[DigitalOcean Cloud Firewalls](https://docs.digitalocean.com/products/networking/firewalls/) provide the ability to restrict network access to and from a Droplet allowing you to define which ports will accept inbound or outbound connections. By sending requests to the `/v2/firewalls` endpoint, you can list, create, or delete firewalls as well as modify access rules.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/digital-ocean:digital-ocean-firewalls-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: DigitalOcean Firewalls API
version: '2.0'
description: 'DigitalOcean Cloud Firewalls
provide the ability to restrict network access to and from a Droplet
allowing you to define which ports will accept inbound or outbound
connections. By sending requests to the `/v2/firewalls` endpoint, you can
list, create, or delete firewalls as well as modify access rules.'
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
contact:
name: DigitalOcean API Team
email: api-engineering@digitalocean.com
termsOfService: https://www.digitalocean.com/legal/terms-of-service-agreement/
servers:
- url: https://api.digitalocean.com
description: production
security:
- bearer_auth: []
tags:
- name: Firewalls
description: 'DigitalOcean Cloud Firewalls
provide the ability to restrict network access to and from a Droplet
allowing you to define which ports will accept inbound or outbound
connections. By sending requests to the `/v2/firewalls` endpoint, you can
list, create, or delete firewalls as well as modify access rules.'
paths:
/v2/firewalls:
get:
$ref: resources/firewalls/firewalls_list.yml
tags:
- Firewalls
summary: Get firewalls
x-summary-source: derived
operationId: getV2Firewalls
x-operation-id-source: derived
post:
$ref: resources/firewalls/firewalls_create.yml
tags:
- Firewalls
summary: Create firewalls
x-summary-source: derived
operationId: postV2Firewalls
x-operation-id-source: derived
/v2/firewalls/{firewall_id}:
get:
$ref: resources/firewalls/firewalls_get.yml
tags:
- Firewalls
summary: Get firewalls by firewall id
x-summary-source: derived
operationId: getV2FirewallsByFirewallId
x-operation-id-source: derived
put:
$ref: resources/firewalls/firewalls_update.yml
tags:
- Firewalls
summary: Replace firewalls by firewall id
x-summary-source: derived
operationId: putV2FirewallsByFirewallId
x-operation-id-source: derived
delete:
$ref: resources/firewalls/firewalls_delete.yml
tags:
- Firewalls
summary: Delete firewalls by firewall id
x-summary-source: derived
operationId: deleteV2FirewallsByFirewallId
x-operation-id-source: derived
/v2/firewalls/{firewall_id}/droplets:
post:
$ref: resources/firewalls/firewalls_assign_droplets.yml
tags:
- Firewalls
summary: Create firewalls by firewall id droplets
x-summary-source: derived
operationId: postV2FirewallsByFirewallIdDroplets
x-operation-id-source: derived
delete:
$ref: resources/firewalls/firewalls_delete_droplets.yml
tags:
- Firewalls
summary: Delete firewalls by firewall id droplets
x-summary-source: derived
operationId: deleteV2FirewallsByFirewallIdDroplets
x-operation-id-source: derived
/v2/firewalls/{firewall_id}/tags:
post:
$ref: resources/firewalls/firewalls_add_tags.yml
tags:
- Firewalls
summary: Create firewalls by firewall id tags
x-summary-source: derived
operationId: postV2FirewallsByFirewallIdTags
x-operation-id-source: derived
delete:
$ref: resources/firewalls/firewalls_delete_tags.yml
tags:
- Firewalls
summary: Delete firewalls by firewall id tags
x-summary-source: derived
operationId: deleteV2FirewallsByFirewallIdTags
x-operation-id-source: derived
/v2/firewalls/{firewall_id}/rules:
post:
$ref: resources/firewalls/firewalls_add_rules.yml
tags:
- Firewalls
summary: Create firewalls by firewall id rules
x-summary-source: derived
operationId: postV2FirewallsByFirewallIdRules
x-operation-id-source: derived
delete:
$ref: resources/firewalls/firewalls_delete_rules.yml
tags:
- Firewalls
summary: Delete firewalls by firewall id rules
x-summary-source: derived
operationId: deleteV2FirewallsByFirewallIdRules
x-operation-id-source: derived
components:
securitySchemes:
bearer_auth:
type: http
scheme: bearer
description: '## OAuth Authentication
In order to interact with the DigitalOcean API, you or your application must
authenticate.
The DigitalOcean API handles this through OAuth, an open standard for
authorization. OAuth allows you to delegate access to your account.
Scopes can be used to grant full access, read-only access, or access to
a specific set of endpoints.
You can generate an OAuth token by visiting the [Apps & API](https://cloud.digitalocean.com/account/api/tokens)
section of the DigitalOcean control panel for your account.
An OAuth token functions as a complete authentication request. In effect, it
acts as a substitute for a username and password pair.
Because of this, it is absolutely **essential** that you keep your OAuth
tokens secure. In fact, upon generation, the web interface will only display
each token a single time in order to prevent the token from being compromised.
