Firewall

FirewallLockdowns

List Zone Lockdown rules

client.firewall.lockdowns.list(, ?): V4PagePaginationArray<Lockdown { id, configurations, created_on, 4 more } >

GET/zones/{zone_id}/firewall/lockdowns

Get a Zone Lockdown rule

client.firewall.lockdowns.get(, , ?): Lockdown { id, configurations, created_on, 4 more }

GET/zones/{zone_id}/firewall/lockdowns/{lock_downs_id}

Create a Zone Lockdown rule

client.firewall.lockdowns.create(, ?): Lockdown { id, configurations, created_on, 4 more }

POST/zones/{zone_id}/firewall/lockdowns

Update a Zone Lockdown rule

client.firewall.lockdowns.update(, , ?): Lockdown { id, configurations, created_on, 4 more }

PUT/zones/{zone_id}/firewall/lockdowns/{lock_downs_id}

Delete a Zone Lockdown rule

client.firewall.lockdowns.delete(, , ?): LockdownDeleteResponse { id }

DELETE/zones/{zone_id}/firewall/lockdowns/{lock_downs_id}

ModelsExpand Collapse

Configuration = Array<LockdownIPConfiguration { target, value } | LockdownCIDRConfiguration { target, value } >

A list of IP addresses or CIDR ranges that will be allowed to access the URLs specified in the Zone Lockdown rule. You can include any number of ip or ip_range configurations.

One of the following:

LockdownIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the Zone Lockdown rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

LockdownCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the Zone Lockdown rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24.

Lockdown { id, configurations, created_on, 4 more }

id: string

The unique identifier of the Zone Lockdown rule.

maxLength32

configurations: Configuration { , }

A list of IP addresses or CIDR ranges that will be allowed to access the URLs specified in the Zone Lockdown rule. You can include any number of ip or ip_range configurations.

created_on: string

The timestamp of when the rule was created.

formatdate-time

description: string

An informative summary of the rule.

maxLength1024

modified_on: string

The timestamp of when the rule was last modified.

formatdate-time

paused: boolean

When true, indicates that the rule is currently paused.

urls: Array<LockdownURL>

The URLs to include in the rule definition. You can use wildcards. Each entered URL will be escaped before use, which means you can only use simple wildcard patterns.

LockdownCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the Zone Lockdown rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24.

LockdownIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the Zone Lockdown rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

LockdownURL = string

LockdownDeleteResponse { id }

id?: string

The unique identifier of the Zone Lockdown rule.

maxLength32

FirewallRules

List firewall rules

Deprecated

client.firewall.rules.list(, ?): V4PagePaginationArray<FirewallRule { id, action, description, 5 more } >

GET/zones/{zone_id}/firewall/rules

Get a firewall rule

Deprecated

client.firewall.rules.get(, , ?): FirewallRule { id, action, description, 5 more }

GET/zones/{zone_id}/firewall/rules/{rule_id}

Create firewall rules

Deprecated

client.firewall.rules.create(, ?): SinglePage<FirewallRule { id, action, description, 5 more } >

POST/zones/{zone_id}/firewall/rules

Update a firewall rule

Deprecated

client.firewall.rules.update(, , ?): FirewallRule { id, action, description, 5 more }

PUT/zones/{zone_id}/firewall/rules/{rule_id}

Update priority of a firewall rule

Deprecated

client.firewall.rules.edit(, , ?): SinglePage<FirewallRule { id, action, description, 5 more } >

PATCH/zones/{zone_id}/firewall/rules/{rule_id}

Delete a firewall rule

Deprecated

client.firewall.rules.delete(, , ?): FirewallRule { id, action, description, 5 more }

DELETE/zones/{zone_id}/firewall/rules/{rule_id}

Update firewall rules

Deprecated

client.firewall.rules.bulkUpdate(, ?): SinglePage<FirewallRule { id, action, description, 5 more } >

PUT/zones/{zone_id}/firewall/rules

Update priority of firewall rules

Deprecated

client.firewall.rules.bulkEdit(, ?): SinglePage<FirewallRule { id, action, description, 5 more } >

PATCH/zones/{zone_id}/firewall/rules

Delete firewall rules

Deprecated

client.firewall.rules.bulkDelete(, ?): SinglePage<FirewallRule { id, action, description, 5 more } >

DELETE/zones/{zone_id}/firewall/rules

ModelsExpand Collapse

DeletedFilter { id, deleted }

id: string

The unique identifier of the filter.

maxLength32

minLength32

deleted: boolean

When true, indicates that the firewall rule was deleted.

