# Security › Anti-DDoS › Configuration API

> Part of the OVHcloud developer hub. Index of every page and section: https://developers.eu.ovhcloud.com/llms.txt
> The Security product's sections: https://developers.eu.ovhcloud.com/reference/security/llms.txt
> Everything in one file: https://developers.eu.ovhcloud.com/llms-full.txt

> 5 operations of the OVHcloud API. Calls carry `authorization: Bearer $OVH_TOKEN`; the EU host is shown, Canada and the United States answer on api.ca.ovhcloud.com and api.us.ovhcloud.com.

Page: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/

OpenAPI v1: https://api.eu.ovhcloud.com/1.0/__schemas/developer-hub-navigation/security/anti-ddos/configuration.json?format=openapi3
OpenAPI v2: https://api.eu.ovhcloud.com/v2/__schemas/developer-hub-navigation/security/anti-ddos/configuration.json?format=openapi3

## Operations

- `GET /networkDefense/vac/resource/{resourceName}/policy` — List VAC policies
- `GET /networkDefense/vac/resource/{resourceName}/policy/{policyId}` — Get a VAC policy
- `POST /networkDefense/vac/resource/{resourceName}/policy` — Create a VAC policy
- `PUT /networkDefense/vac/resource/{resourceName}/policy/{policyId}` — Update a VAC policy
- `DELETE /networkDefense/vac/resource/{resourceName}/policy/{policyId}` — Delete a VAC policy

## List VAC policies

`GET /v2/networkDefense/vac/resource/{resourceName}/policy`

Link: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/#get-networkdefense-vac-resource-resourcename-policy

**Status:** Stable production version  
**IAM actions:** `vac:apiovh:resource/policy/get`

Returns the list of policies within a VAC DDoS protection resource. Every policy applies a profile and a sensitivity level to target IP address prefixes, and carries the configuration requested and the one currently enforced.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Pagination-Cursor` | header | string |  | Pagination cursor |
| `X-Pagination-Size` | header | integer |  | Pagination size |
| `iamTags` | query | object |  | Filter resources on IAM tags |
| `resourceName` | path | string (uuid) | yes | Resource name |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | networkDefense.Vac.PolicyAsyncResourceWithIAM[] | successful operation |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change. |
| `createdAt` | string (date-time) | read-only | Date and time the policy was created |
| `currentState` | networkDefense.Vac.PolicyState | read-only | Configuration currently being enforced. Null while the policy is still being created (CREATING). |
| `currentState.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `currentState.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `currentState.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `currentState.profileVersion` | integer | read-only | Version of the enforced configuration, increased each time a change is applied |
| `currentState.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `currentState.serviceId` | string (uuid) | read-only | Identifier of the VAC resource this policy belongs to |
| `currentState.targets` | networkDefense.Vac.TargetState[] | read-only | The targets currently held by the policy, each with the status of every prefix it protects. Also includes the targets removed from the configuration that are still being taken down, so it can list more targets than the configuration does. |
| `currentState.targets[].id` | string (uuid) | read-only | Read-only target identifier. It is not part of the policy configuration: a target is declared by its value. |
| `currentState.targets[].prefix` | networkDefense.Vac.PrefixDefinition | read-only | The IP range, set when the target type is PREFIX |
| `currentState.targets[].resolved` | networkDefense.Vac.ResolvedPrefix[] | read-only | The IP prefixes this target currently protects, each with its status. A PREFIX target always has exactly one entry. |
| `currentState.targets[].type` | networkDefense.Vac.TargetTypeEnum | read-only | Type of target, which determines which definition field is set — one of `PREFIX` |
| `errorMessage` | string | read-only | Details of the last error, set when the status is ERROR |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Unique identifier of the policy |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Current status of the policy — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | networkDefense.Vac.PolicySpec | read-only | Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. |
| `targetSpec.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `targetSpec.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] | read-only | The complete set of targets the policy protects, excluding the ones being removed. Only the PREFIX type is available today. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |
| `updatedAt` | string (date-time) | read-only | Date and time the policy was last updated |

```json
[
  {
    "checksum": "string",
    "createdAt": "2024-01-01T12:00:00Z",
    "currentState": {
      "enabled": true,
      "name": "string",
      "profileId": "string",
      "profileVersion": 0,
      "sensitivity": "HIGH",
      "serviceId": "00000000-0000-0000-0000-000000000000",
      "targets": [
        {
          "id": "00000000-0000-0000-0000-000000000000",
          "prefix": {
            "cidr": "192.0.2.0/24"
          },
          "resolved": [
            {
              "cidr": null,
              "status": null
            }
          ],
          "type": "PREFIX"
        }
      ]
    },
    "errorMessage": "string",
    "iam": {
      "displayName": "string",
      "id": "00000000-0000-0000-0000-000000000000",
      "state": "EXPIRED",
      "tags": {
        "key": "string"
      },
      "urn": "string"
    },
    "id": "00000000-0000-0000-0000-000000000000",
    "resourceStatus": "CREATING",
    "targetSpec": {
      "enabled": true,
      "name": "string",
      "profileId": "string",
      "sensitivity": "HIGH",
      "targets": [
        {
          "prefix": {
            "cidr": "192.0.2.0/24"
          }
        }
      ]
    },
    "updatedAt": "2024-01-01T12:00:00Z"
  }
]
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/networkDefense/vac/resource/{resourceName}/policy" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/networkDefense/vac/resource/{resourceName}/policy")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/networkDefense/vac/resource/{resourceName}/policy");

print_r($result);
?>
```

