List VPS firewall rules

GET /api/v2/vps/{id}/firewall

Return VPS firewall protection state, rules, rule limits, and action gates.

Get {id} from GET /api/v2/vps.

Use rules[].pos as {pos} for rule update/delete only when rules[].editable is true.

Per-VPS v2 writes manage inbound rules only: type: "in" can be editable, while upstream type: "out" rules and type: "group" shared/group references are read-only on this endpoint.

VPS Services Firewall

Authentication

Required API scope: read:vm

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID from GET /api/v2/vps data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Authorization Bearer <token>
Accept application/json

Responses

200 VPS firewall state and rules.
available boolean required · Example: true
reason string · nullable required · Example: null

enabled boolean required · Example: true
summary string · nullable required · Example: Firewall protection is on. Incoming traffic must match an allow rule to pass.

detail string · nullable required · Example: Traffic that does not match one of the rules below is blocked before it reaches the VM.

limits object required
limits.maxRules integer required · Example: 100
limits.currentRules integer required · Example: 1
limits.remainingRules integer required · Example: 99
rules array<object> required
rules[].pos integer · nullable required · Example: 0

Nullable: may be null when not applicable.

rules[].type string · nullable · enum required · Example: in

in is the customer-writable inbound rule type. out and group can appear from upstream reads but are read-only through this per-VPS endpoint.

in
out
group
rules[].action string · nullable · enum required · Example: ACCEPT

Nullable: may be null when not applicable.

ACCEPT
DROP
REJECT
rules[].enabled boolean required · Example: true
rules[].proto string · nullable required · Example: tcp

Nullable: may be null when not applicable.

rules[].dport string · nullable required · Example: 22

Nullable: may be null when not applicable.

rules[].sport string · nullable required · Example: null

Nullable: may be null when not applicable.

rules[].source string · nullable required · Example: 198.51.100.10

Nullable: may be null when not applicable.

rules[].dest string · nullable required · Example: null

Nullable: may be null when not applicable.

rules[].description string · nullable required · Example: Allow SSH from office

Nullable: may be null when not applicable.

rules[].isSystem boolean required · Example: false
rules[].editable boolean required · Example: true
ruleCount integer required · Example: 1
actions object required
actions.canAddRule object required
actions.canAddRule.allowed boolean required · Example: true
actions.canAddRule.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canAddRule.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canToggleFirewall object required
actions.canToggleFirewall.allowed boolean required · Example: true
actions.canToggleFirewall.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canToggleFirewall.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
GET https://cloud.hostup.se/api/v2/vps/{id}/firewall
For AI assistants
View as Markdown
cURL 
curl -X GET "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/firewall" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"
Response 
{
  "available": true,
  "reason": null,
  "enabled": true,
  "summary": "Firewall protection is on. Incoming traffic must match an allow rule to pass.",
  "detail": "Traffic that does not match one of the rules below is blocked before it reaches the VM.",
  "limits": {
    "maxRules": 100,
    "currentRules": 1,
    "remainingRules": 99
  },
  "rules": [
    {
      "pos": 0,
      "type": "in",
      "action": "ACCEPT",
      "enabled": true,
      "proto": "tcp",
      "dport": "22",
      "sport": null,
      "source": "198.51.100.10",
      "dest": null,
      "description": "Allow SSH from office",
      "isSystem": false,
      "editable": true
    }
  ],
  "ruleCount": 1,
  "actions": {
    "canAddRule": {
      "allowed": true,
      "reason": null
    },
    "canToggleFirewall": {
      "allowed": true,
      "reason": null
    }
  }
}