mode, or the key lacks domain.settings.
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Example
{ "error": "read-only API key"}No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Example
{ "error": "read-only API key"}The key exceeded its request budget (300 requests per minute by default).
The single error shape used by every endpoint.
object
Human-readable description of what went wrong.
Examples
{ "error": "rate limit exceeded"}