Create Rate Limit Rule
Create a per-endpoint rate-limit rule. Each rule has 0..N conditions joined by AND/OR — same vocabulary as firewall policies (source_ip, country, browser, user_agent, endpoint, path, method, header, cookie, protocol, port). A request is counted only when its conditions resolve to true; the counter is then keyed by client IP. Once the counter exceeds requests_per_window within window_size_seconds, the configured action applies until the window rolls over.
Counters live in the platform's hot-path Redis. Rules are reloaded by every tunnel-server every 30 seconds, so a new rule starts taking effect within that window.
A rule with no conditions matches every request to its endpoint (legacy behaviour).
Request body
name string Req
Rule name.
endpoint_id int | string (uuid) Req
The endpoint this rule applies to. Accepts the numeric DB ID or the endpoint UUID. You may also pass
endpoint_uuid as an explicit alias.description string
Free-form description.
conditions array
Match conditions joined by AND/OR. Each entry is
{condition_type, operator, condition_value, logical_operator} with the same vocabulary as firewall policies — see firewall policies for the full type/operator matrix and per-type value rules (ISO country codes, uppercase HTTP methods, IP/CIDR, etc.). The logical_operator on a condition is the OUTGOING connector to the next condition. Empty / omitted = "match every request to this endpoint".source_ip string? Deprecated
Pre-#172 single-IP filter, kept for backwards compatibility. When you post a rule with
source_ip set and an empty conditions array, the api-server auto-promotes it into a single {type:"source_ip", operator:"equals", value:<ip>} condition. New code should use conditions directly.requests_per_window int
Requests allowed per window. A negative value returns 400;
0 (or omitted) defaults to 100.window_size_seconds int
Sliding window length. A value
≤ 0 (or omitted) defaults to 3600. Common values: 60 (per minute), 3600 (per hour), 86400 (per day).action string
block (default — return 429) or throttle (delay subsequent requests instead of dropping them). Any other value is coerced to block.status string
active (default), inactive, or disabled. Only active rules are evaluated.priority int
Lower numbers evaluated first. Stored as sent; defaults to
0 when omitted (no server-side default or clamp).Response (200 OK)
The newly-created rule with assigned id, plus created_at / updated_at and its conditions array.
Errors
400 Bad Request
Missing
name, malformed source_ip, negative requests_per_window, an invalid conditions entry (bad type/operator/value), or an unknown JSON field. Unknown fields are rejected — there is no key, scope, limit, or window_seconds on this endpoint; use the names documented above.401 Unauthorized
Missing auth.
403 Forbidden
Plan doesn't include
custom_rate_limits.404 Not Found
Endpoint doesn't exist or isn't owned by the caller.
Request — 1000 req/min for all IPs on endpoint #42
curl -X POST "https://api.ngris.com/v1/firewall/rate-limits" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"name": "anti-abuse",
"endpoint_id": 42,
"requests_per_window": 1000,
"window_size_seconds": 60,
"action": "block"
}'
Request — 50 req/min throttle for one corporate /24
curl -X POST "https://api.ngris.com/v1/firewall/rate-limits" \
-H "X-API-KEY: <your_api_key>" \
-H "Content-Type: application/json" \
-d '{
"name": "scrape-defense",
"endpoint_id": 42,
"source_ip": "203.0.113.0/24",
"requests_per_window": 50,
"window_size_seconds": 60,
"action": "throttle",
"priority": 50
}'
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
client.firewall.create_rate_limit({
"name": "anti-abuse",
"endpoint_id": 42,
"requests_per_window": 1000,
"window_size_seconds": 60,
"action": "block",
})
Response — 200 OK
{
"id": 1,
"endpoint_id": 42,
"user_id": 7,
"name": "anti-abuse",
"description": null,
"source_ip": null,
"requests_per_window": 1000,
"window_size_seconds": 60,
"action": "block",
"status": "active",
"priority": 0,
"created_at": "2026-05-10T13:00:00Z",
"updated_at": "2026-05-10T13:00:00Z"
}