Update the attack protection settings

PATCH /v1/attack-protection · permission attack-protection:write

Updates the attack protection object with a JSON merge patch (application/merge-patch+json, RFC 7396). If-Match is required: missing gives 428, a stale ETag gives 412. A patch that changes nothing writes nothing and keeps the ETag.

Request

Field	Type	Required	Description
`If-Match`	header	yes	The `ETag` of the object as last read. Missing: `428`; stale: `412`.
body	object	yes	The merge patch. Fields are listed in Replace the attack protection settings.

Behavior

Sections merge recursively: send only the fields you change.
null removes a field or a whole section, which returns it to its default. Lists such as allowlist and allowed_countries are replaced as a whole.
The merged object is checked exactly as a PUT body.

Response

200 OK with the object, as in Get the attack protection settings, and the new ETag.

Errors

HTTP	code	When
400	`unknown_field`	A section or field is not part of the object. `errors[]` lists the pointers.
400	`malformed_request`	The body is not valid JSON, or the `If-Match` header is malformed.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks `attack-protection:write`.
403	`plan_feature_unavailable`	`risk_policy.mode` is `enforce` and the plan does not include it; the body carries `feature` and `required_plan`.
412	`precondition_failed`	The object changed since you read it. Read it again and retry.
413	`payload_too_large`	The object is larger than 32 KiB.
422	`validation_failed`	A value has the wrong type or is out of range, or `block_threshold` is not greater than `challenge_threshold`. `errors[]` lists the pointers.
422	`below_security_floor`	A value is below the security floor. Each `errors[]` entry names the field and its floor in `detail`.
422	`allowlist_range_too_broad`	An allowlist prefix is wider than /8 (IPv4) or /32 (IPv6).
428	`precondition_required`	`If-Match` is missing.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

When several kinds of error are present, only the most severe kind is returned, in this order: unknown_field, validation_failed, below_security_floor, allowlist_range_too_broad, plan_feature_unavailable. The written values are never echoed back.

Example

curl -X PATCH https://api.eu.keenauth.com/v1/attack-protection \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Content-Type: application/merge-patch+json" \
  -H 'If-Match: "3f1c9a0b5d7e2a4c6b8d0e1f2a3b4c5d"' \
  -d '{"risk_policy": {"block_threshold": 9}, "sms_protection": null}'