Skip to content
HostupDevelopers
GuidesAPI referenceSupport

Enable DDoS scrubbing

POST /api/v2/vps/{id}/ddos-scrubbing

Start DDoS scrubbing for the VPS’s primary IPv4 address. Traffic to the address is then filtered before it reaches the VPS. Send duration in seconds for a session of 1, 3, 6, 12 or 24 hours. Send permanent: true for always-on scrubbing that runs until you stop it with DELETE /api/v2/vps/{id}/ddos-scrubbing. Check available on GET /api/v2/vps/{id}/ddos-scrubbing first. A VPS in a location without scrubbing answers 403. So does an address that is excluded from scrubbing. An address outside the ranges that can be scrubbed answers 400 invalid_request. When the filter cannot take the address range yet, the call answers 409 ddos_scrubbing_unavailable_for_ip and nothing is started. When protection is already on for the address, the call answers 409 ddos_mitigation_active.

Authentication: An API key with the scope write:vm. About keys and scopes

Request

Path parameters

idstringrequired
The VPS ID (vps_…).

Body

durationinteger
Session length in seconds: 3600, 10800, 21600, 43200 or 86400 (1, 3, 6, 12 or 24 hours). Not together with permanent. One of 3600, 10800, 21600, 43200, 86400.
permanentboolean
true for always-on scrubbing without an end time. It runs until you stop it. Not together with duration. One of true.

Example

POST /api/v2/vps/{id}/ddos-scrubbing
curl -X POST "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/ddos-scrubbing" \
  -H "Authorization: Bearer $HOSTUP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "duration": 3600
  }'

Responses

200 Scrubbing started.

Response 200
{
  "available": true,
  "reason": null,
  "ip": "192.0.2.10",
  "active": true,
  "durationSeconds": 3600,
  "createdAt": null,
  "expiresAt": "2026-06-22T13:07:03.000Z",
  "networkMitigation": {
    "status": "unknown",
    "action": null,
    "automatic": null,
    "createdAt": null,
    "expiresAt": null
  }
}
Response fields
availableboolean
True after a successful start.
reasonstring or null
Always null after a successful start.
ipstring or null
The address being scrubbed.
activeboolean
True once scrubbing has started.
durationSecondsinteger or null
Session length in seconds. Null for always-on scrubbing.
createdAtstring or null
Always null in this response.
expiresAtstring or null
When the session ends. Null for always-on scrubbing.
networkMitigationobject
Always status: "unknown" in this response. Read GET /api/v2/vps/{id}/ddos-scrubbing for the verified state.
statusstring
active when protection is on. none when checked and clear. unknown when it could not be checked, which never means clear. One of active, none, unknown.
actionstring or null
blackhole: all internet traffic to the address is dropped. scrub: traffic is filtered before it reaches the VPS. Null unless status is active. One of blackhole, scrub.
automaticboolean or null
False for a session started from the client area or the API. True otherwise, for example the automatic response to an attack. Null when unknown.
createdAtstring or null
When it started. Null when unknown.
expiresAtstring or null
When it ends by itself. Null when it has no end or is unknown.

Errors

Errors are Problem Details with a stable code. Branch on the code, not on the text.

400Invalid request. The response body is an RFC 7807 Problem Details document.
401Unauthorized. Authentication is required.
403Forbidden. The caller lacks a required scope or does not own the resource.
404Not found. The resource does not exist or is not owned by the caller; code is vps_not_found.
409ddos_mitigation_active: protection is already on for this address. ddos_scrubbing_unavailable_for_ip: the address range cannot be scrubbed yet. Nothing was started in either case.
429Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
500Internal error. Retry later or contact support if the issue persists.

This page as MarkdownOpenAPI spec