Skip to content
Cloudflare API
Start here
API Reference

Fraud

Get Fraud Detection Settings
client.fraud.get(FraudGetParams { zone_id } params, RequestOptionsoptions?): FraudSettings { authentication_settings, user_profiles, username_expressions }
GET/zones/{zone_id}/fraud_detection/settings
Update Fraud Detection Settings
client.fraud.update(FraudUpdateParams { zone_id, authentication_settings, user_profiles, username_expressions } params, RequestOptionsoptions?): FraudSettings { authentication_settings, user_profiles, username_expressions }
PUT/zones/{zone_id}/fraud_detection/settings
ModelsExpand Collapse
FraudSettings { authentication_settings, user_profiles, username_expressions }
authentication_settings?: AuthenticationSettings { failure_criteria, success_criteria }

Configuration for classifying login authentication outcomes based on the origin response. Requires user_profiles to be enabled.

  • Success and failure criteria are independently updatable — sending only success_criteria leaves failure codes untouched, and vice versa.
  • Omit authentication_settings entirely to leave both unchanged.
  • Status codes must not overlap between success and failure criteria.
failure_criteria?: FailureCriteria { kind, status_codes }

Criterion for identifying failed login responses.

kind: "status_code"

The type of criterion. Currently only status_code is supported.

status_codes?: Array<number>

HTTP status codes to match against the origin response.

  • Maximum of 10 codes per criterion.
  • Each code must be a valid HTTP status code (100-599).
  • Codes are deduplicated and sorted on save.
  • Omit to leave unchanged on update.
  • Provide an empty array [] to clear codes on update.
success_criteria?: SuccessCriteria { kind, status_codes }

Criterion for identifying successful login responses.

kind: "status_code"

The type of criterion. Currently only status_code is supported.

status_codes?: Array<number>

HTTP status codes to match against the origin response.

  • Maximum of 10 codes per criterion.
  • Each code must be a valid HTTP status code (100-599).
  • Codes are deduplicated and sorted on save.
  • Omit to leave unchanged on update.
  • Provide an empty array [] to clear codes on update.
user_profiles?: "enabled" | "disabled"

Whether Fraud User Profiles is enabled for the zone.

One of the following:
"enabled"
"disabled"
username_expressions?: Array<string>

List of expressions to detect usernames in write HTTP requests.

  • Maximum of 10 expressions.
  • Omit or set to null to leave unchanged on update.
  • Provide an empty array [] to clear all expressions on update.
  • Invalid expressions will result in a 10400 Bad Request with details in the messages array.