DigitalOcean access tokens begin with an identifiable prefix in order to
distinguish them from other similar tokens.
- `dop_v1_` for personal access tokens generated in the control panel
- `doo_v1_` for tokens generated by applications using [the OAuth flow](https://docs.digitalocean.com/reference/api/oauth-api/)
- `dor_v1_` for OAuth refresh tokens
### Scopes
Scopes act like permissions assigned to an API token. These permissions
determine what actions the token can perform. You can create API
tokens that grant read-only access, full access, or limited access to
specific endpoints by using custom scopes.
Generally, scopes are designed to match HTTP verbs and common CRUD
operations (Create, Read, Update, Delete).
| HTTP Verb | CRUD Operation | Scope |
|---|---|---|
| GET | Read | `<resource>:read` |
| POST | Create | `<resource>:create` |
| PUT/PATCH | Update | `<resource>:update` |
| DELETE | Delete | `<resource>:delete` |
For example, creating a new Droplet by making a `POST` request to the
`/v2/droplets` endpoint requires the `droplet:create` scope while
listing Droplets by making a `GET` request to the `/v2/droplets`
endpoint requires the `droplet:read` scope.
Each endpoint below specifies which scope is required to access it when
using custom scopes.
### How to Authenticate with OAuth
In order to make an authenticated request, include a bearer-type
`Authorization` header containing your OAuth token. All requests must be
made over HTTPS.
### Authenticate with a Bearer Authorization Header
```
curl -X $HTTP_METHOD -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://api.digitalocean.com/v2/$OBJECT"
```
'
inference_bearer_auth:
type: http
scheme: bearer
description: '## OAuth Authentication
In order to interact with the DigitalOcean API, you or your application must
authenticate.
The DigitalOcean API handles this through OAuth, an open standard for
authorization. OAuth allows you to delegate access to your account.
Scopes can be used to grant full access, read-only access, or access to
a specific set of endpoints.
You can generate an OAuth token by visiting the [Apps & API](https://cloud.digitalocean.com/account/api/tokens)
section of the DigitalOcean control panel for your account.
An OAuth token functions as a complete authentication request. In effect, it
acts as a substitute for a username and password pair.
Because of this, it is absolutely **essential** that you keep your OAuth
tokens secure. In fact, upon generation, the web interface will only display
each token a single time in order to prevent the token from being compromised.
DigitalOcean access tokens begin with an identifiable prefix in order to
distinguish them from other similar tokens.
- `dop_v1_` for personal access tokens generated in the control panel
- `doo_v1_` for tokens generated by applications using [the OAuth flow](https://docs.digitalocean.com/reference/api/oauth-api/)
- `dor_v1_` for OAuth refresh tokens
### Authenticate with a Bearer Authorization Header
**Serverless Inference:**
```
curl -X POST -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" "https://inference.do-ai.run/v1/chat/completions"
```
**Agent Inference:**
```
curl -X POST -H "Authorization: Bearer $AGENT_ACCESS_KEY" "https://{your-agent-url}.agents.do-ai.run/v1/chat/completions?agent=true"
```
**Note:** Agent Inference APIs use an `agent_access_key` (endpoint access
key) instead of a DigitalOcean OAuth token. The `agent_access_key` is
provided when you provision an agent endpoint and is scoped to that
specific agent. It is not interchangeable with DigitalOcean OAuth tokens
(`dop_v1_*`, `doo_v1_*`, `dor_v1_*`), which are used with Serverless
Inference and the control-plane API at `https://api.digitalocean.com`.
'
x-tagGroups:
- name: Public APIs
tags:
- Public APIs Introduction
- 1-Click Applications
- Account
- Actions
- Add-Ons
- Action Gateway
- Action Gateway Data Plane
- Agent Platform API
- Apps
- Billing
- Block Storage
- Block Storage Actions
- BYOIP Prefixes
- CDN Endpoints
- Certificates
- Container Registry
- Container Registries
- Databases
- Dedicated Inference
- Domain Records
- Domains
- Droplet Actions
- Droplets
- Droplet Autoscale Pools
- Firewalls
- Floating IP Actions
- Floating IPs
- Functions
- Harness Runtime
- Image Actions
- Images
- Insights
- Kubernetes
- Load Balancers
- MicroVMs [Public Preview]
- Monitoring
- NFS
- NFS Actions
- Organizations
- Partner Network Connect
- Project Resources
- Projects
- Regions
- Reserved IP Actions
- Reserved IPs
- Reserved IPv6
- Reserved IPv6 Actions
- Security
- Signals
- Sizes
- Snapshots
- Spaces Keys
- SSH Keys
- Tags
- Uptime
- Vector Databases
- VPC NAT Gateways
- VPC Peerings
- VPC Routes [Public Preview]
- VPC Subnets [Public Preview]
- VPCs
- name: Inference APIs
tags:
- Inference Introduction
- Agent Inference
- Batch Inference
- Embeddings
- Serverless Inference