Network Protect
The Network Protect API lets you register customer-owned IP space, configure GRE delivery endpoints, manage reusable source prefix lists, and define ordered rules that filter network-layer DDoS traffic.
Data model
Conflict returned when resource state prevents the request.
detail | string | Explanation of the conflicting resource state. Required. | |
errors | array | Optional conflict error details. | |
status | integer | HTTP status code for this error. Required. | |
title | string | Short summary of the conflict. Required. | |
error | string | Explanation of the conflict for the field. | |
field | string | Request field associated with the conflict. | |
ip_address | string | The GRE destination address, unique within the customer. It cannot be changed after endpoint creation. | |
name | string | A human-readable name, unique within the customer. | |
endpoints | array | The endpoints serving a policy region. | |
region | string | The region served by this policy.s the only accepted value. [Default default] | |
created_at | string | An ISO 8601 timestamp in UTC. Read-only. | |
id | string | A read-only unique identifier for a Network Protect resource. Read-only. | |
updated_at | string | An ISO 8601 timestamp in UTC. Read-only. | |
meta | object | Pagination metadata for a collection response. | |
limit | integer | Effective page limit after defaulting and clamping. [Default 100] | |
next_cursor | string | Continuation value to send as cursor when more resources remain. Omitted on the final page. | |
advertise | boolean | Desired advertisement state, which is not the same as observed route state. Enabling it requires approved LOA, valid ROA, and a ready default-region delivery policy. A later ROA failure does not turn an existing advertisement off; losing LOA approval or the last ready default endpoint does. [Default false] | |
description | string | Optional descriptive text for the network. This metadata does not change traffic handling. Null clears it on update. | |
endpoint_policies | array | Complete endpoint policy configuration. A network has at most one policy per region and may have no policies. | |
prefix | string | The CIDR block to protect, masked to its network address. It cannot be changed after creation. | |
rule_set_id | string | The backend-assigned rule set applied to this network. | |
loa_status | string | Fastly operator status for the Letter of Authorization. A status of pending means review is incomplete; approved means operators accepted it; and rejected means they declined it. An approved LOA alone does not make a network ready for advertisement. Read-only. | |
roa_checked_at | string | When Fastly last completed a ROA check. Null while the status is pending. A failed check leaves this unchanged; an old value can indicate delayed or failing checks. Null also means the controller did not report a check time. Read-only. | |
roa_data_as_of | string | When the RPKI dataset used by the last check was built. This is not the same as roa_checked_at; a recent check can use an older dataset. Null while the status is pending or when no dataset build time was reported. Read-only. | |
roa_status | string | Whether a Route Origin Authorization permits Fastly to announce this prefix. Fastly refreshes this on a schedule; reading a network never triggers a check, so this can be older than the moment you read it. A status of pending means no check has completed; valid authorizes Fastly at this prefix length; invalid means a covering ROA does not authorize Fastly; and not_found means no ROA covers the prefix. The controller may omit an unrecognized status, and omission is not an authorization result. A valid ROA alone does not make a network ready for advertisement. Read-only. | |
endpoint_id | string | A unique identifier for a Network Protect resource. | |
preference | integer | Delivery preference within a policy. Lower values are preferred first. Two endpoints in the same policy cannot share a value. | |
addresses | array | Complete canonical list contents. Bare addresses are canonicalized, CIDRs are masked, equivalent entries are deduplicated, and overlaps are retained. | |
family | string | The address family; it cannot change after creation. | |
action | string | Action for traffic matching this rule. | |
comment | string | Optional rule metadata of 1 to 100 Unicode code points. It does not participate in traffic matching. Omit it to leave a rule without a comment; replacing rules with an item that omits it clears the stored comment. Omitting rules on PATCH preserves existing comments. Empty strings and null are rejected. | |
destination_ip_address | string | Match traffic sent to this address; omit for any destination. An address outside a Network using this Rule Set never matches and still consumes one of the 64 rules. The API does not enforce containment in a network prefix; attached Rule Sets require a compatible IP family. | |
destination_ports | string | Match traffic sent to this port or port range. | |
ip_protocol | string | The IP protocol to match. Omit to match any protocol. | |
source_ports | string | Match traffic from this port or port range. | |
source_prefix_list_id | string | Match traffic whose source appears in this prefix list. | |
default_action | string | Action when no rule matches. | |
rules | array | Rules in evaluation order with read-only timestamps. |
