# TinoWAF

Website firewall: add websites, protection level, emergency anti-attack mode, domain names and DNS records, origin servers, event log, IP block/allow list.

Every route is called through the gateway `https://api.tino.vn/v1` with `Authorization: Bearer <token>`; see [Calling the Tino API](/en/docs/api).

## TinoWAF

| Method | Path | Name | Scope |
| --- | --- | --- | --- |
| `GET` | `/v1/service/@id/waf/events` | [Event summary](/en/docs/api/get-service-id-waf-events) | `waf:read` |
| `GET` | `/v1/service/@id/waf/ip-rules` | [List IP rules](/en/docs/api/get-service-id-waf-ip-rules) | `waf:read` |
| `POST` | `/v1/service/@id/waf/ip-rules` | [Block or allow an IP](/en/docs/api/post-service-id-waf-ip-rules) | `waf:write` |
| `DELETE` | `/v1/service/@id/waf/ip-rules/@rule` | [Delete an IP rule](/en/docs/api/delete-service-id-waf-ip-rules-rule) | `waf:write` |
| `POST` | `/v1/service/@id/waf/ip-rules/apply` | [Re-apply IP rules](/en/docs/api/post-service-id-waf-ip-rules-apply) | `waf:write` |
| `GET` | `/v1/service/@id/waf/overview` | [TinoWAF overview](/en/docs/api/get-service-id-waf-overview) | `waf:read` |
| `GET` | `/v1/service/@id/waf/zones` | [List websites](/en/docs/api/get-service-id-waf-zones) | `waf:read` |
| `POST` | `/v1/service/@id/waf/zones` | [Add a website](/en/docs/api/post-service-id-waf-zones) | `waf:write` |
| `GET` | `/v1/service/@id/waf/zones/@zone` | [Get a website](/en/docs/api/get-service-id-waf-zones-zone) | `waf:read` |
| `DELETE` | `/v1/service/@id/waf/zones/@zone` | [Delete a website](/en/docs/api/delete-service-id-waf-zones-zone) | `waf:write` |
| `POST` | `/v1/service/@id/waf/zones/@zone/check` | [Check DNS now](/en/docs/api/post-service-id-waf-zones-zone-check) | `waf:write` |
| `GET` | `/v1/service/@id/waf/zones/@zone/events` | [List a website's events](/en/docs/api/get-service-id-waf-zones-zone-events) | `waf:read` |
| `GET` | `/v1/service/@id/waf/zones/@zone/hostnames` | [List a website's domain names](/en/docs/api/get-service-id-waf-zones-zone-hostnames) | `waf:read` |
| `POST` | `/v1/service/@id/waf/zones/@zone/hostnames` | [Add a domain name to a website](/en/docs/api/post-service-id-waf-zones-zone-hostnames) | `waf:write` |
| `DELETE` | `/v1/service/@id/waf/zones/@zone/hostnames/@hostname` | [Remove a domain name from a website](/en/docs/api/delete-service-id-waf-zones-zone-hostnames-hostname) | `waf:write` |
| `GET` | `/v1/service/@id/waf/zones/@zone/origin` | [Get a website's origin servers](/en/docs/api/get-service-id-waf-zones-zone-origin) | `waf:read` |
| `PUT` | `/v1/service/@id/waf/zones/@zone/origin` | [Update origin servers](/en/docs/api/put-service-id-waf-zones-zone-origin) | `waf:write` |
| `PUT` | `/v1/service/@id/waf/zones/@zone/under-attack` | [Turn emergency anti-attack mode on or off](/en/docs/api/put-service-id-waf-zones-zone-under-attack) | `waf:write` |
| `PUT` | `/v1/service/@id/waf/zones/@zone/waf-mode` | [Change the protection level](/en/docs/api/put-service-id-waf-zones-zone-waf-mode) | `waf:write` |