Update Rate Limit Rule
Edit a rate-limit rule. This is a full-record PUT, not a patch: name is always required, and any field you omit reverts to its zero value / default (e.g. an omitted action coerces to block, an omitted requests_per_window resets to 100, omitted conditions clears them). Send the complete intended state.
Counters in Redis aren't reset by changes — bumping requests_per_window from 100 to 200 means clients currently throttled (counter ≥ 100) stay throttled until the window rolls. To reset, delete and recreate.
Changes are pushed to the edges when you save and take effect within seconds. Each edge's cached copy also expires on its own after about a minute, which only matters if a change notice is lost.
Path parameters
uuid from /firewall/rate-limits.Deprecated: the legacy integer id is still accepted in the path until the sunset, answered with Deprecation and Sunset headers. Use the uuid.
Request body
The mutable fields are name (required), description, conditions, requests_per_window, window_size_seconds, action, status, and priority. Conditions use the same vocabulary as firewall policies (source_ip, country, asn, browser, user_agent, endpoint, path, method, header, cookie, protocol, port) and fully replace the rule's existing conditions — send the complete set every time (an empty/omitted array clears them). The legacy single-IP source_ip field is still accepted and auto-promoted to a source_ip condition.
The endpoint is fixed at creation — the rule's original endpoint is always preserved, so it cannot be changed via update. Unknown JSON fields (including endpoint_uuid) are rejected with 400.
Response (200 OK)
The rule as stored, read back after the write (full record, with uuid, endpoint_uuid, user_uuid, account_uuid, its real created_at / updated_at), with the conditions it now has as saved (omitted when none). description and the legacy source_ip are omitted when unset. Its match statistics are the ones its list row shows, over the same 7-day window: hit_count, and last_matched / hits_daily (both omitted when the rule hasn't matched in the window).
Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
source_ip, unknown JSON field, or an integer id after the sunset (integer_id_unsupported).custom_rate_limits.Rate limit rule not found).