FirewallRule { id, action, description, 5 more }

id?: string

The unique identifier of the firewall rule.

maxLength32

action?: Action

The action to apply to a matched request. The log action is only available on an Enterprise plan.

description?: string

An informative summary of the firewall rule.

maxLength500

filter?: FirewallFilter { id, description, expression, 2 more } | DeletedFilter { id, deleted }

One of the following:

FirewallFilter { id, description, expression, 2 more }

id?: string

The unique identifier of the filter.

maxLength32

minLength32

description?: string

An informative summary of the filter.

maxLength500

expression?: string

The filter expression. For more information, refer to Expressions.

paused?: boolean

When true, indicates that the filter is currently paused.

ref?: string

A short reference tag. Allows you to select related filters.

maxLength50

DeletedFilter { id, deleted }

id: string

The unique identifier of the filter.

maxLength32

minLength32

deleted: boolean

When true, indicates that the firewall rule was deleted.

paused?: boolean

When true, indicates that the firewall rule is currently paused.

priority?: number

The priority of the rule. Optional value used to define the processing order. A lower number indicates a higher priority. If not provided, rules with a defined priority will be processed before rules without a priority.

maximum2147483647

minimum0

products?: Array<Product>

One of the following:

"zoneLockdown"

"uaBlock"

"bic"

"hot"

"securityLevel"

"rateLimit"

"waf"

ref?: string

A short reference tag. Allows you to select related firewall rules.

maxLength50

Product = "zoneLockdown" | "uaBlock" | "bic" | 4 more

A list of products to bypass for a request when using the bypass action.

One of the following:

"zoneLockdown"

"uaBlock"

"bic"

"hot"

"securityLevel"

"rateLimit"

"waf"

FirewallAccess Rules

List IP Access rules

client.firewall.accessRules.list(?, ?): V4PagePaginationArray<AccessRuleListResponse { id, allowed_modes, configuration, 5 more } >

GET/{accounts_or_zones}/{account_or_zone_id}/firewall/access_rules/rules

Get an IP Access rule

client.firewall.accessRules.get(, ?, ?): AccessRuleGetResponse { id, allowed_modes, configuration, 5 more }

GET/{accounts_or_zones}/{account_or_zone_id}/firewall/access_rules/rules/{rule_id}

Create an IP Access rule

client.firewall.accessRules.create(, ?): AccessRuleCreateResponse { id, allowed_modes, configuration, 5 more }

POST/{accounts_or_zones}/{account_or_zone_id}/firewall/access_rules/rules

Update an IP Access rule

client.firewall.accessRules.edit(, , ?): AccessRuleEditResponse { id, allowed_modes, configuration, 5 more }

PATCH/{accounts_or_zones}/{account_or_zone_id}/firewall/access_rules/rules/{rule_id}

Delete an IP Access rule

client.firewall.accessRules.delete(, ?, ?): AccessRuleDeleteResponse { id } | null

DELETE/{accounts_or_zones}/{account_or_zone_id}/firewall/access_rules/rules/{rule_id}

ModelsExpand Collapse

AccessRuleCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24 for IPv4 ranges, and prefix lengths /32, /48, and /64 for IPv6 ranges.

AccessRuleIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

ASNConfiguration { target, value }

target?: "asn"

The configuration target. You must set the target to asn when specifying an Autonomous System Number (ASN) in the rule.

value?: string

The AS number to match.

CountryConfiguration { target, value }

target?: "country"

The configuration target. You must set the target to country when specifying a country code in the rule.

value?: string

The two-letter ISO-3166-1 alpha-2 code to match. For more information, refer to IP Access rules: Parameters.

