> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbitelshield.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Protection changes

> Apply, sync, and manage prefixes and tunnels for protected services.

Use these endpoints to make live changes to a protected service's routing configuration. Every request is account-scoped and returns JSON. Changes are applied to the scrubbing network straight away, and each response includes a sync result. These endpoints require the `protection:write` scope. The supplied specification does not define the sync result's structure.

Requests require a valid bearer token and JSON bodies where applicable. See [Overview](https://docs.orbitelshield.com/api-reference/overview.md) for authentication and general conventions, and [Errors](https://docs.orbitelshield.com/api-reference/errors.md) for status and rate-limit details. This group shares the [Protection](https://docs.orbitelshield.com/api-reference/protection.md) and [Services and invoices](https://docs.orbitelshield.com/api-reference/services-invoices.md) context.

> [!WARNING]
>
> These endpoints perform live mutations. Adding or removing prefixes and tunnels affects production routing immediately. Confirm the service and resource IDs before sending a deletion request.

> [!NOTE]
>
> The addresses `198.51.100.0/24`, `192.0.2.10`, and `192.0.2.11` are documentation examples. Replace them with your authorized prefix and reachable router endpoint. Replace every path placeholder with its actual resource ID before sending a request.

## Base URL

```text theme={null}
https://portal.orbitelshield.com/api/v1/public
```

## Authentication

All requests must include the API key as a bearer token:

```bash theme={null}
-H "Authorization: Bearer $ORBITEL_API_KEY"
```

JSON request bodies must also set:

```bash theme={null}
-H "Content-Type: application/json"
```

***

## Push current configuration

Re-applies the current set of prefixes and tunnels for a service to the network.

```bash theme={null}
POST /protection/{serviceId}/sync
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |

### Request

No request body.

### Example

```bash theme={null}
curl -X POST "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/sync" \
  -H "Authorization: Bearer $ORBITEL_API_KEY"
```

***

## Add a prefix

Adds an authorized prefix to a protected service.

```bash theme={null}
POST /protection/{serviceId}/prefixes
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |

### Body parameters

| Parameter | Type | Description |
| - | - | - |
| `prefix` | string | CIDR block, for example `198.51.100.0/24` |
| `label` | string | Human-readable label |

### Example

```bash theme={null}
curl -X POST "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/prefixes" \
  -H "Authorization: Bearer $ORBITEL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prefix":"198.51.100.0/24","label":"Game servers"}'
```

***

## Remove a prefix

Removes a prefix from a protected service. This change takes effect immediately.

```bash theme={null}
DELETE /protection/{serviceId}/prefixes/{prefixId}
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |
| `prefixId` | string | 26-character prefix identifier |

### Example

```bash theme={null}
curl -X DELETE "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/prefixes/{prefixId}" \
  -H "Authorization: Bearer $ORBITEL_API_KEY"
```

***

## Create a tunnel

Creates a GRE tunnel to a router endpoint for a protected service.

```bash theme={null}
POST /protection/{serviceId}/tunnels
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |

### Body parameters

| Parameter | Type | Description |
| - | - | - |
| `label` | string | Human-readable label |
| `endpoint` | string | Router IP address |
| `prefixIds` | string\[] | Array of 26-character prefix identifiers |

### Example

```bash theme={null}
curl -X POST "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/tunnels" \
  -H "Authorization: Bearer $ORBITEL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Edge router","endpoint":"192.0.2.10","prefixIds":[]}'
```

> [!NOTE]
>
> The semantics of an empty `prefixIds` array are unspecified. Do not assume it means all prefixes or no prefixes.

***

## Update a tunnel

Updates an existing tunnel's label, endpoint, or associated prefixes.

```bash theme={null}
PUT /protection/{serviceId}/tunnels/{tunnelId}
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |
| `tunnelId` | string | 26-character tunnel identifier |

### Body parameters

| Parameter | Type | Description |
| - | - | - |
| `label` | string | Human-readable label |
| `endpoint` | string | Router IP address |
| `prefixIds` | string\[] | Array of 26-character prefix identifiers |

### Example

```bash theme={null}
curl -X PUT "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/tunnels/{tunnelId}" \
  -H "Authorization: Bearer $ORBITEL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"label":"Edge router","endpoint":"192.0.2.11","prefixIds":[]}'
```

> [!NOTE]
>
> The semantics of an empty `prefixIds` array are unspecified. Do not assume it means all prefixes or no prefixes.

***

## Delete a tunnel

Removes a tunnel from a protected service. This change takes effect immediately.

```bash theme={null}
DELETE /protection/{serviceId}/tunnels/{tunnelId}
```

### Path parameters

| Parameter | Type | Description |
| - | - | - |
| `serviceId` | string | 26-character service identifier |
| `tunnelId` | string | 26-character tunnel identifier |

### Example

```bash theme={null}
curl -X DELETE "https://portal.orbitelshield.com/api/v1/public/protection/{serviceId}/tunnels/{tunnelId}" \
  -H "Authorization: Bearer $ORBITEL_API_KEY"
```

***

## Rate limits

Each API key allows **120 requests per minute**, including at most **30 write requests** per minute. See [Errors](https://docs.orbitelshield.com/api-reference/errors.md) for rate-limit response details.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.