## Get a VAC policy

`GET /v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}`

Link: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/#get-networkdefense-vac-resource-resourcename-policy-policyid

**Status:** Stable production version  
**IAM actions:** `vac:apiovh:resource/policy/get`

Returns a policy with the configuration requested and the one currently enforced, including the status of every protected IP address prefix.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `policyId` | path | string (uuid) | yes | Policy ID |
| `resourceName` | path | string (uuid) | yes | Resource name |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | networkDefense.Vac.PolicyAsyncResourceWithIAM | successful operation |
| 404 | object | Error 404 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change. |
| `createdAt` | string (date-time) | read-only | Date and time the policy was created |
| `currentState` | networkDefense.Vac.PolicyState | read-only | Configuration currently being enforced. Null while the policy is still being created (CREATING). |
| `currentState.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `currentState.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `currentState.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `currentState.profileVersion` | integer | read-only | Version of the enforced configuration, increased each time a change is applied |
| `currentState.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `currentState.serviceId` | string (uuid) | read-only | Identifier of the VAC resource this policy belongs to |
| `currentState.targets` | networkDefense.Vac.TargetState[] | read-only | The targets currently held by the policy, each with the status of every prefix it protects. Also includes the targets removed from the configuration that are still being taken down, so it can list more targets than the configuration does. |
| `currentState.targets[].id` | string (uuid) | read-only | Read-only target identifier. It is not part of the policy configuration: a target is declared by its value. |
| `currentState.targets[].prefix` | networkDefense.Vac.PrefixDefinition | read-only | The IP range, set when the target type is PREFIX |
| `currentState.targets[].resolved` | networkDefense.Vac.ResolvedPrefix[] | read-only | The IP prefixes this target currently protects, each with its status. A PREFIX target always has exactly one entry. |
| `currentState.targets[].type` | networkDefense.Vac.TargetTypeEnum | read-only | Type of target, which determines which definition field is set — one of `PREFIX` |
| `errorMessage` | string | read-only | Details of the last error, set when the status is ERROR |
| `iam` | iam.ResourceMetadata | read-only | IAM resource metadata |
| `iam.displayName` | string | read-only | Resource display name |
| `iam.id` | string (uuid) | read-only | Unique identifier of the resource |
| `iam.state` | iam.ResourceMetadata.StateEnum | read-only | Resource state — one of `EXPIRED`, `IN_CREATION`, `OK`, `SUSPENDED` |
| `iam.tags` | object | read-only | Resource tags. Tags that were internally computed are prefixed with ovh: |
| `iam.urn` | string | read-only | Unique resource name used in policies |
| `id` | string (uuid) | read-only | Unique identifier of the policy |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Current status of the policy — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | networkDefense.Vac.PolicySpec | read-only | Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. |
| `targetSpec.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `targetSpec.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] | read-only | The complete set of targets the policy protects, excluding the ones being removed. Only the PREFIX type is available today. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |
| `updatedAt` | string (date-time) | read-only | Date and time the policy was last updated |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "profileVersion": 0,
    "sensitivity": "HIGH",
    "serviceId": "00000000-0000-0000-0000-000000000000",
    "targets": [
      {
        "id": "00000000-0000-0000-0000-000000000000",
        "prefix": {
          "cidr": "192.0.2.0/24"
        },
        "resolved": [
          {
            "cidr": "192.0.2.0/24",
            "status": "ACTIVE"
          }
        ],
        "type": "PREFIX"
      }
    ]
  },
  "errorMessage": "string",
  "iam": {
    "displayName": "string",
    "id": "00000000-0000-0000-0000-000000000000",
    "state": "EXPIRED",
    "tags": {
      "key": "string"
    },
    "urn": "string"
  },
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  },
  "updatedAt": "2024-01-01T12:00:00Z"
}
```

### Example

