Enable DDoS scrubbing

POST /api/v2/vps/{id}/ddos-scrubbing

Enable on-demand DDoS scrubbing for the VPS primary IP — either for a fixed duration, or always-on with permanent: true (no expiry; stays active until disabled with DELETE /api/v2/vps/{id}/ddos-scrubbing). Successful responses are wrapperless; validation, ownership, permission, and state failures use Problem Details with JSON pointers where applicable.

VPS Services VM

Authentication

Required API scope: write:vm

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Related endpoints

GET /api/v2/vps/{id}/ddos-scrubbing Get DDoS scrubbing status DELETE /api/v2/vps/{id}/ddos-scrubbing Disable DDoS scrubbing GET /api/v2/vps/{id} Get VPS details

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID. Get it from GET /api/v2/vps data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Authorization Bearer <token>

Accept application/json

Content-Type application/json

Body

required

application/json

duration integer · enum

Requested scrubbing duration in seconds. Mutually exclusive with permanent.

3600

10800

21600

43200

86400

permanent boolean · enum

Enable always-on scrubbing with no expiry — protection stays active until it is disabled with DELETE. Mutually exclusive with duration; pass exactly one of the two.

true

Responses

200 DDoS scrubbing status after the enable attempt. 8 fields

available boolean required

reason string · nullable required

ip string · nullable required

active boolean required

durationSeconds integer · nullable required

createdAt string · nullable required

expiresAt string · nullable required

networkMitigation object required

Network-level mitigation state for the VPS IP. Action responses do not re-verify the platform-wide mitigation state, so this is typically "unknown" here — read GET /api/v2/vps/{id}/ddos-scrubbing for the verified state.

networkMitigation.status string · enum required

"active" when a mitigation is applied, "none" when verified clear, "unknown" when the state was not verified in this response.

active

none

unknown

networkMitigation.action string · nullable · enum required

"blackhole": all internet traffic to the IP is dropped. "scrub": traffic is filtered; services keep working. Null when status is not "active".

blackhole

scrub

networkMitigation.automatic boolean · nullable required

True for automatic attack responses, false for the customer's own on-demand session, null when unknown.

networkMitigation.createdAt string · nullable required

When the mitigation started, or null.

networkMitigation.expiresAt string · nullable required

When the mitigation automatically ends, or null.

400 Invalid request. The response body is an RFC 7807 Problem Details document. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

401 Unauthorized. Authentication is required. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

403 Forbidden. The caller lacks a required scope or does not own the resource. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

404 Not found. The resource does not exist or is not owned by the caller. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

409 DDoS mitigation is already active for this IP address. 8 fields

type string required

title string required

status integer required

detail string required

instance string required

code string required

requestId string required

timestamp string required

429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

500 Internal error. Retry later or contact support if the issue persists. 10 fields

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

POST https://cloud.hostup.se/api/v2/vps/{id}/ddos-scrubbing

For AI assistants

View as Markdown

cURL

curl -X POST "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/ddos-scrubbing" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "duration": 3600
  }'

Response

{
  "available": true,
  "reason": null,
  "ip": "192.0.2.10",
  "active": true,
  "durationSeconds": 3600,
  "createdAt": null,
  "expiresAt": "2026-06-22T13:07:03.000Z",
  "networkMitigation": {
    "status": "unknown",
    "action": null,
    "automatic": null,
    "createdAt": null,
    "expiresAt": null
  }
}

{
  "type": "object",
  "properties": {
    "available": {
      "type": "boolean"
    },
    "reason": {
      "type": "string",
      "nullable": true
    },
    "ip": {
      "type": "string",
      "nullable": true
    },
    "active": {
      "type": "boolean"
    },
    "durationSeconds": {
      "type": "integer",
      "nullable": true
    },
    "createdAt": {
      "type": "string",
      "nullable": true
    },
    "expiresAt": {
      "type": "string",
      "nullable": true
    },
    "networkMitigation": {
      "type": "object",
      "description": "Network-level mitigation state for the VPS IP. Action responses do not re-verify the platform-wide mitigation state, so this is typically \"unknown\" here — read GET /api/v2/vps/{id}/ddos-scrubbing for the verified state.",
      "properties": {
        "status": {
          "type": "string",
          "description": "\"active\" when a mitigation is applied, \"none\" when verified clear, \"unknown\" when the state was not verified in this response.",
          "enum": [
            "active",
            "none",
            "unknown"
          ]
        },
        "action": {
          "type": "string",
          "description": "\"blackhole\": all internet traffic to the IP is dropped. \"scrub\": traffic is filtered; services keep working. Null when status is not \"active\".",
          "nullable": true,
          "enum": [
            "blackhole",
            "scrub"
          ]
        },
        "automatic": {
          "type": "boolean",
          "description": "True for automatic attack responses, false for the customer's own on-demand session, null when unknown.",
          "nullable": true
        },
        "createdAt": {
          "type": "string",
          "description": "When the mitigation started, or null.",
          "nullable": true
        },
        "expiresAt": {
          "type": "string",
          "description": "When the mitigation automatically ends, or null.",
          "nullable": true
        }
      }
    }
  }
}

Request Body Enable for one hour

{
  "duration": 3600
}