Connect your agent.
Register → Dashboard → Connect your agent → Create private key. Select Read for evidence. Protect adds Manage permission for incident actions.
MCP
Add a remote Streamable HTTP server in a compatible client:
URL: https://app.webupcheck.com/mcp Authorization: Bearer YOUR_PRIVATE_KEY
Tools: get_protection, get_protection_events, set_protection_mode, release_caller, issue_traffic_credential.
The last three require Protect and a Manage key. Do not expose the key to web pages, URL parameters or untrusted agents. Clients must support custom Bearer headers; OAuth automatic login is not available.
REST API
curl https://app.webupcheck.com/api/protection \ -H 'Authorization: Bearer YOUR_PRIVATE_KEY' curl https://app.webupcheck.com/api/events \ -H 'Authorization: Bearer YOUR_PRIVATE_KEY'
For writes, use POST, Content-Type: application/json and the same Authorization header.
POST /api/domains/DOMAIN_ID/settings
{"mode":"observe","expectedRevision":3}
POST /api/domains/DOMAIN_ID/release
{"subjectId":"CALLER_FROM_ACTIVE_RESTRICTIONS","prefix":"/v1/"}
POST /api/domains/DOMAIN_ID/issue
{"kind":"agent"}Observe pauses behavioral blocking and resets active caller restrictions. Read the latest revision before changing settings. A traffic credential is separate from the control key: send it to your own protected API as X-WebUpCheck-Client. It lasts one hour, is revocable, and never bypasses abuse limits.
Signed application webhooks
Protect can deliver caller-restriction events to a configured path on your verified origin. Up to three attempts, spaced about five minutes apart. Duplicate delivery is possible: deduplicate the event ID.
Validate X-WebUpCheck-Timestamp within five minutes. Compute HMAC-SHA256 of timestamp + '.' + raw_request_body using your origin key, encode base64url without padding, and compare in constant time to X-WebUpCheck-Signature. Reject invalid signatures. The origin guard must still run first.
This is an application integration, not an email or Slack service. New webhook events and detailed history pause when the included history allowance is exhausted. Blocking continues.
URL and request boundaries
POST bodies must use a JSON media type and must be uncompressed. Use normalized paths: encoded separators, nested percent encoding, repeated slashes, matrix parameters and encoded whitespace/control characters are rejected with HTTP400. Prefix matching is case-insensitive after decoding. If your origin rewrites other paths into a protected endpoint, protect the root prefix / or include every rewritten entry path.
Safety contract
Never interpret an empty event array as proof that no attack occurred. Read coverage, history availability, retention, mode and timestamps. A successful origin response does not establish full application health. Threat feeds are disabled; the service makes no reputation-based all-clear claim.
Diagnostics at webupcheck.com/mcp remain separate, public and read-only. The Protect MCP requires credentials and affects only your account.