---
title: "Review an application's Shield policy and WAF counters"
method: GET
path: "/platform/deployments/{id}/shield"
tags: ["Platform"]
---

# Review an application's Shield policy and WAF counters

`GET /platform/deployments/{id}/shield`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/platform/deployments/{id}/shield`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

Requires read scope and current ownership. Returns the same owner-filtered
review as impreza_get_shield and the Shield card: distinct would-block and
blocked requests for 24 hours, and five ranked static CRS detections.
One request can match multiple rules. Minute data is retained for 48 hours;
prior v1 traffic is not backfilled. No visitor identity is retained.
Available with agent 0.6.27+; counters and exclusions require
shield-v2 and its compatible proxy image. Existing servers require an explicit agent update.

## Response `200`

Current policy and audit review

- object
  - `success` boolean
  - `data` object
    - `shield` ShieldState
      - `deployment_id` string
      - `profile` 'off' | 'standard' | 'hardened' | 'max'
      - `mode` 'audit' | 'enforce'
      - `revision` integer
      - `exclusions` ShieldExclusion[]
        - `rule_id` integer, required: Exact ID of a detection rule from the embedded OWASP CRS 4.25.0. Control rules, such as the anomaly score evaluation and the setup checks, are refused.
        - `path_prefix` string: Optional decoded, normalized app path prefix; omit for a global exclusion.
      - `v2_supported` boolean
      - `required_capability` 'shield-v2'
      - `minimum_agent_version` '0.6.27': Requires agent 0.6.27 or later. Capability negotiation remains required.
      - `policy_updated_at` string, nullable
      - `audit_review` ShieldReview
        - `window_hours` 24
        - `would_block_requests` integer
        - `blocked_requests` integer
        - `top_rules` object[]
          - `rule_id` integer
          - `category` string
          - `description` string: Static English CRS metadata, never matched input.
          - `matches` integer
        - `note` string
      - `controls` ShieldControlsState
        - `pow_paths` string[]: Text prefixes of decoded or normalized request paths; /api also matches /apiary. Prefer a trailing slash for a path subtree.
        - `rate_limit_rpm` integer, nullable
        - `pow_difficulty` integer, nullable
        - `trusted_sources` string[]: Canonical network CIDRs, IPv4 /16-/32 or IPv6 /48-/128. No host bits or mapped IPv6. Real transport peer only; never Forwarded headers or onion routes. Private customer configuration, excluded from audit logs.
        - `attack_expires_at` integer: Absolute Unix deadline in UTC. 0 disables attack mode. Never extended by command retries.
      - `controls_supported` boolean
      - `controls_required_capability` 'shield-v2-controls'
      - `under_attack` object
        - `active` boolean
        - `expires_at` string, date-time, nullable
        - `remaining_seconds` integer
        - `difficulty` 4
  - `meta` Meta
    - `request_id` string
    - `timestamp` string, date-time

## Other responses

- `401`: Invalid or missing API credentials
- `404`: Resource not found

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)