> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/using-link11/api/web-ddos.md).

# Web DDoS

{% hint style="info" %}
The information below assumes you have already the [Introduction to the Link11 API](/using-link11/api/introduction.md).
{% endhint %}

## Service Key definition

`apikey=link11`

## Domain Key definition <a href="#id-customerapi-webddos-webddoscommands" id="id-customerapi-webddos-webddoscommands"></a>

For the commands that include a Domain Key  (referred to below as $DOMAINKEY), use the [API Key for the instance from WebGUI](/product-guides/web-ddos/interface/api-access.md).

***

## API Commands <a href="#id-customerapi-webddos-webddoscommands" id="id-customerapi-webddos-webddoscommands"></a>

### **Get Statistics**

The Web DDoS Log API returns bandwidth information in the form of a byte count for a given time range, time interval, and domain. The returned statistics show combined inbound and outbound traffic for the given time interval, either between the Link11 proxies and the customer origin, or between the public internet and the Link11 proxies.

`https://api.link11.de/?apikey=link11&domainkey=[$DOMAINKEY]&get_stats&from=1633076968&to=1633150568&aggregate=86400&type=clientbytes`

| Parameter | Description                                                                                                                                                                                                                                                                                                                                               |
| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| from      | Unix timestamp in UTC determining the start time/date of the query                                                                                                                                                                                                                                                                                        |
| to        | Unix timestamp in UTC determining the end time/date of the query                                                                                                                                                                                                                                                                                          |
| aggregate | The "bucket" size for the returned records in seconds. Example: To return data in one-hour buckets, set the value to 3600 (seconds in an hour).                                                                                                                                                                                                           |
| type      | <p><code>clientbytes</code></p><ul><li>returns statistics between the requestor (client) and the Link11 proxies</li></ul><p><code>serverbytes</code></p><ul><li>returns statistics between the Link11 proxies and the customer origin</li></ul><p><code>total</code></p><ul><li>returns the combined statistics for clientbytes and serverbytes</li></ul> |

**Response:**

```
{
    "results":  2,
    "type":  "clientbytes",
    "time_to":  "2021-10-02 04:56:08",
    "time_from":  "2021-10-01 08:29:28",
    "data":  [
                 {
                     "value":  30720,
                     "date":  "2021-10-01 00:00:00"
                 },
                 {
                     "value":  2048,
                     "date":  "2021-10-02 00:00:00"
                 }
             ]
}
```

### **Get IP Whitelist**

Returns all whitelisted IP addresses for an instance

`https://api.link11.de/?apikey=link11&get_ip_whitelist`

**Response:**

```
{
    "value":  [
                  {
                      "ip":  "37.218.253.197/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "37.218.253.229/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "109.237.142.13/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "109.237.142.15/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "109.237.142.17/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "109.237.142.30/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  },
                  {
                      "ip":  "109.237.142.31/32",
                      "created":  "2020-08-14 05:07:53",
                      "comment":  "whitelist entries from wafc1"
                  }
              ],
    "Count":  7
}
```

### **Add IP Whitelist**

Adds single IP address (can also be written in CIDR notation) to whitelist

`https://api.link11.de/?apikey=link11&add_ip_whitelist=<IP>(,<CIDR>)`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Delete IP Whitelist**

Deletes an IP/Network from the whitelist

`https://api.link11.de/?apikey=link11&delete_ip_whitelist=<IP>(,<CIDR>)`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Get IP Blacklist**

Returns blacklisted IPs for instance

`https://api.link11.de/?apikey=link11&get_ip_blacklist`

**Response (in this case empty):**

```
[
{
"ip":"1.1.1.0\/30",
"created":"2019-10-11 12:45:02",
"comment":"API: test"
},
{
"ip":"5.7.5.0\/30",
"created":"2019-10-11 12:45:02",
"comment":"API: test"
}]
```

### **Add IP Blacklist**

Blacklists single IP for instance

`https://api.link11.de/?apikey=link11&add_ip_blacklist=<IP>(,<CIDR>)`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Delete IP Blacklist**

Deletes IP from instance

`https://api.link11.de/?apikey=link11&delete_ip_blacklist=<IP>(,<CIDR>)`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **IP Blocking at the Edge**

Link11 offers our WebDDoS clients protection from Layer 3 and Layer 4 attacks at no additional charge. This allows clients to also block IPs at the edge of the Link11 network via API.

| **Parameter** | **Example**            | **Explanation**                                                                                                                          |
| ------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| \[command]    | block\_ip, unblock\_ip | The command that will be executed with this API call                                                                                     |
| ip            | 50.34.106.211          | The client IP (source IP address) that should be blocked. Multiple IP addresses can be passed to this command as a comma separated list. |

**Possible Responses**

<table><thead><tr><th width="311">Entered URL</th><th>Response</th><th>Comments</th></tr></thead><tbody><tr><td><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;ip=foo</code><br><br><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;ip=foo</code></td><td>400 Invalid IP</td><td>The “ip” value of “foo” is not a valid IP.</td></tr><tr><td><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;ip=31.31.31.31</code><br><br><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;ip=31.31.31.31</code></td><td>200 Operation successful</td><td></td></tr><tr><td><p><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;ip=31.31.31.31,32.32.32.32</code><br></p><p><code>https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;ip=31.31.31.31,32.32.32.32</code></p></td><td>200 Operation successful</td><td></td></tr><tr><td><p><code>curl -s -X POST "https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;block_ip" -d "ip[]=31.31.31.31" -d "ip[]=32.32.32.32"</code><br></p><p><code>curl -s -X POST "https://api.link11.de/?apikey=link11&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip" -d "ip[]=31.31.31.31" -d "ip[]=32.32.32.32"</code></p></td><td>200 Operation successful</td><td>This endpoint supports both GET and POST commands.</td></tr></tbody></table>

### **Add GeoIP**

Adds a Country to Geo IP block list in accordance with [ISO 3166-1 Country Codes](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)

`https://api.link11.de/?apikey=link11&add_geoip=<country_code>`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Delete GeoIP**

Removes a Country from Geo IP block list in accordance with [ISO 3166-1 Country Codes](https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes)

`https://api.link11.de/?apikey=link11&delete_geoip=<country_code>`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 11:59:58 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Get Origin**

Gets origin for a Web DDoS instance

`https://api.link11.de/?apikey=link11&get_origin`

**Response:**

```
"stickyip:88.99.151.164/10,138.201.250.149/10,94.130.15.218/10"
```

### **Set Origin**

Sets origin for Web DDoS instance, DNS record

`https://api.link11.de/?apikey=link11&set_origin=<origin>`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Set Origin Loadbalancer**&#x20;

Sets Load Balancing configuration for origin. See syntax example in "Get Origin" response above.

`https://api.link11.de/?apikey=link11&set_origin=<LB-configuration>`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Set Attack Mode**

Sets Attack Mode for an Instance

`https://api.link11.de/?apikey=link11&set_attack_mode`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Delete Attack Mode**

Stops Attack Mode for Instance

`https://api.link11.de/?apikey=link11&delete_attack_mode`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Enable Maintenance Mode**

To enable maintenance mode for your service, make a `GET` request to the following endpoint:

`https://api.link11.de/?apikey=link11&enable_maintenance`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```

### **Disable Maintenance Mode**

To disable maintenance mode and resume normal operations, make a `GET` request to the following endpoint:

`https://api.link11.de/?apikey=link11&disable_maintenance`

**Response:**

```
HTTP/2 200
server: nginx/1.16.0
date: Thu, 07 Nov 2019 12:21:11 GMT
content-type: text/html; charset=UTF-8

200 Operation successful
```