openapi: 3.0.3
info:
  title: Wallarm Applications IP Lists API
  description: The Wallarm API provides programmatic access to the Wallarm API Security Platform. It enables management of attacks, incidents, vulnerabilities, security rules, IP lists, filter nodes, users, integrations, and triggers. The API is available on both US Cloud and EU Cloud endpoints and uses API token authentication.
  version: 4.0.0
  termsOfService: https://www.wallarm.com/terms-of-service
  contact:
    name: Wallarm Support
    url: https://docs.wallarm.com/
    email: support@wallarm.com
  license:
    name: Proprietary
    url: https://www.wallarm.com/terms-of-service
servers:
- url: https://us1.api.wallarm.com
  description: Wallarm US Cloud API
- url: https://api.wallarm.com
  description: Wallarm EU Cloud API
security:
- ApiTokenAuth: []
tags:
- name: IP Lists
  description: IP allowlist, denylist, and graylist management
paths:
  /v4/ip_rules:
    get:
      operationId: listIpRules
      summary: List IP Rules
      description: Retrieve the contents of IP lists (allowlist, denylist, graylist). Returns up to 300 items per request. Use offset parameter for pagination.
      tags:
      - IP Lists
      parameters:
      - name: clientid
        in: query
        required: true
        schema:
          type: integer
        description: Client ID
      - name: list
        in: query
        required: false
        schema:
          type: string
          enum:
          - allowlist
          - denylist
          - graylist
        description: Filter by list type
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          default: 300
          maximum: 300
        description: Number of items to return
      - name: offset
        in: query
        required: false
        schema:
          type: integer
          default: 0
        description: Pagination offset
      responses:
        '200':
          description: IP rules returned successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpRuleListResponse'
        '401':
          description: Unauthorized
    post:
      operationId: addIpRule
      summary: Add IP Rule
      description: Add an IP address, subnet, country, or proxy service to an IP list (allowlist, denylist, or graylist).
      tags:
      - IP Lists
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateIpRuleRequest'
      responses:
        '200':
          description: IP rule added successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpRuleResponse'
        '400':
          description: Invalid request
        '401':
          description: Unauthorized
    delete:
      operationId: deleteIpRule
      summary: Delete IP Rule
      description: Remove an IP rule from an IP list by its ID.
      tags:
      - IP Lists
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteIpRuleRequest'
      responses:
        '200':
          description: IP rule deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: IP rule not found
components:
  schemas:
    IpRuleResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          $ref: '#/components/schemas/IpRule'
    DeleteIpRuleRequest:
      type: object
      required:
      - id
      - clientid
      properties:
        id:
          type: integer
          description: IP rule ID to delete
        clientid:
          type: integer
          description: Client ID
    IpRuleListResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          type: array
          items:
            $ref: '#/components/schemas/IpRule'
    CreateIpRuleRequest:
      type: object
      required:
      - rule_type
      - pools
      - clientid
      properties:
        clientid:
          type: integer
          description: Client ID
        rule_type:
          type: string
          enum:
          - ip_range
          - country
          - proxy_type
          description: Type of IP rule to create
        subnet:
          type: string
          description: IP address or CIDR notation (for ip_range)
        source_values:
          type: array
          items:
            type: string
          description: Country codes (ISO 3166) or proxy types
        pools:
          type: array
          items:
            type: string
            enum:
            - allowlist
            - denylist
            - graylist
          description: Target IP list(s)
        expired_at:
          type: integer
          description: Unix timestamp when rule expires
    IpRule:
      type: object
      properties:
        id:
          type: integer
          description: IP rule identifier
        rule_type:
          type: string
          enum:
          - ip_range
          - country
          - proxy_type
          description: Type of IP rule
        list:
          type: string
          enum:
          - allowlist
          - denylist
          - graylist
          description: Which IP list this rule belongs to
        subnet:
          type: string
          description: IP address or CIDR subnet (for ip_range type)
        country_iso:
          type: string
          description: ISO 3166 country code (for country type)
        source:
          type: string
          description: Proxy/threat type (for proxy_type)
        expired_at:
          type: integer
          description: Unix timestamp when rule expires (null = permanent)
        created_at:
          type: integer
          description: Unix timestamp of creation
  securitySchemes:
    ApiTokenAuth:
      type: apiKey
      in: header
      name: X-WallarmApi-Token
      description: API token obtained from Wallarm Console under Settings → API Tokens.