---
title: Network Protect
summary: The Network Protect API lets you register customer-owned IP space, configure GRE delivery endpoints, manage reusable source prefix lists, and define ordered rules that filter network-layer DDoS traffic.
url: https://www.fastly.com/documentation/reference/api/network-protect
---

The Network Protect API lets you register customer-owned IP space, configure GRE delivery endpoints, manage reusable source prefix lists, and define ordered rules that filter network-layer DDoS traffic.

## Data model

| Field | Type | Description |
|-------|------|-------------|
| `detail` | string | Explanation of the conflicting resource state. |
| `errors` | array | Optional conflict error details. |
| `status` | integer | HTTP status code for this error. |
| `title` | string | Short summary of the conflict. |
| `error` | string | Explanation of the conflict for the field. |
| `field` | string | Request field associated with the conflict. |
| `ip_address` | string | The GRE destination address, unique within the customer. It cannot be changed after endpoint creation. |
| `name` | string | A human-readable name, unique within the customer. |
| `endpoints` | array | The endpoints serving a policy region. |
| `region` | string | The region served by this policy.s the only accepted value. |
| `created_at` | string | An ISO 8601 timestamp in UTC. (Read-only) |
| `id` | string | A read-only unique identifier for a Network Protect resource. (Read-only) |
| `updated_at` | string | An ISO 8601 timestamp in UTC. (Read-only) |
| `meta` | object | Pagination metadata for a collection response. |
| `limit` | integer | Effective page limit after defaulting and clamping. |
| `next_cursor` | string | Continuation value to send as cursor when more resources remain. Omitted on the final page. |
| `advertise` | boolean | Desired advertisement state, which is not the same as observed route state. Enabling it requires approved LOA, valid ROA, and a ready default-region delivery policy. A later ROA failure does not turn an existing advertisement off; losing LOA approval or the last ready default endpoint does. |
| `description` | string | Optional descriptive text for the network. This metadata does not change traffic handling. Null clears it on update. |
| `endpoint_policies` | array | Complete endpoint policy configuration. A network has at most one policy per region and may have no policies. |
| `prefix` | string | The CIDR block to protect, masked to its network address. It cannot be changed after creation. |
| `rule_set_id` | string | The backend-assigned rule set applied to this network. |
| `loa_status` | string | Fastly operator status for the Letter of Authorization. A status of <code>pending</code> means review is incomplete; <code>approved</code> means operators accepted it; and <code>rejected</code> means they declined it. An approved LOA alone does not make a network ready for advertisement. (Read-only) |
| `roa_checked_at` | string | When Fastly last completed a ROA check. Null while the status is pending. A failed check leaves this unchanged; an old value can indicate delayed or failing checks. Null also means the controller did not report a check time. (Read-only) |
| `roa_data_as_of` | string | When the RPKI dataset used by the last check was built. This is not the same as <code>roa_checked_at</code>; a recent check can use an older dataset. Null while the status is pending or when no dataset build time was reported. (Read-only) |
| `roa_status` | string | Whether a Route Origin Authorization permits Fastly to announce this prefix. Fastly refreshes this on a schedule; reading a network never triggers a check, so this can be older than the moment you read it. A status of <code>pending</code> means no check has completed; <code>valid</code> authorizes Fastly at this prefix length; <code>invalid</code> means a covering ROA does not authorize Fastly; and <code>not_found</code> means no ROA covers the prefix. The controller may omit an unrecognized status, and omission is not an authorization result. A valid ROA alone does not make a network ready for advertisement. (Read-only) |
| `endpoint_id` | string | A unique identifier for a Network Protect resource. |
| `preference` | integer | Delivery preference within a policy. Lower values are preferred first. Two endpoints in the same policy cannot share a value. |
| `addresses` | array | Complete canonical list contents. Bare addresses are canonicalized, CIDRs are masked, equivalent entries are deduplicated, and overlaps are retained. |
| `family` | string | The address family; it cannot change after creation. |
| `action` | string | Action for traffic matching this rule. |
| `comment` | string | Optional rule metadata of 1 to 100 Unicode code points. It does not participate in traffic matching. Omit it to leave a rule without a comment; replacing rules with an item that omits it clears the stored comment. Omitting rules on PATCH preserves existing comments. Empty strings and null are rejected. |
| `destination_ip_address` | string | Match traffic sent to this address; omit for any destination. An address outside a Network using this Rule Set never matches and still consumes one of the 64 rules. The API does not enforce containment in a network prefix; attached Rule Sets require a compatible IP family. |
| `destination_ports` | string | Match traffic sent to this port or port range. |
| `ip_protocol` | string | The IP protocol to match. Omit to match any protocol. |
| `source_ports` | string | Match traffic from this port or port range. |
| `source_prefix_list_id` | string | Match traffic whose source appears in this prefix list. |
| `default_action` | string | Action when no rule matches. |
| `rules` | array | Rules in evaluation order with read-only timestamps. |

