Get DDoS attack details
ip is required and is what proves the record is yours: attack ids are a global sequence, so an id alone identifies nothing you are entitled to. A mismatch is a 404, like every other id that is not yours.
apiToken firewall:readAuthorizationBearer <token>A personal API token: Authorization: Bearer dh_live_…. See Authentication for scopes.
Scope: firewall:read
attackId*integerid from GET /v1/firewall/attacks.
ip*stringOne of your protected addresses, from GET /v1/firewall/ips. Any other address is a 403.
The attack and its per-port breakdown.
application/json- response
attack*ports*array<>curl -X GET 'https://api.deluxhost.net/v1/firewall/attacks/0?ip=string' \ -H "Authorization: Bearer $DELUXHOST_TOKEN"{ "attack": { "id": 0, "ip": "string", "startedAt": "string", "endedAt": "string", "peak": "string", "peakGbps": 0, "flags": [ "string" ] }, "ports": [ { "port": 0, "protocol": "string", "packetsPeak": 0 } ]}List DDoS attacks GET
Mitigated attacks against one address, newest first. `endedAt` is null while one is still in progress — that, not a separate endpoint, is how you tell you are under attack now. Page-numbered rather than cursor-paginated like the invoice list: the panel offers page and size, and a cursor on top of that would promise a stability it does not give.
List protection rules GET
Ten per page, the panel's own page size. `state` is `working` once the rule is enforced; a rule you just created is `creating`, and one being removed is `delete`.