Switch Patch & Protect

POST

https://api.modulards.com/api/public/v1/patchstack-services/bulk

POST

/api/public/v1/patchstack-services/bulk

curl -X POST https://api.modulards.com/api/public/v1/patchstack-services/bulk \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "sites": [
    2,
    3
  ],
  "status": "enabled"
}'

202Switch Patch & Protect

{
  "data": [
    {
      "attributes": {
        "completed_at": null,
        "created_at": "2026-09-24T15:00:58.000000Z",
        "created_by": 1,
        "origin": "agent",
        "site_id": 2,
        "started_at": null,
        "status": "pending",
        "type": "security.patchstack.create",
        "updated_at": "2026-09-24T15:00:58.000000Z"
      },
      "id": "1",
      "links": {
        "self": "https://api.modulards.local/api/public/v1/site-actions/1"
      },
      "type": "site-actions"
    }
  ],
  "jsonapi": {
    "version": "1.1"
  },
  "meta": {
    "skipped": [
      {
        "message": "This website is not connected; connect it first.",
        "reason_code": "SITE_UNREACHABLE",
        "site_action_id": null,
        "site_id": 3,
        "site_name": "old.example.com"
      }
    ]
  }
}

Switch Patch & Protect on or off over an explicit selection of websites: sites (exact ids, 1 to 200) and status (enabled or disabled).

Every protected website is billed. The add-on is metered per website and per month, with no websites included in the plan, so enabling it here adds to the organization’s invoice. Without the add-on subscribed the call answers 403 and the user enables it from the Modular DS dashboard: an integration never buys it.

Switching on installs the security plugin on WordPress; switching off removes it and leaves the website unprotected. Both are pipelines, so the answer is 202 with one site-actions document per website, which you follow through /site-actions, and meta.skipped for the rest.

A website is skipped when it is not connected (SITE_UNREACHABLE), when it is being restored or already has a switch running (CONFLICT), or when it is already in the state you asked for (ALREADY_APPLIED). Ids outside your reach come back as PERMISSION_DENIED instead of being dropped in silence.

Switch Patch & Protect on or off over an explicit selection of websites: `sites` (exact ids, 1 to 200) and `status` (`enabled` or `disabled`). **Every protected website is billed.** The add-on is metered per website and per month, with no websites included in the plan, so enabling it here adds to the organization's invoice. Without the add-on subscribed the call answers 403 and the user enables it from the Modular DS dashboard: an integration never buys it. Switching on installs the security plugin on WordPress; switching off removes it and leaves the website unprotected. Both are pipelines, so the answer is **202** with one `site-actions` document per website, which you follow through `/site-actions`, and `meta.skipped` for the rest. A website is skipped when it is not connected (`SITE_UNREACHABLE`), when it is being restored or already has a switch running (`CONFLICT`), or when it is already in the state you asked for (`ALREADY_APPLIED`). Ids outside your reach come back as `PERMISSION_DENIED` instead of being dropped in silence.

Authentication

AuthorizationBearer

Personal access token created in the Modular DS dashboard; read-only tokens can only call GET endpoints.

Request

This endpoint expects an object.

siteslist of doublesOptional

statusstringOptional

Response

202 - One website switched on, one skipped

datalist of objectsOptional

jsonapiobjectOptional

metaobjectOptional