---
title: "Get es-python's web protection settings"
method: GET
path: "/api/web_protection/"
tags: ["Filters, rules and taint"]
---

# Get es-python's web protection settings

`GET /api/web_protection/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/web_protection/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Returns the web protection settings stored in one scope (machine query param = a machine public_id, '' or absent = your account) and the values that apply where a setting is not stored there: the defaults for the account, the account's values for a machine. Keys: client (header or ip), client_header (a header name), client_proxies (1-16), request_context (on/off), rate (on/off), rate.limit (1-1000000 requests), rate.window (1-86400 seconds), rate.action (block or report), block (on/off: refuse the addresses on your blocked clients list), check.smuggling, check.reflect, check.redirect, check.host, check.cards, check.headers (on/off), hosts (your host names, comma separated, for check.host), routes (on/off: keep the route inventory), and, on the account only, autoblock (off, attacks or severe) and autoblock.hours (1-720). A stored value of "" means not set in this scope. can_block is false when your plan has no Raise: blocking settings then cannot be saved, and inherited values show them downgraded to report-only.

This is a **read**: a read-only API key may call it.

## Query parameters

- `machine` string

## Response `200`

OK. For example:

```
{
  "settings": {"rate": "on", "rate.limit": "", "client_header": "X-Real-IP", …one entry for every key},
  "inherited": {"rate": "off", "rate.limit": "100", "client_header": "X-Forwarded-For", …},
  "can_block": true
}
```

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)