Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[WAF] Use APIRequest component in API examples #21216

Draft
wants to merge 7 commits into
base: production
Choose a base branch
from
Draft

[WAF] Use APIRequest component in API examples #21216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
6aa82c4
Update account-level API examples
pedrosousa Mar 27, 2025
33a0b7c
Update custom rules API examples
pedrosousa Mar 27, 2025
a5a27a4
Update leaked credentials detection API examples
pedrosousa Mar 27, 2025
bfaff40
Update malicious uploads detection API examples (TODO)
pedrosousa Mar 27, 2025
fd8d08e
Update managed rulesets API examples
pedrosousa Mar 28, 2025
9441c2c
Update rate limiting rules API examples
pedrosousa Mar 28, 2025
2a743a5
Update API examples for additional tools (UA blocking, zone lockdown)
pedrosousa Mar 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 57 additions & 57 deletions src/content/docs/waf/account/custom-rulesets/create-api.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ head:
content: Create a WAF custom ruleset using the API
---

import { Render } from "~/components";
import { Render, APIRequest } from "~/components";

:::note
This feature requires an Enterprise plan with a paid add-on.
Expand All @@ -30,24 +30,23 @@ Currently, you can only deploy WAF custom rulesets at the account level.

The following example creates a custom ruleset with a single rule in the `rules` array.

```bash
curl "https://api.cloudflare.com/api/v4/accounts/{account_id}/rulesets" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"description": "",
"kind": "custom",
"name": "My custom ruleset",
"rules": [
{
"description": "Challenge web traffic (not /api)",
"expression": "not starts_with(http.request.uri.path, \"/api/\")",
"action": "managed_challenge"
}
],
"phase": "http_request_firewall_custom"
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets"
method="POST"
json={{
description: "",
kind: "custom",
name: "My custom ruleset",
rules: [
{
description: "Challenge web traffic (not /api)",
expression: 'not starts_with(http.request.uri.path, "/api/")',
action: "managed_challenge",
},
],
phase: "http_request_firewall_custom",
}}
/>

Save the ruleset ID in the response for the next step.

Expand All @@ -60,10 +59,13 @@ To deploy the custom ruleset, add a rule with `"action": "execute"` to the `http
params={{ phaseName: "http_request_firewall_custom" }}
/>

```bash
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/phases/http_request_firewall_custom/entrypoint" \
--header "Authorization: Bearer <API_TOKEN>"
```
<APIRequest
path="/accounts/{account_id}/rulesets/phases/{ruleset_phase}/entrypoint"
method="GET"
parameters={{
ruleset_phase: "http_request_firewall_custom",
}}
/>

```json output {4}
{
Expand Down Expand Up @@ -94,20 +96,19 @@ To deploy the custom ruleset, add a rule with `"action": "execute"` to the `http

The following request creates a rule that executes the custom ruleset with ID `<CUSTOM_RULESET_ID>` for all Enterprise zones in the account:

```bash
curl "https://dash.cloudflare.com/api/v4/accounts/{account_id}/rulesets/{ruleset_id}/rules" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"description": "Execute custom ruleset",
"expression": "(cf.zone.plan eq \"ENT\")",
"action": "execute",
"action_parameters": {
"id": "<CUSTOM_RULESET_ID>"
},
"enabled": true
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets/{ruleset_id}/rules"
method="POST"
json={{
description: "Execute custom ruleset",
expression: '(cf.zone.plan eq "ENT")',
action: "execute",
action_parameters: {
id: "<CUSTOM_RULESET_ID>",
},
enabled: true,
}}
/>

:::caution
You can only apply custom rulesets to incoming traffic of zones on an Enterprise plan. To enforce this requirement, you must include `cf.zone.plan eq "ENT"` in the expression of the `execute` rule deploying the custom ruleset.
Expand All @@ -121,26 +122,25 @@ To deploy the custom ruleset, add a rule with `"action": "execute"` to the `http
}}
/>

```bash
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"description": "",
"kind": "root",
"name": "Account-level phase entry point",
"rules": [
{
"action": "execute",
"expression": "(cf.zone.plan eq \"ENT\")",
"action_parameters": {
"id": "<CUSTOM_RULESET_ID>"
}
}
],
"phase": "http_request_firewall_custom"
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets"
method="POST"
json={{
description: "",
kind: "root",
name: "Account-level phase entry point",
rules: [
{
action: "execute",
expression: '(cf.zone.plan eq "ENT")',
action_parameters: {
id: "<CUSTOM_RULESET_ID>",
},
},
],
phase: "http_request_firewall_custom",
}}
/>

## Next steps

Expand Down
104 changes: 52 additions & 52 deletions src/content/docs/waf/account/managed-rulesets/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ sidebar:
order: 4
---

import { Render, Tabs, TabItem, Details } from "~/components";
import { Render, Tabs, TabItem, Details, APIRequest } from "~/components";

:::note
This feature requires an Enterprise plan with a paid add-on.
Expand Down Expand Up @@ -52,57 +52,57 @@ Once you finish your configuration, the **Deployed managed rulesets** list will

The following `POST` request for the [Create an account ruleset](/api/resources/rulesets/methods/create/) operation creates an [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_request_firewall_managed` phase at the account level. The ruleset includes two rules deploying the Cloudflare OWASP Core Ruleset twice with different configurations.

```bash
curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"name": "My ruleset",
"description": "Entry point ruleset for WAF managed rulesets (account)",
"kind": "root",
"phase": "http_request_firewall_managed",
"rules": [
{
"action": "execute",
"action_parameters": {
"id": "4814384a9e5d4991b9815dcfc25d2f1f",
"overrides": {
"categories": [
{
"category": "paranoia-level-4",
"enabled": false
}
],
"rules": [
{
"id": "6179ae15870a4bb7b2d480d4843b323c",
"action": "managed_challenge"
}
]
}
},
"expression": "cf.zone.plan eq \"ENT\"",
"description": "Execute OWASP ruleset at PL3 with Managed Challenge action"
},
{
"action": "execute",
"action_parameters": {
"id": "4814384a9e5d4991b9815dcfc25d2f1f",
"overrides": {
"rules": [
{
"id": "6179ae15870a4bb7b2d480d4843b323c",
"action": "log"
}
]
}
},
"expression": "cf.zone.plan eq \"ENT\"",
"description": "Execute OWASP ruleset at PL4 with Log action"
}
]
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets"
method="POST"
json={{
name: "My ruleset",
description: "Entry point ruleset for WAF managed rulesets (account)",
kind: "root",
phase: "http_request_firewall_managed",
rules: [
{
action: "execute",
action_parameters: {
id: "4814384a9e5d4991b9815dcfc25d2f1f",
overrides: {
categories: [
{
category: "paranoia-level-4",
enabled: false,
},
],
rules: [
{
id: "6179ae15870a4bb7b2d480d4843b323c",
action: "managed_challenge",
},
],
},
},
expression: 'cf.zone.plan eq "ENT"',
description:
"Execute OWASP ruleset at PL3 with Managed Challenge action",
},
{
action: "execute",
action_parameters: {
id: "4814384a9e5d4991b9815dcfc25d2f1f",
overrides: {
rules: [
{
id: "6179ae15870a4bb7b2d480d4843b323c",
action: "log",
},
],
},
},
expression: 'cf.zone.plan eq "ENT"',
description: "Execute OWASP ruleset at PL4 with Log action",
},
],
}}
/>

</TabItem> </Tabs>

Expand Down
Loading