Update Ratelimits Firewall

Update Rate Limit Rule

PUT /v1/firewall/rate-limits/{id}

Edit a rate-limit rule. This is a full-record PUT, not a patch: name is always required, and any field you omit reverts to its zero value / default (e.g. an omitted action coerces to block, an omitted requests_per_window resets to 100, omitted conditions clears them). Send the complete intended state.

Counters in Redis aren't reset by changes — bumping requests_per_window from 100 to 200 means clients currently throttled (counter ≥ 100) stay throttled until the window rolls. To reset, delete and recreate.

Changes propagate to every tunnel-server within ~30 seconds (the rule-cache reload interval).

Path parameters

id int Req

Rule ID.

Request body

The mutable fields are name (required), description, conditions, requests_per_window, window_size_seconds, action, status, and priority. Conditions use the same vocabulary as firewall policies (source_ip, country, asn, browser, user_agent, endpoint, path, method, header, cookie, protocol, port) and fully replace the rule's existing conditions — send the complete set every time (an empty/omitted array clears them). The legacy single-IP source_ip field is still accepted and auto-promoted to a source_ip condition.

The endpoint is fixed at creation — the original endpoint_id is always preserved, so it cannot be changed via update. Unknown JSON fields (including endpoint_uuid) are rejected with 400.

Response (200 OK)

Updated rule (full record).

Errors

400 Bad Request

Invalid field value, malformed source_ip, or unknown JSON field.

401 Unauthorized

Missing auth.

403 Forbidden

Plan doesn't include custom_rate_limits.

404 Not Found

Rule doesn't exist or doesn't belong to the calling user.

Request — bump cap
curl -X PUT "https://api.ngris.com/v1/firewall/rate-limits/1" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "anti-abuse",
    "requests_per_window": 2000,
    "window_size_seconds": 60
  }'

Request — switch to throttle for one /24
curl -X PUT "https://api.ngris.com/v1/firewall/rate-limits/1" \
  -H "X-API-KEY: <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "scrape-defense",
    "source_ip": "203.0.113.0/24",
    "action": "throttle"
  }'

Python
from ngris import Ngris

client = Ngris(api_key="<your_api_key>")
client.firewall.update_rate_limit(1, {
    "name": "anti-abuse",
    "requests_per_window": 2000,
    "window_size_seconds": 60,
})

Response — 200 OK
{
  "id": 1,
  "endpoint_id": 42,
  "user_id": 7,
  "name": "anti-abuse",
  "source_ip": null,
  "requests_per_window": 2000,
  "window_size_seconds": 60,
  "action": "block",
  "status": "active",
  "priority": 100,
  "updated_at": "2026-05-10T13:05:00Z"
}

PreviousCreate Rate Limit NextDelete Rate Limit

On this page

Update Rate Limit Rule