Add an access rule to the end of a service's firewall. Allow and block rules are checked in order, and the first match decides. With no match, the client gets in. Rate limit rules then apply to websites, and each matching one counts the request, per client address and per server.
API key access: full.
apiKeyAuthorizationBearer <pyo_…>An API key from the dashboard's API keys page: Authorization: Bearer pyo_…. Keys can expire, and an expired one gets a 401.
application/jsonAdd an access rule to the end of a service's firewall. Allow and block rules are checked in order, and the first match decides. With no match, the client gets in. Rate limit rules then apply to websites, and each matching one counts the request, per client address and per server.
API key access: full.
op*"addFirewallRule""addFirewallRule"id*stringA new id you choose: fwr_ then 4 to 40 lowercase letters, digits, dashes or underscores.
serviceId*stringaction*string"allow", "block" or "rateLimit".
operator?string"in" (the default) or "notIn": whether the client's address or country is in sources.
sources?array<string>Up to 50 IP addresses and ranges ("198.51.100.0/24", "2001:db8::/32") or two-letter country codes ("DE"), but not both. None (with "in") matches any client. Countries apply to websites only, since TCP and UDP ports never see a client's country. Rate limits take no countries, and only one value with "notIn".
requests?|A rate limit's requests from each client address per per: 1 to 1,000,000.
int320 <= valueper?|A rate limit's window: "second" or "minute" (the default).
note?stringDone. Always ok: true, and some operations add more, such as a new API key or a join command. A warning comes with a change that went through but won't fully take effect yet, such as more replicas than the servers have room for.
application/jsoncurl -X POST 'https://your-pyo.example.com/api/v1/ops' \
-H 'Content-Type: application/json' \
-d '{
"action": "allow",
"id": "fwr_8kq2x7ad",
"op": "addFirewallRule",
"serviceId": "svc_8kq2x7ad"
}'{}