---
title: JSON objects
description: JSON object structure for Advanced TCP Protection API requests and responses.
image: https://developers.cloudflare.com/core-services-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/ddos-protection/llms.txt  
> Use this file to discover all available pages before exploring further.

[Skip to content](#%5Ftop) 

### Tags

[ JSON ](https://developers.cloudflare.com/search/?tags=JSON) 

# JSON objects

This page contains an example of the TCP protection rule JSON object used in the API.

## Prefix

```

{

  "id": "31c70c65-9f81-4669-94ed-1e1e041e7b06",

  "prefix": "192.0.2.0/24",

  "comment": "Game ranges",

  "excluded": false,

  "created_on": "2022-01-01T13:06:04.721954+01:00",

  "modified_on": "2022-01-01T13:06:04.721954+01:00"

}


```

## Prefix in allowlist

```

{

  "id": "31c70c65-9f81-4669-94ed-1e1e041e7b06",

  "prefix": "192.0.2.0/24",

  "comment": "Game ranges",

  "enabled": true,

  "created_on": "2021-10-01T13:06:04.721954+01:00",

  "modified_on": "2021-10-01T13:06:04.721954+01:00"

}


```

The `prefix` field can contain an IP address or a CIDR range.

## SYN flood rule or out-of-state TCP rule

```

{

  "id": "31c70c65-9f81-4669-94ed-1e1e041e7b06",

  "scope": "region",

  "name": "WEUR",

  "rate_sensitivity": "medium",

  "burst_sensitivity": "medium",

  "created_on": "2021-10-01T13:10:38.762503+01:00",

  "modified_on": "2021-10-01T13:10:38.762503+01:00"

}


```

The `scope` field value must be one of `global`, `region`, or `datacenter`. You must provide a region code (or data center code) in the `name` field when specifying a `region` (or `datacenter`) scope.

The `rate_sensitivity` and `burst_sensitivity` field values must be one of `low`, `medium`, or `high`.

## Filter

```

{

  "id": "20b99eb6-8b48-48dd-a5b9-a995a0843b57",

  "expression": "ip.dst in { 192.0.2.0/24 203.0.113.0/24 } and tcp.dstport in { 80 443 10000..65535 }",

  "mode": "enabled",

  "created_on": "2022-11-01T13:10:38.762503+01:00",

  "modified_on": "2022-11-01T13:10:38.762503+01:00"

}


```

The `expression` field is a [Rules language expression](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/) up to 8,192 characters that can include the following fields:

* `ip.src`
* `ip.dst`
* `tcp.srcport`
* `tcp.dstport`

Note

Expressions of SYN flood protection and out-of-state TCP protection filters do not currently support functions.

The `mode` value must be one of `enabled`, `disabled`, or `monitoring`.

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ddos-protection/","name":"DDoS Protection"}},{"@type":"ListItem","position":3,"item":{"@id":"/ddos-protection/advanced-ddos-systems/","name":"Advanced DDoS systems"}},{"@type":"ListItem","position":4,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/","name":"API configuration"}},{"@type":"ListItem","position":5,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/tcp-protection/","name":"Advanced TCP Protection"}},{"@type":"ListItem","position":6,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/tcp-protection/json-objects/","name":"JSON objects"}}]}
```