Skip to content
HostupDevelopers
GuidesAPI referenceSupport

Get DDoS scrubbing status

GET /api/v2/vps/{id}/ddos-scrubbing

Get the DDoS scrubbing state of the VPS’s primary IPv4 address. available says whether you can start scrubbing on this VPS. When it is false, reason says why. active is true while a session you started is running. networkMitigation shows any protection on the address right now, including the automatic response to an attack. With action: "blackhole" all traffic from the internet to the address is dropped. The VPS is unreachable from outside until expiresAt. With action: "scrub" traffic is filtered before it reaches the VPS. status: "unknown" means the state could not be checked. It does not mean that nothing is active. Start a session with POST /api/v2/vps/{id}/ddos-scrubbing and end it with DELETE /api/v2/vps/{id}/ddos-scrubbing.

Authentication: An API key with the scope read:vm. About keys and scopes

Request

Path parameters

idstringrequired
The VPS ID (vps_…).

Example

GET /api/v2/vps/{id}/ddos-scrubbing
curl "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/ddos-scrubbing" \
  -H "Authorization: Bearer $HOSTUP_API_KEY"

Responses

200 DDoS scrubbing state of the VPS’s primary IPv4 address.

Response 200
{
  "available": true,
  "reason": null,
  "ip": "192.0.2.10",
  "active": false,
  "durationSeconds": null,
  "createdAt": null,
  "expiresAt": null,
  "networkMitigation": {
    "status": "active",
    "action": "blackhole",
    "automatic": true,
    "createdAt": "2026-08-07T11:15:20.000Z",
    "expiresAt": "2026-08-07T12:15:20.000Z"
  }
}
Response fields
availableboolean
Whether you can start scrubbing on this VPS.
reasonstring or null
Why scrubbing is not available. Null when it is.
ipstring or null
The primary IPv4 address the state applies to. Null when the VPS has none.
activeboolean
True while a scrubbing session you started is running.
durationSecondsinteger or null
Always null on this read. The response to POST carries the session length.
createdAtstring or null
When the running session started. Null without a session.
expiresAtstring or null
When the running session ends. Null without a session and for always-on scrubbing.
networkMitigationobject
Any protection on the address right now, including the automatic response to an attack.
statusstring
active when protection is on. none when checked and clear. unknown when it could not be checked, which never means clear. One of active, none, unknown.
actionstring or null
blackhole: all internet traffic to the address is dropped. scrub: traffic is filtered before it reaches the VPS. Null unless status is active. One of blackhole, scrub.
automaticboolean or null
False for a session started from the client area or the API. True otherwise, for example the automatic response to an attack. Null when unknown.
createdAtstring or null
When it started. Null when unknown.
expiresAtstring or null
When it ends by itself. Null when it has no end or is unknown.

Errors

Errors are Problem Details with a stable code. Branch on the code, not on the text.

400Invalid request. The response body is an RFC 7807 Problem Details document.
401Unauthorized. Authentication is required.
403Forbidden. The caller lacks a required scope or does not own the resource.
404Not found. The resource does not exist or is not owned by the caller; code is vps_not_found.
429Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
500Internal error. Retry later or contact support if the issue persists.

This page as MarkdownOpenAPI spec