API reference
The web application firewall: the workspace's policy, protected sites with their own policy, events and statistics.
GET/v1/orgs/{org}/cdn/{zone}/firewall
API token or dashboard session
Read the firewall policy of a CDN zone: its own, or its workspace's until it has one.
orgstringpathrequired
Organisation slug
zonestringpathrequired
200PolicyDocument
404Problem
curl "https://api.infraflow.app/v1/orgs/acme/cdn/zone/firewall" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
{}PUT/v1/orgs/{org}/cdn/{zone}/firewall
API token or dashboard session
Set the firewall policy of a CDN zone. From then on it is guarded by this one, whatever its workspace's says.
orgstringpathrequired
Organisation slug
zonestringpathrequired
200PolicyDocument
422Problem
curl -X PUT "https://api.infraflow.app/v1/orgs/acme/cdn/zone/firewall" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'GET/v1/orgs/{org}/firewall
API token or dashboard session
Read the firewall policy. An organisation that never saved one gets the default: observe mode with every built-in detection on.
orgstringpathrequired
Organisation slug
200PolicyDocument
curl "https://api.infraflow.app/v1/orgs/acme/firewall" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
{}PUT/v1/orgs/{org}/firewall
API token or dashboard session
Replace the firewall policy. It reaches the edges within moments.
orgstringpathrequired
Organisation slug
200PolicyDocument
422Problem
The policy is invalid; detail says why
curl -X PUT "https://api.infraflow.app/v1/orgs/acme/firewall" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'GET/v1/orgs/{org}/firewall/events
API token or dashboard session
Requests the firewall matched, newest first.
orgstringpathrequired
Organisation slug
cursorstringquery
next_cursor of the previous page
limitintegerquery
Page size, 1 to 200. Defaults to 50
blockedbooleanquery
Only requests that were refused
hostnamestringquery
Only this hostname
GET/v1/orgs/{org}/firewall/stats
API token or dashboard session
What matched over the last 24 hours: when, which rules, from where.
orgstringpathrequired
Organisation slug
hostnamestringquery
Only this hostname.
200FirewallStats
clientsStatsCount[]required
matchesintegerrequired
GET/v1/orgs/{org}/services/{service}/firewall
API token or dashboard session
The firewall policy guarding a service's address: its own if it has one, else the defaults every address starts with.
orgstringpathrequired
Organisation slug
servicestringpathrequired
200PolicyDocument
404Problem
curl "https://api.infraflow.app/v1/orgs/acme/services/api/firewall" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
PUT/v1/orgs/{org}/services/{service}/firewall
API token or dashboard session
Set the firewall policy of a service.
orgstringpathrequired
Organisation slug
servicestringpathrequired
200PolicyDocument
422Problem
curl -X PUT "https://api.infraflow.app/v1/orgs/acme/services/api/firewall" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'GET/v1/orgs/{org}/sites
API token or dashboard session
Protected sites of an organisation.
orgstringpathrequired
Organisation slug
200Site[]
cname_targetstringrequired
The CNAME record to create at the domain's DNS provider.
created_atdate-timerequired
hostnamestringrequired
The site's address: your domain.
POST/v1/orgs/{org}/sites
API token or dashboard session
Put a domain of yours behind the firewall.
The site goes live once its DNS points at the platform and a certificate has been issued, which is retried automatically.
orgstringpathrequired
Organisation slug
cloudflare_api_tokenstring | null
A Cloudflare API token with DNS edit rights on the domain's zone: the CNAME record is then created for you. Used once, not stored.
hostnamestringrequired
Your domain, such as www.example.com.
name
PATCH/v1/orgs/{org}/sites/{site}
API token or dashboard session
Point a site at another origin. Takes effect at once.
orgstringpathrequired
Organisation slug
sitestringpathrequired
originstringrequired
200Site
404Problem
422Problem
DELETE/v1/orgs/{org}/sites/{site}
API token or dashboard session
Remove a site. Its domain stops being served here at once.
orgstringpathrequired
Organisation slug
sitestringpathrequired
204no body
404Problem
curl -X DELETE "https://api.infraflow.app/v1/orgs/acme/sites/shop" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
POST/v1/orgs/{org}/sites/{site}/check
API token or dashboard session
Check now whether a pending site's domain points here, instead of waiting for the next automatic attempt.
orgstringpathrequired
Organisation slug
sitestringpathrequired
200Site
404Problem
cname_targetstringrequired
The CNAME record to create at the domain's DNS provider.