IPV6Configuration { target, value }

target?: "ip6"

The configuration target. You must set the target to ip6 when specifying an IPv6 address in the rule.

value?: string

The IPv6 address to match.

AccessRuleListResponse { id, allowed_modes, configuration, 5 more }

id: string

The unique identifier of the IP Access rule.

maxLength32

allowed_modes: Array<"block" | "challenge" | "whitelist" | 2 more>

The available actions that a rule can apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

configuration: AccessRuleIPConfiguration { target, value } | IPV6Configuration { target, value } | AccessRuleCIDRConfiguration { target, value } | 2 more

The rule configuration.

One of the following:

AccessRuleIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

IPV6Configuration { target, value }

target?: "ip6"

The configuration target. You must set the target to ip6 when specifying an IPv6 address in the rule.

value?: string

The IPv6 address to match.

AccessRuleCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24 for IPv4 ranges, and prefix lengths /32, /48, and /64 for IPv6 ranges.

ASNConfiguration { target, value }

target?: "asn"

The configuration target. You must set the target to asn when specifying an Autonomous System Number (ASN) in the rule.

value?: string

The AS number to match.

CountryConfiguration { target, value }

target?: "country"

The configuration target. You must set the target to country when specifying a country code in the rule.

value?: string

The two-letter ISO-3166-1 alpha-2 code to match. For more information, refer to IP Access rules: Parameters.

mode: "block" | "challenge" | "whitelist" | 2 more

The action to apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

created_on?: string

The timestamp of when the rule was created.

formatdate-time

modified_on?: string

The timestamp of when the rule was last modified.

formatdate-time

notes?: string

An informative summary of the rule, typically used as a reminder or explanation.

scope?: Scope { id, email, type }

All zones owned by the user will have the rule applied.

id?: string

Defines an identifier.

maxLength32

email?: string

The contact email address of the user.

maxLength90

type?: "user" | "organization"

Defines the scope of the rule.

One of the following:

"user"

"organization"

AccessRuleGetResponse { id, allowed_modes, configuration, 5 more }

id: string

The unique identifier of the IP Access rule.

maxLength32

allowed_modes: Array<"block" | "challenge" | "whitelist" | 2 more>

The available actions that a rule can apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

configuration: AccessRuleIPConfiguration { target, value } | IPV6Configuration { target, value } | AccessRuleCIDRConfiguration { target, value } | 2 more

The rule configuration.

One of the following:

AccessRuleIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

IPV6Configuration { target, value }

target?: "ip6"

The configuration target. You must set the target to ip6 when specifying an IPv6 address in the rule.

value?: string

The IPv6 address to match.

AccessRuleCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24 for IPv4 ranges, and prefix lengths /32, /48, and /64 for IPv6 ranges.

ASNConfiguration { target, value }

target?: "asn"

The configuration target. You must set the target to asn when specifying an Autonomous System Number (ASN) in the rule.

value?: string

The AS number to match.

CountryConfiguration { target, value }

target?: "country"

The configuration target. You must set the target to country when specifying a country code in the rule.

value?: string

The two-letter ISO-3166-1 alpha-2 code to match. For more information, refer to IP Access rules: Parameters.

mode: "block" | "challenge" | "whitelist" | 2 more

The action to apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

created_on?: string

The timestamp of when the rule was created.

formatdate-time

modified_on?: string

The timestamp of when the rule was last modified.

formatdate-time

notes?: string

An informative summary of the rule, typically used as a reminder or explanation.

scope?: Scope { id, email, type }

All zones owned by the user will have the rule applied.

id?: string

Defines an identifier.

maxLength32

email?: string

The contact email address of the user.

maxLength90

type?: "user" | "organization"

Defines the scope of the rule.

One of the following:

"user"

"organization"

AccessRuleCreateResponse { id, allowed_modes, configuration, 5 more }

id: string

The unique identifier of the IP Access rule.

maxLength32

allowed_modes: Array<"block" | "challenge" | "whitelist" | 2 more>

The available actions that a rule can apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

configuration: AccessRuleIPConfiguration { target, value } | IPV6Configuration { target, value } | AccessRuleCIDRConfiguration { target, value } | 2 more

The rule configuration.

