List DDoS attacks
Mitigated attacks against one address, newest first. endedAt is null while one is still
in progress — that, not a separate endpoint, is how you tell you are under attack now.
Page-numbered rather than cursor-paginated like the invoice list: the panel offers page and size, and a cursor on top of that would promise a stability it does not give.
apiToken firewall:readAuthorizationBearer <token>A personal API token: Authorization: Bearer dh_live_…. See Authentication for scopes.
Scope: firewall:read
ip*stringOne of your protected addresses, from GET /v1/firewall/ips. Any other address is a 403.
page?integer1 <= value1limit?integer1 <= value <= 10020One page of attacks, and how many there are in total.
application/json- response
items*array<>total*integerAttacks on record for this address.
curl -X GET 'https://api.deluxhost.net/v1/firewall/attacks?ip=string' \ -H "Authorization: Bearer $DELUXHOST_TOKEN"{ "items": [ { "id": 0, "ip": "string", "startedAt": "string", "endedAt": "string", "peak": "string", "peakGbps": 0, "flags": [ "string" ] } ], "total": 0}Get protection traffic statistics GET
The filter's own view of an address: what reached the server and what it discarded. `passUnit` and `dropUnit` are chosen by the panel from the window and are **not** always the same — read both rather than assuming Kb.
Get DDoS attack details GET
`ip` is required and is what proves the record is yours: attack ids are a global sequence, so an id alone identifies nothing you are entitled to. A mismatch is a `404`, like every other id that is not yours.