Update an account or zone entry point ruleset
Updates an account or zone entry point ruleset, creating a new version.
Security
API Token
The preferred authorization scheme for interacting with the Cloudflare API. Create a token.
Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYYAPI Email + API Key
The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.
X-Auth-Email: user@example.comThe previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.
X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194Accepted Permissions (at least one required)
Mass URL Redirects WriteMagic Firewall WriteL4 DDoS Managed Ruleset WriteTransform Rules WriteSelect Configuration WriteAccount WAF WriteAccount Rulesets WriteLogs WriteParametersExpand Collapse
The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
The list of rules in the ruleset.
The list of rules in the ruleset.
class BlockRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsChallengeRule: …
exposed_credential_check: Optional[RuleRulesetsChallengeRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsChallengeRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class CompressResponseRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class DDoSDynamicRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ExecuteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
matched_data: Optional[ActionParametersMatchedData]The configuration to use for matched data logging.
The configuration to use for matched data logging.
overrides: Optional[ActionParametersOverrides]A set of overrides to apply to the target ruleset.
A set of overrides to apply to the target ruleset.
An action to override all rules with. This option has lower precedence than rule and category overrides.
categories: Optional[List[ActionParametersOverridesCategory]]A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ForceConnectionCloseRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsJSChallengeRule: …
exposed_credential_check: Optional[RuleRulesetsJSChallengeRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsJSChallengeRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class LogRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class LogCustomFieldRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
raw_response_fields: Optional[List[ActionParametersRawResponseField]]The raw response fields to log.
The raw response fields to log.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ManagedChallengeRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RedirectRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RewriteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
headers: Optional[Dict[str, ActionParametersHeaders]]A map of headers to rewrite.
A map of headers to rewrite.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RouteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ScoreRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ServeErrorRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
class ActionParametersActionParametersContent: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsSetCacheControlRule: …
action_parameters: Optional[RuleRulesetsSetCacheControlRuleActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
immutable: Optional[RuleRulesetsSetCacheControlRuleActionParametersImmutable]A cache-control directive configuration.
A cache-control directive configuration.
max_age: Optional[RuleRulesetsSetCacheControlRuleActionParametersMaxAge]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
must_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersMustRevalidate]A cache-control directive configuration.
A cache-control directive configuration.
must_understand: Optional[RuleRulesetsSetCacheControlRuleActionParametersMustUnderstand]A cache-control directive configuration.
A cache-control directive configuration.
no_cache: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoCache]A cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
class RuleRulesetsSetCacheControlRuleActionParametersNoCacheSetDirective: …Set the directive with optional qualifiers.
Set the directive with optional qualifiers.
no_store: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoStore]A cache-control directive configuration.
A cache-control directive configuration.
no_transform: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoTransform]A cache-control directive configuration.
A cache-control directive configuration.
private: Optional[RuleRulesetsSetCacheControlRuleActionParametersPrivate]A cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
class RuleRulesetsSetCacheControlRuleActionParametersPrivateSetDirective: …Set the directive with optional qualifiers.
Set the directive with optional qualifiers.
proxy_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersProxyRevalidate]A cache-control directive configuration.
A cache-control directive configuration.
public: Optional[RuleRulesetsSetCacheControlRuleActionParametersPublic]A cache-control directive configuration.
A cache-control directive configuration.
s_maxage: Optional[RuleRulesetsSetCacheControlRuleActionParametersSMaxage]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_if_error: Optional[RuleRulesetsSetCacheControlRuleActionParametersStaleIfError]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_while_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersStaleWhileRevalidate]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
exposed_credential_check: Optional[RuleRulesetsSetCacheControlRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsSetCacheControlRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SetCacheSettingsRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
A list of additional ports that caching should be enabled on.
browser_ttl: Optional[ActionParametersBrowserTTL]How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
cache_key: Optional[ActionParametersCacheKey]Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Whether to separate cached content based on the visitor's device type.
Whether to protect from web cache deception attacks, while allowing static assets to be cached.
custom_key: Optional[ActionParametersCacheKeyCustomKey]Which components of the request are included or excluded from the cache key.
Which components of the request are included or excluded from the cache key.
header: Optional[ActionParametersCacheKeyCustomKeyHeader]Which headers to include in the cache key.
Which headers to include in the cache key.
A list of headers to check for the presence of. The presence of these headers is included in the cache key.
query_string: Optional[ActionParametersCacheKeyCustomKeyQueryString]Which query string parameters to include in or exclude from the cache key.
Which query string parameters to include in or exclude from the cache key.
cache_reserve: Optional[ActionParametersCacheReserve]Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
edge_ttl: Optional[ActionParametersEdgeTTL]How long the Cloudflare edge network should cache the response.
How long the Cloudflare edge network should cache the response.
status_code_ttl: Optional[List[ActionParametersEdgeTTLStatusCodeTTL]]A list of TTLs to apply to specific status codes or status code ranges.