```bash
curl -X GET \
  "https://api.eu.ovhcloud.com/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.get("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->get("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}");

print_r($result);
?>
```

## Create a VAC policy

`POST /v2/networkDefense/vac/resource/{resourceName}/policy`

Link: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/#post-networkdefense-vac-resource-resourcename-policy

**Status:** Stable production version  
**IAM actions:** `vac:apiovh:resource/policy/create`, `ip:apiovh:networkDefense/vac/protect`

Creates a policy within a VAC DDoS protection resource, applying a profile and a sensitivity level to target IP address prefixes in order to tune detection and mitigation rules. Async call, follow resourceStatus for operation progress. A target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `force` | query | boolean |  | Overwrite the protection settings that were not set via a policy on the targets this request adds. Without it, such a request is refused. The previous settings are lost: you cannot restore them yourself. The `force` flag is not stored in the policy spec. |
| `resourceName` | path | string (uuid) | yes | Resource name |

### Request body (required)

Type: `networkDefense.Vac.PolicyAsyncAdd`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `targetSpec` | networkDefense.Vac.PolicySpecInput | yes | Protection configuration to apply to the policy |
| `targetSpec.enabled` | boolean |  | Whether the policy is active. Defaults to true. |
| `targetSpec.name` | string | yes | Name for the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | yes | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | yes | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] |  | The complete set of targets to protect. Every write fully replaces the previous set: omitting this field or sending an empty list removes every target. At most 1000 entries. Changing only the targets is always accepted, even while another change is still being applied. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |

```json
{
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  }
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | networkDefense.Vac.PolicyAsyncResource | successful operation |
| 400 | object | Error 400 response |
| 403 | object | Error 403 response |
| 404 | object | Error 404 response |
| 409 | object | Error 409 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change. |
| `createdAt` | string (date-time) | read-only | Date and time the policy was created |
| `currentState` | networkDefense.Vac.PolicyState | read-only | Configuration currently being enforced. Null while the policy is still being created (CREATING). |
| `currentState.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `currentState.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `currentState.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `currentState.profileVersion` | integer | read-only | Version of the enforced configuration, increased each time a change is applied |
| `currentState.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `currentState.serviceId` | string (uuid) | read-only | Identifier of the VAC resource this policy belongs to |
| `currentState.targets` | networkDefense.Vac.TargetState[] | read-only | The targets currently held by the policy, each with the status of every prefix it protects. Also includes the targets removed from the configuration that are still being taken down, so it can list more targets than the configuration does. |
| `currentState.targets[].id` | string (uuid) | read-only | Read-only target identifier. It is not part of the policy configuration: a target is declared by its value. |
| `currentState.targets[].prefix` | networkDefense.Vac.PrefixDefinition | read-only | The IP range, set when the target type is PREFIX |
| `currentState.targets[].resolved` | networkDefense.Vac.ResolvedPrefix[] | read-only | The IP prefixes this target currently protects, each with its status. A PREFIX target always has exactly one entry. |
| `currentState.targets[].type` | networkDefense.Vac.TargetTypeEnum | read-only | Type of target, which determines which definition field is set — one of `PREFIX` |
| `errorMessage` | string | read-only | Details of the last error, set when the status is ERROR |
| `id` | string (uuid) | read-only | Unique identifier of the policy |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Current status of the policy — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | networkDefense.Vac.PolicySpec | read-only | Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. |
| `targetSpec.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `targetSpec.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] | read-only | The complete set of targets the policy protects, excluding the ones being removed. Only the PREFIX type is available today. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |
| `updatedAt` | string (date-time) | read-only | Date and time the policy was last updated |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "profileVersion": 0,
    "sensitivity": "HIGH",
    "serviceId": "00000000-0000-0000-0000-000000000000",
    "targets": [
      {
        "id": "00000000-0000-0000-0000-000000000000",
        "prefix": {
          "cidr": "192.0.2.0/24"
        },
        "resolved": [
          {
            "cidr": "192.0.2.0/24",
            "status": "ACTIVE"
          }
        ],
        "type": "PREFIX"
      }
    ]
  },
  "errorMessage": "string",
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  },
  "updatedAt": "2024-01-01T12:00:00Z"
}
```

### Example