One of the following:

AccessRuleIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

IPV6Configuration { target, value }

target?: "ip6"

The configuration target. You must set the target to ip6 when specifying an IPv6 address in the rule.

value?: string

The IPv6 address to match.

AccessRuleCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24 for IPv4 ranges, and prefix lengths /32, /48, and /64 for IPv6 ranges.

ASNConfiguration { target, value }

target?: "asn"

The configuration target. You must set the target to asn when specifying an Autonomous System Number (ASN) in the rule.

value?: string

The AS number to match.

CountryConfiguration { target, value }

target?: "country"

The configuration target. You must set the target to country when specifying a country code in the rule.

value?: string

The two-letter ISO-3166-1 alpha-2 code to match. For more information, refer to IP Access rules: Parameters.

mode: "block" | "challenge" | "whitelist" | 2 more

The action to apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

created_on?: string

The timestamp of when the rule was created.

formatdate-time

modified_on?: string

The timestamp of when the rule was last modified.

formatdate-time

notes?: string

An informative summary of the rule, typically used as a reminder or explanation.

scope?: Scope { id, email, type }

All zones owned by the user will have the rule applied.

id?: string

Defines an identifier.

maxLength32

email?: string

The contact email address of the user.

maxLength90

type?: "user" | "organization"

Defines the scope of the rule.

One of the following:

"user"

"organization"

AccessRuleEditResponse { id, allowed_modes, configuration, 5 more }

id: string

The unique identifier of the IP Access rule.

maxLength32

allowed_modes: Array<"block" | "challenge" | "whitelist" | 2 more>

The available actions that a rule can apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

configuration: AccessRuleIPConfiguration { target, value } | IPV6Configuration { target, value } | AccessRuleCIDRConfiguration { target, value } | 2 more

The rule configuration.

One of the following:

AccessRuleIPConfiguration { target, value }

target?: "ip"

The configuration target. You must set the target to ip when specifying an IP address in the rule.

value?: string

The IP address to match. This address will be compared to the IP address of incoming requests.

IPV6Configuration { target, value }

target?: "ip6"

The configuration target. You must set the target to ip6 when specifying an IPv6 address in the rule.

value?: string

The IPv6 address to match.

AccessRuleCIDRConfiguration { target, value }

target?: "ip_range"

The configuration target. You must set the target to ip_range when specifying an IP address range in the rule.

value?: string

The IP address range to match. You can only use prefix lengths /16 and /24 for IPv4 ranges, and prefix lengths /32, /48, and /64 for IPv6 ranges.

ASNConfiguration { target, value }

target?: "asn"

The configuration target. You must set the target to asn when specifying an Autonomous System Number (ASN) in the rule.

value?: string

The AS number to match.

CountryConfiguration { target, value }

target?: "country"

The configuration target. You must set the target to country when specifying a country code in the rule.

value?: string

The two-letter ISO-3166-1 alpha-2 code to match. For more information, refer to IP Access rules: Parameters.

mode: "block" | "challenge" | "whitelist" | 2 more

The action to apply to a matched request.

One of the following:

"block"

"challenge"

"whitelist"

"js_challenge"

"managed_challenge"

created_on?: string

The timestamp of when the rule was created.

formatdate-time

modified_on?: string

The timestamp of when the rule was last modified.

formatdate-time

notes?: string

An informative summary of the rule, typically used as a reminder or explanation.

scope?: Scope { id, email, type }

All zones owned by the user will have the rule applied.

id?: string

Defines an identifier.

maxLength32

email?: string

The contact email address of the user.

maxLength90

type?: "user" | "organization"

Defines the scope of the rule.

