List DNS firewall rule groups.

GET

/v1/projects/{projectId}/dns/firewall-rule-groups

Code sample: Shell / cURL

curl --request GET \
  --url 'https://stratum.example.com/v1/projects/example/dns/firewall-rule-groups?limit=100' \
  --header 'Authorization: Bearer <token>'

• A Stratum cluster endpoint.

Per-VPC DNS Firewall (Slice E,) — the Route 53 Resolver DNS Firewall analog. A rule group is a named set of domain rules (block/allow); associating it with a VPC applies it to that VPC’s recursor.

Authorizations

• bearerAuth

Parameters

Path Parameters

projectId

required

string

/^p-[a-z0-9-]+$/

Query Parameters

limit

integer

default: 100 >= 1 <= 500

page_token

string

Opaque cursor from a previous response’s nextPageToken; omit for the first page. A token that cannot be parsed is treated as no token, so a client gets the first page rather than a 400.

Cursor-paginated, ordered name, id. Ordering on name alone is not a total order, so id is the tiebreaker: without it a cursor sitting on two same-named rows repeats or skips one.

This endpoint returned every matching row with no limit of any kind until.

Responses

200

The project’s firewall rule groups.

Media typeapplication/json

object

items

required

Array<object>

object

id

required

string

/^fwrg-[a-z0-9]+$/

projectId

required

string

region

string

name

required

string

managed

True for a platform-curated managed group: owned by the platform, read-only to tenants, associable by any project with its own VPCs.

boolean

description

Human-readable description; set on managed groups to explain the curated list.

string

createdAt

string format: date-time

domains

The group’s domain rules. Omitted on the managed-list discovery endpoint (see domainCount).

Array<object>

object

domain

required

FQDN to match (its subtree is included). A trailing dot is added if omitted.

string

action

required

Block sinkholes the domain (NXDOMAIN); alert logs matched queries but resolves normally (monitoring); allow overrides a block/alert for that exact domain.

string

Allowed values: block allow alert

vpcIds

VPCs this rule group is associated with.

Array<string>

domainCount

Number of domain rules; set by the managed-list discovery endpoint in lieu of the full domains array.

integer

Example

{
  "items": [
    {
      "domains": [
        {
          "action": "block"
        }
      ]
    }
  ]
}