```bash
curl -X POST \
  "https://api.eu.ovhcloud.com/v2/networkDefense/vac/resource/{resourceName}/policy" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: networkDefense.Vac.PolicyAsyncAdd
result = client.post("/v2/networkDefense/vac/resource/{resourceName}/policy",
	targetSpec = None, # Protection configuration to apply to the policy (type: networkDefense.Vac.PolicySpecInput)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: networkDefense.Vac.PolicyAsyncAdd
$result = $ovh->post("/v2/networkDefense/vac/resource/{resourceName}/policy", array(
	targetSpec => null, // Protection configuration to apply to the policy (type: networkDefense.Vac.PolicySpecInput)
));

print_r($result);
?>
```

## Update a VAC policy

`PUT /v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}`

Link: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/#put-networkdefense-vac-resource-resourcename-policy-policyid

**Status:** Stable production version  
**IAM actions:** `vac:apiovh:resource/policy/edit`, `ip:apiovh:networkDefense/vac/protect`

Updates the name, enabled state, targets, profile and sensitivity level of a policy. The targets sent fully replace the previous ones: an omitted or empty list of targets removes every target from the policy. Removed target IPs reset their VAC DDoS protection settings to the default state. Send the checksum from the last read. A stale value is rejected. A new target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `force` | query | boolean |  | Overwrite the protection settings that were not set via a policy on the targets this request adds. Without it, such a request is refused. The previous settings are lost: you cannot restore them yourself. The `force` flag is not stored in the policy spec. |
| `policyId` | path | string (uuid) | yes | Policy ID |
| `resourceName` | path | string (uuid) | yes | Resource name |

### Request body (required)

Type: `networkDefense.Vac.PolicyAsyncUpdate`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string |  | Checksum returned by the last read, used to detect concurrent changes. A stale value is rejected with HTTP 412. |
| `targetSpec` | networkDefense.Vac.PolicySpecInput | yes | Protection configuration to apply to the policy |
| `targetSpec.enabled` | boolean |  | Whether the policy is active. Defaults to true. |
| `targetSpec.name` | string | yes | Name for the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | yes | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | yes | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] |  | The complete set of targets to protect. Every write fully replaces the previous set: omitting this field or sending an empty list removes every target. At most 1000 entries. Changing only the targets is always accepted, even while another change is still being applied. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |

```json
{
  "checksum": "string",
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  }
}
```

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | networkDefense.Vac.PolicyAsyncResource | successful operation |
| 400 | object | Error 400 response |
| 403 | object | Error 403 response |
| 404 | object | Error 404 response |
| 409 | object | Error 409 response |
| 412 | object | Error 412 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change. |
| `createdAt` | string (date-time) | read-only | Date and time the policy was created |
| `currentState` | networkDefense.Vac.PolicyState | read-only | Configuration currently being enforced. Null while the policy is still being created (CREATING). |
| `currentState.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `currentState.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `currentState.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `currentState.profileVersion` | integer | read-only | Version of the enforced configuration, increased each time a change is applied |
| `currentState.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `currentState.serviceId` | string (uuid) | read-only | Identifier of the VAC resource this policy belongs to |
| `currentState.targets` | networkDefense.Vac.TargetState[] | read-only | The targets currently held by the policy, each with the status of every prefix it protects. Also includes the targets removed from the configuration that are still being taken down, so it can list more targets than the configuration does. |
| `currentState.targets[].id` | string (uuid) | read-only | Read-only target identifier. It is not part of the policy configuration: a target is declared by its value. |
| `currentState.targets[].prefix` | networkDefense.Vac.PrefixDefinition | read-only | The IP range, set when the target type is PREFIX |
| `currentState.targets[].resolved` | networkDefense.Vac.ResolvedPrefix[] | read-only | The IP prefixes this target currently protects, each with its status. A PREFIX target always has exactly one entry. |
| `currentState.targets[].type` | networkDefense.Vac.TargetTypeEnum | read-only | Type of target, which determines which definition field is set — one of `PREFIX` |
| `errorMessage` | string | read-only | Details of the last error, set when the status is ERROR |
| `id` | string (uuid) | read-only | Unique identifier of the policy |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Current status of the policy — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | networkDefense.Vac.PolicySpec | read-only | Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. |
| `targetSpec.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `targetSpec.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] | read-only | The complete set of targets the policy protects, excluding the ones being removed. Only the PREFIX type is available today. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |
| `updatedAt` | string (date-time) | read-only | Date and time the policy was last updated |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "profileVersion": 0,
    "sensitivity": "HIGH",
    "serviceId": "00000000-0000-0000-0000-000000000000",
    "targets": [
      {
        "id": "00000000-0000-0000-0000-000000000000",
        "prefix": {
          "cidr": "192.0.2.0/24"
        },
        "resolved": [
          {
            "cidr": "192.0.2.0/24",
            "status": "ACTIVE"
          }
        ],
        "type": "PREFIX"
      }
    ]
  },
  "errorMessage": "string",
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  },
  "updatedAt": "2024-01-01T12:00:00Z"
}
```

