Show Patch & Protect | Modular DS

{
  "data": {
    "attributes": {
      "configuration": {
        "activity_log": {
          "enabled": true,
          "log_comments": false,
          "log_failed_logins_app": false,
          "log_failed_logins_local": true,
          "log_posts": false
        },
        "firewall": {
          "auto_prepend_enabled": false,
          "autoblock_attempts": 60,
          "autoblock_blocktime": 1,
          "autoblock_minutes": 1,
          "block_bruteforce_ips": false,
          "bruteforce_attempts": 10,
          "bruteforce_blocktime": 60,
          "bruteforce_minutes": 5,
          "enabled": true,
          "ip_block_list": null,
          "ip_header_override": null,
          "whitelist_rules": null,
          "whitelist_user_roles": [
            "administrator"
          ]
        },
        "hardening_captcha": {
          "enable_on_comments": false,
          "enable_on_forgot_password": false,
          "enable_on_login": false,
          "enable_on_register": false,
          "site_key_invisible": null,
          "site_key_turnstile": null,
          "site_key_v2": null,
          "site_key_v3": null,
          "type": "v2"
        },
        "hardening_general": {
          "disable_application_passwords": true,
          "disable_plugin_theme_editor": true,
          "disable_user_enumeration": true,
          "hide_wp_version": true,
          "restrict_rest_api": false,
          "restrict_xmlrpc": true
        },
        "hardening_htaccess": {
          "add_security_headers": true,
          "block_debug_log": true,
          "block_default_file_access": true,
          "block_readme_txt": true,
          "custom_rules": null,
          "custom_rules_location": "bottom",
          "disable_directory_indexing": true,
          "enabled": true
        },
        "hardening_login": {
          "custom_login_enabled": false,
          "enable_2fa": false
        }
      },
      "connection_status": "connected",
      "created_at": "2026-09-24T15:00:57.000000Z",
      "last_stats_at": "2026-09-24T15:00:57.000000Z",
      "status": "enabled",
      "updated_at": "2026-09-24T15:00:57.000000Z"
    },
    "id": "1",
    "links": {
      "self": "https://api.modulards.local/api/public/v1/patchstack-services/1"
    },
    "type": "site-preset-patchstacks"
  },
  "jsonapi": {
    "version": "1.1"
  }
}

One website’s Patch & Protect, addressed by the row id its protection carries.

status says whether the protection is on, connection_status how it is doing against the security provider (connected, sync_error, disconnected, site_not_found, api_unreachable, site_not_linked, or unknown before the first health check), and last_stats_at when its attack figures were last read.

configuration is the website’s settings, read-only here: editing them stays in the dashboard, where a per-website edit forks the shared configuration. Two values never leave the server: the CAPTCHA secret keys, which are credentials of the customer’s provider account, and the custom login slug, because a hidden login URL that is handed out is not hidden. custom_login_enabled does travel, so a reader knows the login was moved without learning where.

A website with no protection has no row at all: read has_patchstack and filter[patchstack] on /sites instead. Switching the protection on is POST /patchstack-services/bulk.

One website's Patch & Protect, addressed by the row id its protection carries. `status` says whether the protection is on, `connection_status` how it is doing against the security provider (`connected`, `sync_error`, `disconnected`, `site_not_found`, `api_unreachable`, `site_not_linked`, or `unknown` before the first health check), and `last_stats_at` when its attack figures were last read. `configuration` is the website's settings, read-only here: editing them stays in the dashboard, where a per-website edit forks the shared configuration. Two values never leave the server: the CAPTCHA secret keys, which are credentials of the customer's provider account, and the custom login slug, because a hidden login URL that is handed out is not hidden. `custom_login_enabled` does travel, so a reader knows the login was moved without learning where. A website with no protection has no row at all: read `has_patchstack` and `filter[patchstack]` on `/sites` instead. Switching the protection on is `POST /patchstack-services/bulk`.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Path parameters

site_preset_patchstackstringRequired

Response

200 - A protected website

dataobjectOptional

jsonapiobjectOptional

One website’s Patch & Protect, addressed by the row id its protection carries.

A website with no protection has no row at all: read has_patchstack and filter[patchstack] on /sites instead. Switching the protection on is POST /patchstack-services/bulk.