Replace VPS firewall rule

Replace one inbound firewall rule at a specific position. Get {pos} from GET /api/v2/vps/{id}/firewall rules[].pos; only rules with editable: true should be updated through this endpoint. The request body is the full rule replacement, not a partial patch. Per-VPS v2 firewall writes require type: "in"; outbound rules and firewall-group references from the read response are read-only on this endpoint.

VPS Services Firewall

Authentication

Required API scope: write:vm

Use Authorization: Bearer <token> for API keys. Dashboard sessions may also use hostup_session.

Context

Path Parameters

id string required Example: vps_01hxa3b4c5d6e7f8g9h0j1k2m3

Public VPS ID from `GET /api/v2/vps` `data[].id`. Do not invent this value; use the exact ID returned by the referenced API response.

pos integer required Example: 0

Firewall rule position from `GET /api/v2/vps/{id}/firewall` `rules[].pos`.

Headers

Accept Example
Content-Type Example

Body

required
application/json
type string · enum required · Example: in

Inbound rule. Per-VPS v2 firewall writes do not replace outbound rules or firewall-group references.

in
action string · enum required · Example: ACCEPT
ACCEPT
DROP
REJECT
enabled boolean · Example: true

Omit to keep the platform default for newly staged rules; send true to enable immediately.

proto stringnull · Example: tcp
dport stringnull · Example: 22
sport stringnull · Example: null
source stringnull · Example: 198.51.100.10
dest stringnull · Example: null
description stringnull · Example: Allow SSH from office

Responses

200 Firewall rule replaced.
pos integernull required · Example: 0
type stringnull · enum required · Example: in

Replaced per-VPS rules are inbound. The list endpoint can still show read-only `out` or `group` rules that already exist upstream.

in
action stringnull · enum required · Example: ACCEPT
ACCEPT
DROP
REJECT
enabled boolean required · Example: true
proto stringnull required · Example: tcp
dport stringnull required · Example: 22
sport stringnull required · Example: null
source stringnull required · Example: 198.51.100.10
dest stringnull required · Example: null
description stringnull required · Example: Allow SSH from office
isSystem boolean required · Example: false
editable boolean required · Example: true
400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
429 Rate limited. Retry after the limit resets. 429 responses include `Retry-After` seconds plus `X-RateLimit-*` headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
PUT https://cloud.hostup.se/api/v2/vps/{id}/firewall/{pos}
For AI assistants
View as Markdown
cURL 
curl -X PUT "https://cloud.hostup.se/api/v2/vps/vps_01hxa3b4c5d6e7f8g9h0j1k2m3/firewall/0" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "in",
    "action": "ACCEPT",
    "enabled": true,
    "proto": "tcp",
    "dport": "443",
    "source": "0.0.0.0/0",
    "description": "Allow HTTPS"
  }'
Response 
{
  "pos": 0,
  "type": "in",
  "action": "ACCEPT",
  "enabled": true,
  "proto": "tcp",
  "dport": "443",
  "sport": null,
  "source": "0.0.0.0/0",
  "dest": null,
  "description": "Allow HTTPS",
  "isSystem": false,
  "editable": true
}
Request Body Replace firewall rule 
{
  "type": "in",
  "action": "ACCEPT",
  "enabled": true,
  "proto": "tcp",
  "dport": "443",
  "source": "0.0.0.0/0",
  "description": "Allow HTTPS"
}