### Example

```bash
curl -X PUT \
  "https://api.eu.ovhcloud.com/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN" \
  -H "content-type: application/json" \
  -d '{ }'
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

# Request body type: networkDefense.Vac.PolicyAsyncUpdate
result = client.put("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}",
	checksum = None, # Checksum returned by the last read, used to detect concurrent changes. A stale value is rejected with HTTP 412. (type: string, nullable)
	targetSpec = None, # Protection configuration to apply to the policy (type: networkDefense.Vac.PolicySpecInput)
)

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

// Request body type: networkDefense.Vac.PolicyAsyncUpdate
$result = $ovh->put("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}", array(
	checksum => null, // Checksum returned by the last read, used to detect concurrent changes. A stale value is rejected with HTTP 412. (type: string, nullable)
	targetSpec => null, // Protection configuration to apply to the policy (type: networkDefense.Vac.PolicySpecInput)
));

print_r($result);
?>
```

## Delete a VAC policy

`DELETE /v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}`

Link: https://developers.eu.ovhcloud.com/reference/security/anti-ddos/configuration/#delete-networkdefense-vac-resource-resourcename-policy-policyid

**Status:** Stable production version  
**IAM actions:** `vac:apiovh:resource/policy/delete`

Deletes a policy from a VAC DDoS protection resource. All settings of linked target IP address prefixes return to their default states.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `policyId` | path | string (uuid) | yes | Policy ID |
| `resourceName` | path | string (uuid) | yes | Resource name |

### Responses

| Status | Type | Description |
| --- | --- | --- |
| 200 | networkDefense.Vac.PolicyAsyncResource | successful operation |
| 404 | object | Error 404 response |
| 409 | object | Error 409 response |

