API ReferenceGroupsBeta

Apply a group to a whole prefixBeta

Enabled per organisation

This endpoint answers 403 until our staff enable the Firewall API flag on your organisation, and its ability cannot be granted to a key before then. Open a ticket saying what you intend to build — see Activation.
POST
/firewall/groups/{group}/prefixes

Applies the group to every address in an IPv4 prefix your organisation owns, as one target. The mitigation network keys each rule to a single address, so the prefix is still carried out address by address, but it is removed, re-scoped and reported as a unit: it reads back under the group's prefixes, and each of its addresses under assignments names it in prefix.

  • The prefix may be no wider than limits.group_prefix_min_length (a /24 by default), and a group may carry at most limits.group_prefix_targets_max prefixes.
  • It must start on its network boundary: 203.0.113.7/24 is refused with a pointer to 203.0.113.0/24.
  • It may not overlap a prefix this group is already applied to.
  • The network and broadcast addresses are left out unless include_edges is true. A /31 or /32 has neither and is always applied whole.

An address this group already reaches on its own is left exactly as it is, and stays behind if the prefix is later removed.

There is no pre-flight: each address is measured against its limits as it is reconciled, and one the group does not fit on is named in the prefix's failed.

Authorization

orgApiKey firewall-groups.manage
AuthorizationBearer <token>

An organisation API key, prefixed tbk_. Create one under Organisation to API keys; the plaintext is shown once.

The scopes listed on each operation are the abilities the key must carry. They are not OAuth scopes and are not negotiated per request.

In: header

Scope: firewall-groups.manage

Path Parameters

group*integer

The group's id, as returned by the list endpoint. A group belonging to another organisation is a 404, never a 403 — a 403 would confirm the id is real.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/firewall/groups/42/prefixes" \  -H "Content-Type: application/json" \  -d '{    "cidr": "203.0.113.0/24"  }'
{  "data": {    "operation_id": 0,    "prefix": {      "cidr": "203.0.113.0/24",      "include_edges": true,      "address_count": 0,      "status": "pending",      "status_counts": {        "property1": 0,        "property2": 0      },      "failed": [        {          "ip": "192.168.0.1",          "last_error": "string"        }      ]    }  },  "message": "string"}

Re-queue one address that failed POST

Clears the recorded error and re-queues that address, forced past the usual "already at this revision" check — the…

Include or leave out a prefix's edges PATCH

Turning include_edges on applies the group to the network and broadcast addresses; turning it off removes the group's…