---
title: "Deployment protection: password (HTTP basic auth) and IP allow-list"
method: GET
path: "/projects/{projectId}/protection"
tags: ["Edge rules"]
---

# Deployment protection: password (HTTP basic auth) and IP allow-list

`GET /projects/{projectId}/protection`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/projects/{projectId}/protection`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `projectId` string, uuid, required

## Response `200`

Protection settings

- object
  - `projectId` string, uuid, required
  - `password` object, required
    - `enabled` boolean, required
    - `scope` 'all' | 'preview' | 'production', required: which deployments the password covers
    - `username` string, nullable, required
  - `ipAllowlist` object, required
    - `enabled` boolean, required
    - `cidrs` string[], required
  - `hostScope` 'all' | 'all_except_custom_domains' | 'default_and_previews': all: every domain; all_except_custom_domains / default_and_previews: only the project's default hostnames (custom domains stay open)
  - `previews` object
    - `enabled` boolean, required
  - `bypass` object
    - `count` integer, required
    - `fingerprints` string[], required: first 12 hex characters of each secret's SHA-256
  - `optionsAllowlist` object
    - `paths` string[], required
  - `engine` object, required
    - `status` 'applied' | 'pending_deploy' | 'not_configured' | 'error', required
    - `message` string, nullable, required
    - `appliedAt` string, nullable, required: ISO-8601 timestamp
  - `updatedAt` string, nullable, required: ISO-8601 timestamp

## Other responses

- `400`: Invalid request, e.g. a bad CIDR/header/redirect pattern, or 307/308 on a redirect rule (code invalid_request)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Authenticated but not permitted (code forbidden)
- `404`: Not found or not visible to the caller (code not_found)

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)