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `checksum` | string | read-only | Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change. |
| `createdAt` | string (date-time) | read-only | Date and time the policy was created |
| `currentState` | networkDefense.Vac.PolicyState | read-only | Configuration currently being enforced. Null while the policy is still being created (CREATING). |
| `currentState.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `currentState.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `currentState.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `currentState.profileVersion` | integer | read-only | Version of the enforced configuration, increased each time a change is applied |
| `currentState.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `currentState.serviceId` | string (uuid) | read-only | Identifier of the VAC resource this policy belongs to |
| `currentState.targets` | networkDefense.Vac.TargetState[] | read-only | The targets currently held by the policy, each with the status of every prefix it protects. Also includes the targets removed from the configuration that are still being taken down, so it can list more targets than the configuration does. |
| `currentState.targets[].id` | string (uuid) | read-only | Read-only target identifier. It is not part of the policy configuration: a target is declared by its value. |
| `currentState.targets[].prefix` | networkDefense.Vac.PrefixDefinition | read-only | The IP range, set when the target type is PREFIX |
| `currentState.targets[].resolved` | networkDefense.Vac.ResolvedPrefix[] | read-only | The IP prefixes this target currently protects, each with its status. A PREFIX target always has exactly one entry. |
| `currentState.targets[].type` | networkDefense.Vac.TargetTypeEnum | read-only | Type of target, which determines which definition field is set — one of `PREFIX` |
| `errorMessage` | string | read-only | Details of the last error, set when the status is ERROR |
| `id` | string (uuid) | read-only | Unique identifier of the policy |
| `resourceStatus` | common.ResourceStatusEnum | read-only | Current status of the policy — one of `CREATING`, `CREATION_PLANNED`, `DELETING`, `ERROR`, `OUT_OF_SYNC`, `READY`, `SUSPENDED`, `UNKNOWN`, `UPDATING` |
| `targetSpec` | networkDefense.Vac.PolicySpec | read-only | Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. |
| `targetSpec.enabled` | boolean | read-only | Whether the policy is active. A disabled policy keeps its configuration but does not protect any traffic. |
| `targetSpec.name` | string | read-only | Name of the policy. Renaming it does not change the protection being enforced. |
| `targetSpec.profileId` | string | read-only | Identifier of the protection profile, chosen from the available profile catalog |
| `targetSpec.sensitivity` | networkDefense.Vac.SensitivityEnum | read-only | Protection sensitivity level — one of `HIGH`, `LOW`, `MEDIUM` |
| `targetSpec.targets` | networkDefense.Vac.TargetDefinition[] | read-only | The complete set of targets the policy protects, excluding the ones being removed. Only the PREFIX type is available today. |
| `targetSpec.targets[].prefix` | networkDefense.Vac.PrefixDefinition | yes | The IP range for the PREFIX target |
| `updatedAt` | string (date-time) | read-only | Date and time the policy was last updated |

```json
{
  "checksum": "string",
  "createdAt": "2024-01-01T12:00:00Z",
  "currentState": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "profileVersion": 0,
    "sensitivity": "HIGH",
    "serviceId": "00000000-0000-0000-0000-000000000000",
    "targets": [
      {
        "id": "00000000-0000-0000-0000-000000000000",
        "prefix": {
          "cidr": "192.0.2.0/24"
        },
        "resolved": [
          {
            "cidr": "192.0.2.0/24",
            "status": "ACTIVE"
          }
        ],
        "type": "PREFIX"
      }
    ]
  },
  "errorMessage": "string",
  "id": "00000000-0000-0000-0000-000000000000",
  "resourceStatus": "CREATING",
  "targetSpec": {
    "enabled": true,
    "name": "string",
    "profileId": "string",
    "sensitivity": "HIGH",
    "targets": [
      {
        "prefix": {
          "cidr": "192.0.2.0/24"
        }
      }
    ]
  },
  "updatedAt": "2024-01-01T12:00:00Z"
}
```

### Example

```bash
curl -X DELETE \
  "https://api.eu.ovhcloud.com/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}" \
  -H "accept: application/json" \
  -H "authorization: Bearer $OVH_TOKEN"
```

```python
'''
First, install the latest release of Python wrapper: $ pip install ovh
'''
import json
import ovh

# Instantiate an OVH Client.
# You can generate new credentials with full access to your account on
# the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
client = ovh.Client(
	endpoint='ovh-eu',               # Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
	application_key='xxxxxxxxxx',    # Application Key
	application_secret='xxxxxxxxxx', # Application Secret
	consumer_key='xxxxxxxxxx',       # Consumer Key
)

result = client.delete("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}")

# Pretty print
print(json.dumps(result, indent=4))
```

```php
<?php
/**
 * First, download the latest release of PHP wrapper on github
 * And include this script into the folder with extracted files
 */
require __DIR__ . '/vendor/autoload.php';
use \Ovh\Api;

/**
 * Instantiate an OVH Client.
 * You can generate new credentials with full access to your account on
 * the token creation page (https://api.ovh.com/createToken/index.cgi?GET=/*&PUT=/*&POST=/*&DELETE=/*)
 */
$ovh = new Api('xxxxxxxxxx',  // Application Key
               'xxxxxxxxxx',  // Application Secret
               'ovh-eu',      // Endpoint of API OVH (List of available endpoints: https://github.com/ovh/python-ovh#2-configure-your-application)
               'xxxxxxxxxx'); // Consumer Key

$result = $ovh->delete("/v2/networkDefense/vac/resource/{resourceName}/policy/{policyId}");

print_r($result);
?>
```