Update VPS firewall options

Partially update inbound VPS firewall options. Send at least one of enabled or inboundPolicy; unknown fields are rejected. Public v2 firewall management is inbound-only; use POST /api/v2/vps/{id}/firewall for inbound allow rules. To turn protection on for inbound traffic, set enabled: true and usually inboundPolicy: "DROP", then add explicit allow rules.

VPS Services Firewall

Authentication

Required API scope: write:vm

Use Authorization: Bearer <token> for API keys. Dashboard sessions may also use hostup_session.

Context

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID from `GET /api/v2/vps` `data[].id`. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Accept Example
Content-Type Example

Body

required
application/json
enabled boolean · Example: true
inboundPolicy string · enum · Example: DROP
ACCEPT
DROP
REJECT

Responses

200 Firewall options updated.
enabled boolean required · Example: true
inboundPolicy string · enum required · Example: DROP
ACCEPT
DROP
REJECT
platformFilteringInbound boolean required · Example: true
available boolean required · Example: true
reason stringnull required · Example: null
source stringnull required · Example: live
mode stringnull required · Example: enabled_restrictive
summary stringnull required · Example: Firewall protection is on. Incoming traffic must match an allow rule to pass.
detail stringnull required · Example: Traffic that does not match an allow rule is blocked before it reaches the VM.
actions object required
actions.canUpdate object required
actions.canUpdate.allowed boolean required · Example: true
actions.canUpdate.reason stringnull required · Example: null
actions.canUpdate.code stringnull · Example: pending_order

Machine-readable reason code when an action is blocked.

400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
429 Rate limited. Retry after the limit resets. 429 responses include `Retry-After` seconds plus `X-RateLimit-*` headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
PUT https://cloud.hostup.se/api/v2/vps/{id}/firewall/options
For AI assistants
View as Markdown
cURL 
curl -X PUT "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/firewall/options" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "inboundPolicy": "DROP"
  }'
Response 
{
  "enabled": true,
  "inboundPolicy": "DROP",
  "platformFilteringInbound": true,
  "available": true,
  "reason": null,
  "source": "live",
  "mode": "enabled_restrictive",
  "summary": "Firewall protection is on. Incoming traffic must match an allow rule to pass.",
  "detail": "Traffic that does not match an allow rule is blocked before it reaches the VM.",
  "actions": {
    "canUpdate": {
      "allowed": true,
      "reason": null
    }
  }
}
Request Body Enable inbound filtering 
{
  "enabled": true,
  "inboundPolicy": "DROP"
}