GET/v1/orgs/{org}/sites/{site}/policy
API token or dashboard session
The policy guarding a site: its own if it has one, else the workspace's.
orgstringpathrequired
Organisation slug
sitestringpathrequired
200PolicyDocument
404Problem
curl "https://api.infraflow.app/v1/orgs/acme/sites/shop/policy" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
PUT/v1/orgs/{org}/sites/{site}/policy
API token or dashboard session
Give a site its own firewall policy.
orgstringpathrequired
Organisation slug
sitestringpathrequired
200PolicyDocument
422Problem
curl -X PUT "https://api.infraflow.app/v1/orgs/acme/sites/shop/policy" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'DELETE/v1/orgs/{org}/sites/{site}/policy
API token or dashboard session
Return a site to its workspace's policy.
orgstringpathrequired
Organisation slug
sitestringpathrequired
204no body
404Problem
curl -X DELETE "https://api.infraflow.app/v1/orgs/acme/sites/shop/policy" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
GET/v1/orgs/{org}/tunnels/{id}/firewall
API token or dashboard session
Read the firewall policy of an HTTP tunnel: its own, or its workspace's until it has one.
orgstringpathrequired
Organisation slug
iduuidpathrequired
200PolicyDocument
404Problem
curl "https://api.infraflow.app/v1/orgs/acme/tunnels/0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55/firewall" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
PUT/v1/orgs/{org}/tunnels/{id}/firewall
API token or dashboard session
Set the firewall policy of an HTTP tunnel. From then on it is guarded by this one, whatever its workspace's says.
orgstringpathrequired
Organisation slug
iduuidpathrequired
200PolicyDocument
422Problem
curl -X PUT "https://api.infraflow.app/v1/orgs/acme/tunnels/0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55/firewall" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{}'{}{}200FirewallEventPage
eventsFirewallEvent[]required
atdate-timerequired
blockedbooleanrequired
Whether the request was refused. False in observe mode.
client_ipstring | null
countrystring | null
Two-letter code of the country it came from, if known.
fingerprintstring | null
A digest of how the client writes its requests. The same tool has the same one whatever address it comes from; it can be blocked.
hostnamestringrequired
iduuidrequired
locationstringrequired
Where in the request it matched.
methodstringrequired
pathstringrequired
rulestringrequired
Which rule matched, such as sqli.semantic or custom.block-admin.
next_cursorstring | null
curl "https://api.infraflow.app/v1/orgs/acme/firewall/events" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
{
"events": [
{
"at": "2026-01-15T09:30:00Z",
"blocked": true,
"client_ip": "string",
"country": "string",
"fingerprint": "string",
"hostname": "www.example.com",
"id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
"location": "string",
"method": "string",
"path": "string",
"rule": "string"
}
],
"next_cursor": "string"
}valuestringrequired
countriesStatsCount[]required
matchesintegerrequired
valuestringrequired
fingerprintsStatsCount[]required
matchesintegerrequired
valuestringrequired
hostnamesStatsCount[]required
matchesintegerrequired
valuestringrequired
hoursStatsHour[]required
Hour by hour; hours without matches are left out.
blockedintegerrequired
hourdate-timerequired
observedintegerrequired
pathsStatsCount[]required
matchesintegerrequired
valuestringrequired
rulesStatsCount[]required
The most matched, most first, for each of these.