## API endpoints

### List Network Protect networks

**GET** `/network-protect/v1/networks`

Lists the customer's networks in ascending ID order. The response is cursor-paginated and includes the effective page limit.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Continuation value from a previous response's meta.next_cursor. Omit this parameter to request the first page. |
| `limit` | integer | query | No | Maximum resources to return. Defaults to 100. Positive values above 1000 are accepted and clamped to 1000; the effective value is reported in meta.limit. Zero, negative, and non-integer values return a <code>400 Bad Request</code> error. |

### Create a Network Protect network

**POST** `/network-protect/v1/networks`

Registers customer-owned IP space for protection. The network starts with advertisement disabled and Fastly does not announce its prefix. Turn advertisement on after LOA and ROA authorization are ready. The create request cannot include advertise; sending it returns a <code>400 Bad Request</code> error.

### Get a Network Protect network

**GET** `/network-protect/v1/networks/{network_id}`

Retrieves a single network by its identifier.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `network_id` | string | path | Yes | Unique identifier of the Network Protect network. |

### Delete a Network Protect network

**DELETE** `/network-protect/v1/networks/{network_id}`

Deletes a network and stops its advertisement and filtering. Endpoints and rule sets used by the network are not deleted.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `network_id` | string | path | Yes | Unique identifier of the Network Protect network. |

### Update a Network Protect network

**PATCH** `/network-protect/v1/networks/{network_id}`

Updates a network. Omitted fields remain unchanged. The prefix cannot be changed. Sending <code>endpoint_policies</code> replaces the complete policy list; an empty array removes every policy.
Advertisement is desired state. Enabling it requires an approved LOA, a valid ROA, and a ready default-region delivery policy. A readiness failure returns a <code>409 Conflict</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `network_id` | string | path | Yes | Unique identifier of the Network Protect network. |

### List Network Protect endpoints

**GET** `/network-protect/v1/endpoints`

Lists the customer's GRE delivery endpoints in ascending ID order. The response is cursor-paginated and includes the effective page limit.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Continuation value from a previous response's meta.next_cursor. Omit this parameter to request the first page. |
| `limit` | integer | query | No | Maximum resources to return. Defaults to 100. Positive values above 1000 are accepted and clamped to 1000; the effective value is reported in meta.limit. Zero, negative, and non-integer values return a <code>400 Bad Request</code> error. |

### Create a Network Protect endpoint

**POST** `/network-protect/v1/endpoints`

Creates a GRE delivery destination. A new endpoint is not attached to a network until it is added to an endpoint policy.

### Get a Network Protect endpoint

**GET** `/network-protect/v1/endpoints/{endpoint_id}`

Retrieves a single endpoint by its identifier.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `endpoint_id` | string | path | Yes | Unique identifier of the Network Protect endpoint. |

### Delete a Network Protect endpoint

**DELETE** `/network-protect/v1/endpoints/{endpoint_id}`

Deletes an endpoint. The endpoint must first be removed from every network policy; active references return a <code>409 Conflict</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `endpoint_id` | string | path | Yes | Unique identifier of the Network Protect endpoint. |

