> ## Documentation Index
> Fetch the complete documentation index at: https://docs.celum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Flow dnsblocked

> **Authorisation:** `security:Read` on `krn:celum:supervisor:{name}:security:*`.

**Assistant tool:** `get_dns_blocked_attempts`



## OpenAPI

````yaml /openapi.json get /api/supervisors/{name}/security/flows/dns-blocked
openapi: 3.0.3
info:
  description: >-
    The HTTP surface of the Celum backend, generated from its own router and

    authorisation map — so this list cannot drift from the server that serves
    it.


    **Every operation states the IAM action and resource it is authorised

    against.** That pairing is the part worth reading: a policy naming the right

    action against the wrong resource matches nothing, and fails silently.


    Request and response bodies come from the Go types the handlers send and

    decode. Where those types do not determine the shape (an interface, a

    map[string]any, an unknown custom encoding), the operation says so in

    `x-celum-schema-gap` instead of carrying a guessed schema.
  title: Celum API
  version: 1.0.0
servers:
  - description: Your Celum deployment
    url: https://{host}
    variables:
      host:
        default: celum.example.com
        description: The host your Celum backend is served from
security:
  - sessionCookie: []
  - bearerToken: []
tags:
  - description: AI assistant & MCP
    name: ai-assistant
  - description: Clusters & CAPI lifecycle
    name: capi
  - description: Certificates & external secrets
    name: certs
  - description: GitOps & apps
    name: gitops
  - description: IAM, audit & auth
    name: iam
  - description: Image library
    name: images
  - description: Infrastructure & supervisors
    name: infrastructure
  - description: Networking
    name: networking
  - description: Observability & platform health
    name: observability
  - description: Platform onboarding & settings
    name: platform-settings
  - description: Projects
    name: projects
  - description: Registries & mirroring
    name: registries
  - description: Security & flows
    name: security
  - description: Storage
    name: storage
  - description: Templates & addons
    name: templates
  - description: Virtualization platform (KubeVirt/CDI)
    name: virt
  - description: Virtual machines
    name: vms
  - description: Workloads & topology
    name: workloads
paths:
  /api/supervisors/{name}/security/flows/dns-blocked:
    get:
      tags:
        - security
      summary: Flow dnsblocked
      description: >-
        **Authorisation:** `security:Read` on
        `krn:celum:supervisor:{name}:security:*`.


        **Assistant tool:** `get_dns_blocked_attempts`
      operationId: get_supervisors_byName_security_flows_dnsBlocked
      parameters:
        - description: >-
            The supervisor's name, as registered under Administration →
            Supervisors.
          in: path
          name: name
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.dnsBlockedResponse'
          description: Success.
        '401':
          description: Not authenticated — no valid session cookie or API token.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.ErrorBody'
          description: >-
            Authenticated, but no policy allows this action on this resource.
            The body carries the action and resource that were evaluated.
        '502':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.ErrorBody'
          description: Bad Gateway.
components:
  schemas:
    api.dnsBlockedResponse:
      properties:
        block:
          type: boolean
        groups:
          items:
            $ref: '#/components/schemas/api.dnsBlockedGroup'
          nullable: true
          type: array
        honeypot:
          type: boolean
        noQueryLog:
          type: boolean
        since:
          type: string
        sinkholes:
          items:
            type: string
          nullable: true
          type: array
        threatBlock:
          type: boolean
        totals:
          properties:
            dns:
              format: int64
              type: integer
            policy:
              format: int64
              type: integer
            sinkhole:
              format: int64
              type: integer
          required:
            - dns
            - policy
            - sinkhole
          type: object
        truncated:
          type: boolean
      required:
        - block
        - groups
        - since
        - sinkholes
        - threatBlock
        - totals
      type: object
      x-go-type: backend/internal/api.dnsBlockedResponse
    api.ErrorBody:
      properties:
        error:
          type: string
      required:
        - error
      type: object
    api.dnsBlockedGroup:
      properties:
        attempts:
          format: int64
          type: integer
        events:
          items:
            $ref: '#/components/schemas/api.dnsBlockedEvent'
          nullable: true
          type: array
        first:
          format: date-time
          type: string
        guestCluster:
          type: string
        key:
          type: string
        kinds:
          items:
            type: string
          nullable: true
          type: array
        last:
          format: date-time
          type: string
        namespace:
          type: string
        pods:
          items:
            type: string
          nullable: true
          type: array
        project:
          type: string
        sourceIps:
          items:
            type: string
          nullable: true
          type: array
        workload:
          type: string
        workloadKind:
          type: string
      required:
        - attempts
        - events
        - first
        - key
        - kinds
        - last
        - namespace
        - pods
        - sourceIps
        - workload
      type: object
      x-go-type: backend/internal/api.dnsBlockedGroup
    api.dnsBlockedEvent:
      properties:
        kind:
          type: string
        layer:
          type: string
        node:
          type: string
        pod:
          type: string
        policy:
          type: string
        provider:
          type: string
        sourceIp:
          type: string
        target:
          type: string
        time:
          format: date-time
          type: string
      required:
        - kind
        - layer
        - target
        - time
      type: object
      x-go-type: backend/internal/api.dnsBlockedEvent
  securitySchemes:
    sessionCookie:
      description: >-
        The session cookie issued by the OIDC sign-in flow. This is what a
        browser uses.
      in: cookie
      name: k8s-gate-session
      type: apiKey
    bearerToken:
      description: >-
        An API token, minted from your own identity page. A token carries the
        IAM groups you held **when it was minted**, and cannot bypass deletion
        approval — except for guest clusters inside a project that same token
        created.
      scheme: bearer
      type: http

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.