Getting started guides, rule engine reference, and API documentation. If something is missing, reach out. We'll add it.
From signup to active protection in under ten minutes. No traffic downtime during onboarding, your origin remains reachable throughout.
always-on or on-demand), and save. You'll be issued a Soreva-assigned IP block.30 seconds. Dashboard status will show Active.on-demand to always-on takes effect within one BGP convergence cycle.Soreva uses BGP to pull your prefix into the scrubbing network. Configure a session from your upstream router using the credentials provided in the dashboard.
Connect to the Soreva route reflector nearest to your origin. Peer IP, ASN, and session password are shown under Network → BGP credentials after creating a network. The example below uses placeholder values.
! Replace values with those shown in your dashboard router bgp 65001 bgp router-id 203.0.113.1 neighbor 192.0.2.1 remote-as 64512 neighbor 192.0.2.1 password your-session-password neighbor 192.0.2.1 soft-reconfiguration inbound ! address-family ipv4 neighbor 192.0.2.1 activate network 203.0.113.0 mask 255.255.255.0 exit-address-family
Scrubbed traffic is delivered back to your origin via a GRE or IPIP tunnel. The tunnel endpoint on the Soreva side is provided alongside your BGP credentials. Configure your origin router to decapsulate the tunnel and accept traffic from Soreva's forwarding ASN (AS64512).
Clean traffic is returned to your origin over a GRE or IPIP tunnel. Configure the tunnel before activating your network to avoid any forwarding gaps.
# GRE tunnel — replace with values from your dashboard ip tunnel add soreva0 \ mode gre \ remote 192.0.2.1 \ local 203.0.113.1 \ ttl 255 ip link set soreva0 up ip addr add 169.254.0.2/30 dev soreva0 ip route add default via 169.254.0.1 dev soreva0
Rules are written in Soreva's HCL-like configuration language. Each rule has a match block that defines conditions and an action that executes when all conditions are met.
rule "example-rule" { # All fields in match are ANDed together match { proto = "TCP" # TCP | UDP | ICMP | HTTP | HTTPS src_cidr = "0.0.0.0/0" # source IP range dst_port = 25565 # destination port or range pps = > 10000 # packets per second threshold asn = 64496 # match specific ASN } action = "drop" # drop | challenge | rate_limit | allow alert = true # send mitigation alert log = true # write to event log }
All fields within a match block are evaluated with AND logic. Multiple values for a single field can be provided as a list and are evaluated with OR logic.
| Field | Type | Description |
|---|---|---|
| proto | string | list | Protocol to match. One of TCP, UDP, ICMP, HTTP, HTTPS. |
| src_cidr | CIDR | list | Source IP range in CIDR notation. Accepts IPv4 and IPv6. |
| dst_port | integer | range | Destination port or port range, e.g. 25565 or 8000-8080. |
| pps | expression | Packets per second threshold. Supports operators: >, <, >=, <=. |
| bps | expression | Bits per second threshold. Same operator support as pps. |
| asn | integer | list | Match traffic originating from a specific ASN or list of ASNs. |
| asn_type | string | Match by ASN classification: residential, datacenter, mobile, education. |
| flags | list | TCP flags to match, e.g. ["SYN"], ["SYN", "ACK"]. |
| country | string | list | ISO 3166-1 alpha-2 country code(s), e.g. "CN" or ["CN", "KP"]. |
| path | string (glob) | HTTP request path. Supports wildcard glob matching, e.g. "/api/*". HTTP/HTTPS only. |
| rps | expression | HTTP requests per second per source IP. HTTP/HTTPS only. |
| ja3 | string | list | JA3 TLS fingerprint hash(es) to match. HTTPS only. |
The action field determines what happens to traffic that matches the rule. Rules are evaluated in order; the first matching rule wins.
| Action | Description |
|---|---|
| drop | Silently discard matching packets at the ingress PoP. No RST is sent to the source. |
| challenge | Issue a TCP or HTTP challenge to verify the source is a legitimate client. Passing sources are automatically allowlisted for the session duration. |
| rate_limit | Enforce a packets-per-second or requests-per-second ceiling on matching traffic. Excess is dropped. Combine with rate field to set the limit. |
| allow | Explicitly pass traffic, bypassing all subsequent rules. Use to whitelist trusted CIDRs or ASNs before broader drop rules. |
All API requests must include a bearer token issued from the dashboard under Account → API keys. Keys are scoped to read, write, or admin at creation time.
GET /v1/networks HTTP/1.1 Host: api.soreva.se Authorization: Bearer srva_live_xxxxxxxxxxxxxxxxxxxx Content-Type: application/json
Manage your protected networks programmatically. Each network corresponds to an IP prefix announced via BGP.
Returns a list of all networks in your account. Includes status, mode, and current mitigation state.
Create a new network. The request body must include a name and CIDR prefix. Protection mode defaults to always-on if not specified.
| Parameter | Required | Description |
|---|---|---|
| name | required | Human-readable label for the network. Max 64 characters. |
| prefix | required | IPv4 or IPv6 CIDR prefix to protect, e.g. 203.0.113.0/24. |
| mode | optional | always-on (default) or on-demand. |
| anycast | optional | Boolean. Enables BGP anycast routing to all PoPs. Default true. |
Remove a network and withdraw its prefix from the scrubbing network. BGP withdrawal propagates within 30 seconds. Active tunnels are torn down automatically.
Deploy, update, and delete rules via the API. Changes propagate globally within 30 seconds of the API response.
List all rules for a network, ordered by priority. Returns rule ID, name, match conditions, action, and current enabled state.
{
"name": "block-syn-flood",
"match": {
"proto": "TCP",
"flags": ["SYN"],
"pps": "> 50000",
"asn_type": "residential"
},
"action": "drop",
"alert": true,
"log": true
}
Replace a rule in full. Partial updates are not supported, send the complete rule object. To temporarily disable a rule without deleting it, set "enabled": false.
Query the event log for mitigation records, alerts, and BGP state changes. Events are retained for 90 days on Premium and Enterprise plans.
| Query param | Required | Description |
|---|---|---|
| from | optional | ISO 8601 timestamp. Filter events after this time. |
| to | optional | ISO 8601 timestamp. Filter events before this time. |
| type | optional | Filter by event type: mitigation, alert, bgp, rule. |
| limit | optional | Number of results to return. Default 100, max 1000. |
| cursor | optional | Pagination cursor returned in the previous response's next_cursor field. |
Deploy in under ten minutes. No traffic rerouting downtime. No credit card required to start.