List Rate Limit Rules
List the rate-limit rules the calling user has defined on their endpoints. Each rule caps the request rate against a single endpoint over a sliding window, gated by an optional list of conditions (post-#172, the same vocabulary as firewall policies). Distinct from traffic-policy rate limits: those attach inside a traffic policy and run inline with the request chain.
Query parameters
endpoint_id int | string (uuid)
Filter to one endpoint. Accepts the endpoint UUID (preferred) or the numeric DB ID.
status string
active, inactive, or disabled.page, limit int
Standard pagination.
page defaults to 1; limit (alias page_size) defaults to the server's configured page size and is capped at the server max.search string
Substring match against rule name (alias
q).Response (200 OK)
A JSON object. The rules are under rules; the object also carries pagination ({page, limit, total, totalPages}), an endpoints array + endpointByID / domainByID maps (to populate dashboard dropdowns), defaultDomain, and an optional posture summary. Each rule in rules:
id int
Rule ID.
endpoint_id int
The endpoint this rule applies to. Rate-limit rules are always per-endpoint.
name, description string
Free-form metadata.
conditions array
Match conditions (post-#172) joined by AND/OR. Each:
{id, rule_id, condition_type, operator, condition_value, logical_operator, created_at}. Same vocabulary as firewall policies (source_ip, country, asn, browser, user_agent, endpoint, path, method, header, cookie, protocol, port). A rule with zero conditions matches every request to its endpoint.source_ip string? Deprecated
Legacy pre-#172 single-IP filter, kept for read-back compat. New rules express IP filters as a
source_ip condition instead. null, empty, or * meant "all client IPs".requests_per_window int
Max requests allowed before the action triggers.
window_size_seconds int
Sliding window length in seconds.
action string
What to do once the limit is hit:
block (return 429) or throttle (delay subsequent requests).status string
active, inactive, or disabled. Only active rules are evaluated by the tunnel-server.priority int
Lower numbers evaluated first.
hit_count, last_matched, hits_daily int / datetime? / int[]
Traffic-log match stats over the last 7 days (best-effort).
last_matched is null if never matched in-window.shadowed, shadow_reason boolean / string
Set when an earlier rule on the same endpoint already covers this rule's match scope.
created_at, updated_at datetime
RFC 3339 UTC.
Errors
401 Unauthorized
Missing auth.
Request
curl "https://api.ngris.com/v1/firewall/rate-limits?endpoint_id=42&status=active" \
-H "X-API-KEY: <your_api_key>"
Python
from ngris import Ngris
client = Ngris(api_key="<your_api_key>")
for rl in client.firewall.list_rate_limits(endpoint_id=42):
src = rl.get("source_ip") or "any"
print(f"{rl['name']}: {rl['requests_per_window']}/{rl['window_size_seconds']}s from {src} → {rl['action']}")
Response — 200 OK
{
"rules": [
{
"id": 1,
"endpoint_id": 42,
"user_id": 7,
"name": "anti-abuse",
"description": "Cap each client to 1000 req/min",
"source_ip": null,
"requests_per_window": 1000,
"window_size_seconds": 60,
"action": "block",
"status": "active",
"priority": 100,
"conditions": [],
"hit_count": 12,
"created_at": "2026-04-01T00:00:00Z",
"updated_at": "2026-04-01T00:00:00Z"
}
],
"pagination": {"page": 1, "limit": 25, "total": 1, "totalPages": 1},
"endpoints": [],
"defaultDomain": "ngris.dev"
}