One of the following:

"user"

"organization"

AccessRuleDeleteResponse { id }

id: string

Defines an identifier.

maxLength32

FirewallUA Rules

List User Agent Blocking rules

client.firewall.uaRules.list(, ?): V4PagePaginationArray<UARuleListResponse { id, configuration, description, 2 more } >

GET/zones/{zone_id}/firewall/ua_rules

Get a User Agent Blocking rule

client.firewall.uaRules.get(, , ?): UARuleGetResponse { id, configuration, description, 2 more }

GET/zones/{zone_id}/firewall/ua_rules/{ua_rule_id}

Create a User Agent Blocking rule

client.firewall.uaRules.create(, ?): UARuleCreateResponse { id, configuration, description, 2 more }

POST/zones/{zone_id}/firewall/ua_rules

Update a User Agent Blocking rule

client.firewall.uaRules.update(, , ?): UARuleUpdateResponse { id, configuration, description, 2 more }

PUT/zones/{zone_id}/firewall/ua_rules/{ua_rule_id}

Delete a User Agent Blocking rule

client.firewall.uaRules.delete(, , ?): UARuleDeleteResponse { id, configuration, description, 2 more }

DELETE/zones/{zone_id}/firewall/ua_rules/{ua_rule_id}

ModelsExpand Collapse

UARuleListResponse { id, configuration, description, 2 more }

id?: string

The unique identifier of the User Agent Blocking rule.

maxLength32

configuration?: Configuration { target, value }

The configuration object for the current rule.

target?: string

The configuration target for this rule. You must set the target to ua for User Agent Blocking rules.

value?: string

The exact user agent string to match. This value will be compared to the received User-Agent HTTP header value.

description?: string

An informative summary of the rule.

maxLength1024

mode?: "block" | "challenge" | "js_challenge" | "managed_challenge"

The action to apply to a matched request.

maxLength12

One of the following:

"block"

"challenge"

"js_challenge"

"managed_challenge"

paused?: boolean

When true, indicates that the rule is currently paused.

UARuleGetResponse { id, configuration, description, 2 more }

id?: string

The unique identifier of the User Agent Blocking rule.

maxLength32

configuration?: Configuration { target, value }

The configuration object for the current rule.

target?: string

The configuration target for this rule. You must set the target to ua for User Agent Blocking rules.

value?: string

The exact user agent string to match. This value will be compared to the received User-Agent HTTP header value.

description?: string

An informative summary of the rule.

maxLength1024

mode?: "block" | "challenge" | "js_challenge" | "managed_challenge"

The action to apply to a matched request.

maxLength12

One of the following:

"block"

"challenge"

"js_challenge"

"managed_challenge"

paused?: boolean

When true, indicates that the rule is currently paused.

UARuleCreateResponse { id, configuration, description, 2 more }

id?: string

The unique identifier of the User Agent Blocking rule.

maxLength32

configuration?: Configuration { target, value }

The configuration object for the current rule.

target?: string

The configuration target for this rule. You must set the target to ua for User Agent Blocking rules.

value?: string

The exact user agent string to match. This value will be compared to the received User-Agent HTTP header value.

description?: string

An informative summary of the rule.

maxLength1024

mode?: "block" | "challenge" | "js_challenge" | "managed_challenge"

The action to apply to a matched request.

maxLength12

One of the following:

"block"

"challenge"

"js_challenge"

"managed_challenge"

paused?: boolean

When true, indicates that the rule is currently paused.

UARuleUpdateResponse { id, configuration, description, 2 more }

id?: string

The unique identifier of the User Agent Blocking rule.

maxLength32

configuration?: Configuration { target, value }

The configuration object for the current rule.

target?: string

The configuration target for this rule. You must set the target to ua for User Agent Blocking rules.

value?: string

The exact user agent string to match. This value will be compared to the received User-Agent HTTP header value.

description?: string

An informative summary of the rule.

maxLength1024

mode?: "block" | "challenge" | "js_challenge" | "managed_challenge"

The action to apply to a matched request.

maxLength12

One of the following:

"block"

"challenge"

"js_challenge"

"managed_challenge"

paused?: boolean

When true, indicates that the rule is currently paused.

UARuleDeleteResponse { id, configuration, description, 2 more }

id?: string

The unique identifier of the User Agent Blocking rule.

maxLength32

configuration?: Configuration { target, value }

The configuration object for the current rule.

target?: string

The configuration target for this rule. You must set the target to ua for User Agent Blocking rules.

value?: string

The exact user agent string to match. This value will be compared to the received User-Agent HTTP header value.

description?: string

An informative summary of the rule.

maxLength1024

mode?: "block" | "challenge" | "js_challenge" | "managed_challenge"

The action to apply to a matched request.

maxLength12

One of the following:

"block"

"challenge"

"js_challenge"

"managed_challenge"

paused?: boolean

When true, indicates that the rule is currently paused.

