Undo the removal of an address from a Cloud Defender domain's list
curl --request POST \
--url https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore \
--header 'X-Aegister-Token: <api-key>'import requests
url = "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore"
headers = {"X-Aegister-Token": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Aegister-Token': '<api-key>'}};
fetch('https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Aegister-Token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Aegister-Token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore")
.header("X-Aegister-Token", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Aegister-Token"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"error": 0,
"messages": [],
"data": {
"id": 41,
"net": "203.0.113.7",
"action": "block",
"source": "manual",
"reason": "Scanning our login page",
"expires_at": "2026-11-27T09:30:00Z",
"created_at": "2026-10-28T09:30:00Z",
"created_by": "00000000-0000-4000-8000-000000000000",
"event_id": 1520
}
}{
"error": 1,
"messages": [
"Invalid data provided",
"net_listed",
"net_known_good"
]
}{
"error": 1,
"messages": []
}{
"error": 1,
"messages": []
}Protection lists
Undo the removal of a Cloud Defender address
Put back an address you unbanned or took off the Whitelist, within 10 minutes of “Unban or remove an IP”. The entry comes back as it was; a ban set from a detection brings its ban verdict back too. It answers 400 after 10 minutes, once a ban’s time is up, when the address is on the other list again, or when the address could not be listed today. 503 means the threat feed that checks addresses could not be read: try again. Owners and security officers with a live licence.
POST
/
api
/
v1
/
cloud-defender
/
{id}
/
ip-rules
/
{rule_id}
/
restore
Undo the removal of an address from a Cloud Defender domain's list
curl --request POST \
--url https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore \
--header 'X-Aegister-Token: <api-key>'import requests
url = "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore"
headers = {"X-Aegister-Token": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Aegister-Token': '<api-key>'}};
fetch('https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Aegister-Token: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Aegister-Token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore")
.header("X-Aegister-Token", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://app.aegister.com/api/v1/cloud-defender/{id}/ip-rules/{rule_id}/restore")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Aegister-Token"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"error": 0,
"messages": [],
"data": {
"id": 41,
"net": "203.0.113.7",
"action": "block",
"source": "manual",
"reason": "Scanning our login page",
"expires_at": "2026-11-27T09:30:00Z",
"created_at": "2026-10-28T09:30:00Z",
"created_by": "00000000-0000-4000-8000-000000000000",
"event_id": 1520
}
}{
"error": 1,
"messages": [
"Invalid data provided",
"net_listed",
"net_known_good"
]
}{
"error": 1,
"messages": []
}{
"error": 1,
"messages": []
}