matchesintegerrequired
valuestringrequired
curl "https://api.infraflow.app/v1/orgs/acme/firewall/stats" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
{
"clients": [
{
"matches": 0,
"value": "string"
}
],
"countries": [
{
"matches": 0,
"value": "string"
}
],
"fingerprints": [
{
"matches": 0,
"value": "string"
}
],
"hostnames": [
{
"matches": 0,
"value": "string"
}
],
"hours": [
{
"blocked": 0,
"hour": "2026-01-15T09:30:00Z",
"observed": 0
}
],
"paths": [
{
"matches": 0,
"value": "string"
}
],
"rules": [
{
"matches": 0,
"value": "string"
}
]
}{}{}iduuidrequired
messagestring | null
Why the site is still pending, in words for its owner.
namestringrequired
originstringrequired
Where requests are sent on.
own_policybooleanrequired
Whether the site has a firewall policy of its own, rather than the workspace's.
statusstringrequired
pending until the domain points here and has a certificate, then active.
curl "https://api.infraflow.app/v1/orgs/acme/sites" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
[
{
"cname_target": "string",
"created_at": "2026-01-15T09:30:00Z",
"hostname": "www.example.com",
"id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
"message": "string",
"name": "my-app",
"origin": "https://203.0.113.10",
"own_policy": true,
"status": "string"
}
]originstringrequired
The server to protect, such as https://origin.example.com or http://203.0.113.10:8080. It receives requests with the site's own hostname.
replace_dnsboolean
Replace the records that already answer for the domain at Cloudflare. Without it, such records make the request fail with 409 dns_record_exists, which names them.
201Site
409Problem
name_taken, domain_taken, site_limit
422Problem
cname_targetstringrequired
The CNAME record to create at the domain's DNS provider.
created_atdate-timerequired
hostnamestringrequired
The site's address: your domain.
iduuidrequired
messagestring | null
Why the site is still pending, in words for its owner.
namestringrequired
originstringrequired
Where requests are sent on.
own_policybooleanrequired
Whether the site has a firewall policy of its own, rather than the workspace's.
statusstringrequired
pending until the domain points here and has a certificate, then active.
curl -X POST "https://api.infraflow.app/v1/orgs/acme/sites" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"cloudflare_api_token": "string",
"hostname": "www.example.com",
"name": "my-app",
"origin": "https://203.0.113.10",
"replace_dns": true
}'{
"cname_target": "string",
"created_at": "2026-01-15T09:30:00Z",
"hostname": "www.example.com",
"id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
"message": "string",
"name": "my-app",
"origin": "https://203.0.113.10",
"own_policy": true,
"status": "string"
}cname_targetstringrequired
The CNAME record to create at the domain's DNS provider.
created_atdate-timerequired
hostnamestringrequired
The site's address: your domain.
iduuidrequired
messagestring | null
Why the site is still pending, in words for its owner.
namestringrequired
originstringrequired
Where requests are sent on.
own_policybooleanrequired
Whether the site has a firewall policy of its own, rather than the workspace's.
statusstringrequired
pending until the domain points here and has a certificate, then active.
curl -X PATCH "https://api.infraflow.app/v1/orgs/acme/sites/shop" \
-H "Authorization: Bearer $INFRAFLOW_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"origin": "https://203.0.113.10"
}'{
"cname_target": "string",
"created_at": "2026-01-15T09:30:00Z",
"hostname": "www.example.com",
"id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
"message": "string",
"name": "my-app",
"origin": "https://203.0.113.10",
"own_policy": true,
"status": "string"
}created_atdate-timerequired
hostnamestringrequired
The site's address: your domain.
iduuidrequired
messagestring | null
Why the site is still pending, in words for its owner.
namestringrequired
originstringrequired
Where requests are sent on.
own_policybooleanrequired
Whether the site has a firewall policy of its own, rather than the workspace's.
statusstringrequired
pending until the domain points here and has a certificate, then active.
curl -X POST "https://api.infraflow.app/v1/orgs/acme/sites/shop/check" \ -H "Authorization: Bearer $INFRAFLOW_TOKEN"
{
"cname_target": "string",
"created_at": "2026-01-15T09:30:00Z",
"hostname": "www.example.com",
"id": "0197b2a4-5c1e-7d3a-9f10-4b6c8e2a1d55",
"message": "string",
"name": "my-app",
"origin": "https://203.0.113.10",
"own_policy": true,
"status": "string"
}{}{}{}{}