FirewallWAF

FirewallWAFOverrides

List WAF overrides

Deprecated

client.firewall.waf.overrides.list(, ?): V4PagePaginationArray<Override { id, description, groups, 5 more } >

GET/zones/{zone_id}/firewall/waf/overrides

Get a WAF override

Deprecated

client.firewall.waf.overrides.get(, , ?): Override { id, description, groups, 5 more }

GET/zones/{zone_id}/firewall/waf/overrides/{overrides_id}

Create a WAF override

Deprecated

client.firewall.waf.overrides.create(, ?): Override { id, description, groups, 5 more }

POST/zones/{zone_id}/firewall/waf/overrides

Update WAF override

Deprecated

client.firewall.waf.overrides.update(, , ?): Override { id, description, groups, 5 more }

PUT/zones/{zone_id}/firewall/waf/overrides/{overrides_id}

Delete a WAF override

Deprecated

client.firewall.waf.overrides.delete(, , ?): OverrideDeleteResponse { id }

DELETE/zones/{zone_id}/firewall/waf/overrides/{overrides_id}

ModelsExpand Collapse

Override { id, description, groups, 5 more }

id?: string

The unique identifier of the WAF override.

maxLength32

description?: string | null

An informative summary of the current URI-based WAF override.

maxLength1024

groups?: Record<string, unknown>

An object that allows you to enable or disable WAF rule groups for the current WAF override. Each key of this object must be the ID of a WAF rule group, and each value must be a valid WAF action (usually default or disable). When creating a new URI-based WAF override, you must provide a groups object or a rules object.

paused?: boolean

When true, indicates that the rule is currently paused.

priority?: number

The relative priority of the current URI-based WAF override when multiple overrides match a single URL. A lower number indicates higher priority. Higher priority overrides may overwrite values set by lower priority overrides.

maximum1000000000

minimum-1000000000

rewrite_action?: RewriteAction { block, challenge, default, 2 more }

Specifies that, when a WAF rule matches, its configured action will be replaced by the action configured in this object.

rules?: WAFRule { , , , 2 more }

An object that allows you to override the action of specific WAF rules. Each key of this object must be the ID of a WAF rule, and each value must be a valid WAF action. Unless you are disabling a rule, ensure that you also enable the rule group that this WAF rule belongs to. When creating a new URI-based WAF override, you must provide a groups object or a rules object.

urls?: Array<OverrideURL>

The URLs to include in the current WAF override. You can use wildcards. Each entered URL will be escaped before use, which means you can only use simple wildcard patterns.

OverrideURL = string

RewriteAction { block, challenge, default, 2 more }

Specifies that, when a WAF rule matches, its configured action will be replaced by the action configured in this object.

block?: "challenge" | "block" | "simulate" | 2 more

The WAF rule action to apply.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

challenge?: "challenge" | "block" | "simulate" | 2 more

The WAF rule action to apply.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

default?: "challenge" | "block" | "simulate" | 2 more

The WAF rule action to apply.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

disable?: "challenge" | "block" | "simulate" | 2 more

The WAF rule action to apply.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

simulate?: "challenge" | "block" | "simulate" | 2 more

The WAF rule action to apply.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

WAFRule = Record<string, "challenge" | "block" | "simulate" | 2 more>

An object that allows you to override the action of specific WAF rules. Each key of this object must be the ID of a WAF rule, and each value must be a valid WAF action. Unless you are disabling a rule, ensure that you also enable the rule group that this WAF rule belongs to. When creating a new URI-based WAF override, you must provide a groups object or a rules object.