### Update a Network Protect endpoint

**PATCH** `/network-protect/v1/endpoints/{endpoint_id}`

Updates an endpoint. Omitted fields remain unchanged. The IP address cannot be changed; create a new endpoint if the destination changes.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `endpoint_id` | string | path | Yes | Unique identifier of the Network Protect endpoint. |

### List Network Protect prefix lists

**GET** `/network-protect/v1/prefix-lists`

Lists prefix lists in ascending ID order. Positive limits above 1000 are accepted and clamped to 1000. Invalid limits return a <code>400 Bad Request</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Continuation value from a previous response's meta.next_cursor. Omit this parameter to request the first page. |
| `limit` | integer | query | No | Maximum resources to return. Defaults to 100. Positive values above 1000 are accepted and clamped to 1000; the effective value is reported in meta.limit. Zero, negative, and non-integer values return a <code>400 Bad Request</code> error. |

### Create a Network Protect prefix list

**POST** `/network-protect/v1/prefix-lists`

Creates a typed list of addresses that rules can reference. The family is required and cannot be changed. The addresses list may remain empty.

### Get a Network Protect prefix list

**GET** `/network-protect/v1/prefix-lists/{prefix_list_id}`

Retrieves a single prefix list by its identifier. Unknown and foreign IDs are indistinguishable and return a <code>404 Not Found</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `prefix_list_id` | string | path | Yes | Unique identifier of the Network Protect prefix list. |

### Delete a Network Protect prefix list

**DELETE** `/network-protect/v1/prefix-lists/{prefix_list_id}`

Deletes a prefix list. Active rule references must be removed first; referenced lists return a <code>409 Conflict</code> error. Unknown and foreign IDs are indistinguishable and return a <code>404 Not Found</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `prefix_list_id` | string | path | Yes | Unique identifier of the Network Protect prefix list. |

### Update a Network Protect prefix list

**PATCH** `/network-protect/v1/prefix-lists/{prefix_list_id}`

Updates a prefix list. The family cannot be changed. Sending addresses replaces the complete list; an empty array clears it when no active source-list restriction applies. Addresses are canonicalized, deduplicated, and sorted by the backend.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `prefix_list_id` | string | path | Yes | Unique identifier of the Network Protect prefix list. |

### List Network Protect rule sets

**GET** `/network-protect/v1/rule-sets`

Lists rule sets in ascending ID order. Positive limits above 1000 are accepted and clamped to 1000; invalid limits return a <code>400 Bad Request</code> error.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `cursor` | string | query | No | Continuation value from a previous response's meta.next_cursor. Omit this parameter to request the first page. |
| `limit` | integer | query | No | Maximum resources to return. Defaults to 100. Positive values above 1000 are accepted and clamped to 1000; the effective value is reported in meta.limit. Zero, negative, and non-integer values return a <code>400 Bad Request</code> error. |

### Create a Network Protect rule set

**POST** `/network-protect/v1/rule-sets`

Creates an ordered rule set and stores its filtering intent. A rule set has at most 64 rules and uses the default action when no rule matches. Custom attachment and detachment are restricted in this release.

### Get a Network Protect rule set

**GET** `/network-protect/v1/rule-sets/{rule_set_id}`

Retrieves a single rule set with rules in evaluation order.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `rule_set_id` | string | path | Yes | Unique identifier of the Network Protect rule set. |

### Delete a Network Protect rule set

**DELETE** `/network-protect/v1/rule-sets/{rule_set_id}`

Deletes a rule set. Attached rule sets cannot be deleted and return a <code>409 Conflict</code> error until their references are removed.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `rule_set_id` | string | path | Yes | Unique identifier of the Network Protect rule set. |

### Update a Network Protect rule set

**PATCH** `/network-protect/v1/rule-sets/{rule_set_id}`

Updates a rule set. Omitted fields remain unchanged. Sending rules replaces the complete ordered list; an empty array removes every rule. Custom attachment and detachment remain restricted in this release.

**Parameters:**

| Name | Type | In | Required | Description |
|------|------|----|---------|--------------|
| `rule_set_id` | string | path | Yes | Unique identifier of the Network Protect rule set. |