---
title: "Apply a reviewed Shield profile and CRS exclusions"
method: POST
path: "/platform/deployments/{id}/shield"
tags: ["Platform"]
---

# Apply a reviewed Shield profile and CRS exclusions

`POST /platform/deployments/{id}/shield`

## Request

- Base URL: `https://api.imprezahost.com/v1`
- URL: `https://api.imprezahost.com/v1/platform/deployments/{id}/shield`
- Auth: API key in header `X-API-Key` and API key in header `X-API-Secret`

Requires manage scope and current ownership. The portal additionally
requires a manager and WHMCS CSRF. Calls the shared Shield entitlement seam.
At most 20 exclusions from the embedded CRS; no arbitrary SecLang directives.
Changed exclusions must first be applied in audit, otherwise
AUDIT_REVIEW_REQUIRED is returned. Enforce requires confirm_enforce: true.
A stale base_revision returns REVISION_CONFLICT (409). Writes queue routes;
acceptance does not establish application or completion. An older agent
receives the existing profile/mode protocol and cannot receive exclusions.

## Request body

- object
  - `shield_profile` 'off' | 'standard' | 'hardened' | 'max', required
  - `shield_mode` 'audit' | 'enforce'
  - `base_revision` integer: Required for every v2 write and whenever exclusions or controls are supplied. Use the revision just reviewed.
  - `exclusions` ShieldExclusion[]
    - `rule_id` integer, required: Exact ID of a detection rule from the embedded OWASP CRS 4.25.0. Control rules, such as the anomaly score evaluation and the setup checks, are refused.
    - `path_prefix` string: Optional decoded, normalized app path prefix; omit for a global exclusion.
  - `confirm_enforce` boolean: Must be the Boolean true for enforce, only on hardened/max.
  - `controls` ShieldControls: Patch Shield controls. Requires shield-v2-controls and base_revision. Omitted fields keep their settings; null limits restore profile defaults. Empty pow_paths protects every path on hardened/max. Trusted clearnet peers bypass PoW and rate limits, never the WAF. Attack mode restores the base settings locally at its absolute deadline, even without the control plane. Requires agent 0.6.27 or later.
    - `pow_paths` string[]: Text prefixes of decoded or normalized request paths; /api also matches /apiary. Prefer a trailing slash for a path subtree.
    - `rate_limit_rpm` integer, nullable
    - `pow_difficulty` integer, nullable
    - `trusted_sources` string[]: Canonical network CIDRs, IPv4 /16-/32 or IPv6 /48-/128. No host bits or mapped IPv6. Real transport peer only; never Forwarded headers or onion routes. Private customer configuration, excluded from audit logs.
    - `under_attack` union: Enable PoW everywhere at difficulty at least 4 for 1-24 hours, or disable early. WAF mode stays as requested; attack mode never enables enforce automatically. Trusted peers remain exempt from PoW.
      - object
        - `enabled` true, required
        - `duration_hours` integer, required
      - object
        - `enabled` false, required

## Response `202`

Accepted route command and shield_revision

## Other responses

- `400`: Invalid policy
- `403`: Missing scope
- `404`: Resource not found
- `409`: Revision conflict or deployment unavailable for a route change

---

[API](https://skmtc.dev/imprezahost/apis/impreza-host-public-api.md) · [All operations](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/imprezahost/apis/impreza-host-public-api/revisions/db86511f604f?raw)