One of the following:

"challenge"

"block"

"simulate"

"disable"

"default"

OverrideDeleteResponse { id }

id?: string

The unique identifier of the WAF override.

maxLength32

FirewallWAFPackages

List WAF packages

Deprecated

client.firewall.waf.packages.list(, ?): V4PagePaginationArray<PackageListResponse>

GET/zones/{zone_id}/firewall/waf/packages

Get a WAF package

Deprecated

client.firewall.waf.packages.get(, , ?): PackageGetResponse

GET/zones/{zone_id}/firewall/waf/packages/{package_id}

ModelsExpand Collapse

PackageListResponse = unknown

PackageGetResponse = FirewallAPIResponseSingle { errors, messages, result, success } | Result { result }

One of the following:

FirewallAPIResponseSingle { errors, messages, result, success }

errors: Array<ResponseInfo { code, message, documentation_url, source } >

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<ResponseInfo { code, message, documentation_url, source } >

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

result: unknown | string | null

One of the following:

unknown

string | null

success: true

Defines whether the API call was successful.

Result { result }

result?: unknown

FirewallWAFPackagesGroups

List WAF rule groups

Deprecated

client.firewall.waf.packages.groups.list(, , ?): V4PagePaginationArray<Group { id, description, mode, 5 more } >

GET/zones/{zone_id}/firewall/waf/packages/{package_id}/groups

Get a WAF rule group

Deprecated

client.firewall.waf.packages.groups.get(, , , ?): GroupGetResponse

GET/zones/{zone_id}/firewall/waf/packages/{package_id}/groups/{group_id}

Update a WAF rule group

Deprecated

client.firewall.waf.packages.groups.edit(, , , ?): GroupEditResponse

PATCH/zones/{zone_id}/firewall/waf/packages/{package_id}/groups/{group_id}

ModelsExpand Collapse

Group { id, description, mode, 5 more }

id: string

Defines the unique identifier of the rule group.

maxLength32

description: string | null

Defines an informative summary of what the rule group does.

mode: "on" | "off"

Defines the state of the rules contained in the rule group. When on, the rules in the group are configurable/usable.

One of the following:

"on"

"off"

name: string

Defines the name of the rule group.

rules_count: number

Defines the number of rules in the current rule group.

allowed_modes?: Array<"on" | "off">

Defines the available states for the rule group.

One of the following:

"on"

"off"

modified_rules_count?: number

Defines the number of rules within the group that have been modified from their default configuration.

package_id?: string

Defines the unique identifier of a WAF package.

maxLength32

GroupGetResponse = unknown | string | null

One of the following:

unknown

string | null

GroupEditResponse = unknown | string | null

One of the following:

unknown

string | null

FirewallWAFPackagesRules

List WAF rules

Deprecated

client.firewall.waf.packages.rules.list(, , ?): V4PagePaginationArray<RuleListResponse>

GET/zones/{zone_id}/firewall/waf/packages/{package_id}/rules

Get a WAF rule

Deprecated

client.firewall.waf.packages.rules.get(, , , ?): RuleGetResponse

GET/zones/{zone_id}/firewall/waf/packages/{package_id}/rules/{rule_id}

Update a WAF rule

Deprecated

client.firewall.waf.packages.rules.edit(, , , ?): RuleEditResponse

PATCH/zones/{zone_id}/firewall/waf/packages/{package_id}/rules/{rule_id}

ModelsExpand Collapse

AllowedModesAnomaly = "on" | "off"

Defines the mode anomaly. When set to on, the current WAF rule will be used when evaluating the request. Applies to anomaly detection WAF rules.

One of the following:

"on"

"off"

WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

id?: string

Defines the unique identifier of the rule group.

maxLength32

name?: string

Defines the name of the rule group.

RuleListResponse = WAFManagedRulesAnomalyRule { id, allowed_modes, description, 4 more } | WAFManagedRulesTraditionalDenyRule { id, allowed_modes, default_mode, 5 more } | WAFManagedRulesTraditionalAllowRule { id, allowed_modes, description, 4 more }

When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

One of the following:

WAFManagedRulesAnomalyRule { id, allowed_modes, description, 4 more }

When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<AllowedModesAnomaly>

Defines the available modes for the current WAF rule. Applies to anomaly detection WAF rules.

One of the following:

"on"

"off"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: AllowedModesAnomaly

Defines the mode anomaly. When set to on, the current WAF rule will be used when evaluating the request. Applies to anomaly detection WAF rules.

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.

WAFManagedRulesTraditionalDenyRule { id, allowed_modes, default_mode, 5 more }

When triggered, traditional WAF rules cause the firewall to immediately act upon the request based on the configuration of the rule. A ‘deny’ rule will immediately respond to the request based on the configured rule action/mode (for example, ‘block’) and no other rules will be processed.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<"default" | "disable" | "simulate" | 2 more>

Defines the list of possible actions of the WAF rule when it is triggered.

One of the following:

"default"

"disable"

"simulate"

"block"

"challenge"

default_mode: "disable" | "simulate" | "block" | "challenge"

Defines the default action/mode of a rule.

One of the following:

"disable"

"simulate"

"block"

"challenge"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: "default" | "disable" | "simulate" | 2 more

Defines the action that the current WAF rule will perform when triggered. Applies to traditional (deny) WAF rules.

One of the following:

"default"

"disable"

"simulate"

"block"

"challenge"

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.

WAFManagedRulesTraditionalAllowRule { id, allowed_modes, description, 4 more }

When triggered, traditional WAF rules cause the firewall to immediately act on the request based on the rule configuration. An ‘allow’ rule will immediately allow the request and no other rules will be processed.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<"on" | "off">

Defines the available modes for the current WAF rule.

One of the following:

"on"

"off"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: "on" | "off"

When set to on, the current rule will be used when evaluating the request. Applies to traditional (allow) WAF rules.

One of the following:

"on"

"off"

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.

RuleGetResponse = unknown | string | null

One of the following:

unknown

string | null

RuleEditResponse = WAFManagedRulesAnomalyRule { id, allowed_modes, description, 4 more } | WAFManagedRulesTraditionalDenyRule { id, allowed_modes, default_mode, 5 more } | WAFManagedRulesTraditionalAllowRule { id, allowed_modes, description, 4 more }

When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

One of the following:

WAFManagedRulesAnomalyRule { id, allowed_modes, description, 4 more }

When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<AllowedModesAnomaly>

Defines the available modes for the current WAF rule. Applies to anomaly detection WAF rules.

One of the following:

"on"

"off"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: AllowedModesAnomaly

Defines the mode anomaly. When set to on, the current WAF rule will be used when evaluating the request. Applies to anomaly detection WAF rules.

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.

WAFManagedRulesTraditionalDenyRule { id, allowed_modes, default_mode, 5 more }

When triggered, traditional WAF rules cause the firewall to immediately act upon the request based on the configuration of the rule. A ‘deny’ rule will immediately respond to the request based on the configured rule action/mode (for example, ‘block’) and no other rules will be processed.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<"default" | "disable" | "simulate" | 2 more>

Defines the list of possible actions of the WAF rule when it is triggered.

One of the following:

"default"

"disable"

"simulate"

"block"

"challenge"

default_mode: "disable" | "simulate" | "block" | "challenge"

Defines the default action/mode of a rule.

One of the following:

"disable"

"simulate"

"block"

"challenge"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: "default" | "disable" | "simulate" | 2 more

Defines the action that the current WAF rule will perform when triggered. Applies to traditional (deny) WAF rules.

One of the following:

"default"

"disable"

"simulate"

"block"

"challenge"

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.

WAFManagedRulesTraditionalAllowRule { id, allowed_modes, description, 4 more }

When triggered, traditional WAF rules cause the firewall to immediately act on the request based on the rule configuration. An ‘allow’ rule will immediately allow the request and no other rules will be processed.

id: string

Defines the unique identifier of the WAF rule.

maxLength32

allowed_modes: Array<"on" | "off">

Defines the available modes for the current WAF rule.

One of the following:

"on"

"off"

description: string

Defines the public description of the WAF rule.

group: WAFRuleGroup { id, name }

Defines the rule group to which the current WAF rule belongs.

mode: "on" | "off"

When set to on, the current rule will be used when evaluating the request. Applies to traditional (allow) WAF rules.

One of the following:

"on"

"off"

package_id: string

Defines the unique identifier of a WAF package.

maxLength32

priority: string

Defines the order in which the individual WAF rule is executed within its rule group.