A list of TTLs to apply to specific status codes or status code ranges.
Whether to generate Cloudflare error pages for issues from the origin server.
A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
shared_dictionary: Optional[ActionParametersSharedDictionary]Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsSetCacheTagsRule: …
action_parameters: Optional[RuleRulesetsSetCacheTagsRuleActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
class RuleRulesetsSetCacheTagsRuleActionParametersAddCacheTagsValues: …Add cache tags using a list of values.
Add cache tags using a list of values.
class RuleRulesetsSetCacheTagsRuleActionParametersAddCacheTagsExpression: …Add cache tags using an expression.
Add cache tags using an expression.
class RuleRulesetsSetCacheTagsRuleActionParametersRemoveCacheTagsValues: …Remove cache tags using a list of values.
Remove cache tags using a list of values.
class RuleRulesetsSetCacheTagsRuleActionParametersRemoveCacheTagsExpression: …Remove cache tags using an expression.
Remove cache tags using an expression.
class RuleRulesetsSetCacheTagsRuleActionParametersSetCacheTagsValues: …Set cache tags using a list of values.
Set cache tags using a list of values.
exposed_credential_check: Optional[RuleRulesetsSetCacheTagsRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsSetCacheTagsRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SetConfigRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
Whether to disable Cloudflare Apps.
Whether to enable Mirage.
Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
request_body_buffering: Optional[Literal["none", "standard", "full"]]The request body buffering mode.
The request body buffering mode.
security_level: Optional[Literal["off", "essentially_off", "low", 3 more]]The Security Level to configure.
The Security Level to configure.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SkipRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
A phase to skip the execution of. This option is only compatible with the products option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
products: Optional[List[Literal["bic", "hot", "rateLimit", 4 more]]]A list of legacy security products to skip the execution of.
A list of legacy security products to skip the execution of.
A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
ReturnsExpand Collapse
class PhaseUpdateResponse: …A ruleset object.
A ruleset object.
rules: List[Rule]The list of rules in the ruleset.
The list of rules in the ruleset.
class BlockRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsChallengeRule: …
exposed_credential_check: Optional[RuleRulesetsChallengeRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsChallengeRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class CompressResponseRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class DDoSDynamicRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ExecuteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
matched_data: Optional[ActionParametersMatchedData]The configuration to use for matched data logging.
The configuration to use for matched data logging.
overrides: Optional[ActionParametersOverrides]A set of overrides to apply to the target ruleset.
A set of overrides to apply to the target ruleset.
An action to override all rules with. This option has lower precedence than rule and category overrides.
categories: Optional[List[ActionParametersOverridesCategory]]A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ForceConnectionCloseRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsJSChallengeRule: …
exposed_credential_check: Optional[RuleRulesetsJSChallengeRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsJSChallengeRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class LogRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class LogCustomFieldRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
raw_response_fields: Optional[List[ActionParametersRawResponseField]]The raw response fields to log.
The raw response fields to log.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ManagedChallengeRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RedirectRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RewriteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
headers: Optional[Dict[str, ActionParametersHeaders]]A map of headers to rewrite.
A map of headers to rewrite.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RouteRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ScoreRule: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class ServeErrorRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
class ActionParametersActionParametersContent: …
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsSetCacheControlRule: …
action_parameters: Optional[RuleRulesetsSetCacheControlRuleActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
immutable: Optional[RuleRulesetsSetCacheControlRuleActionParametersImmutable]A cache-control directive configuration.
A cache-control directive configuration.
max_age: Optional[RuleRulesetsSetCacheControlRuleActionParametersMaxAge]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
must_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersMustRevalidate]A cache-control directive configuration.
A cache-control directive configuration.
must_understand: Optional[RuleRulesetsSetCacheControlRuleActionParametersMustUnderstand]A cache-control directive configuration.
A cache-control directive configuration.
no_cache: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoCache]A cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
class RuleRulesetsSetCacheControlRuleActionParametersNoCacheSetDirective: …Set the directive with optional qualifiers.
Set the directive with optional qualifiers.
no_store: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoStore]A cache-control directive configuration.
A cache-control directive configuration.
no_transform: Optional[RuleRulesetsSetCacheControlRuleActionParametersNoTransform]A cache-control directive configuration.
A cache-control directive configuration.
private: Optional[RuleRulesetsSetCacheControlRuleActionParametersPrivate]A cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
class RuleRulesetsSetCacheControlRuleActionParametersPrivateSetDirective: …Set the directive with optional qualifiers.
Set the directive with optional qualifiers.
proxy_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersProxyRevalidate]A cache-control directive configuration.
A cache-control directive configuration.
public: Optional[RuleRulesetsSetCacheControlRuleActionParametersPublic]A cache-control directive configuration.
A cache-control directive configuration.
s_maxage: Optional[RuleRulesetsSetCacheControlRuleActionParametersSMaxage]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_if_error: Optional[RuleRulesetsSetCacheControlRuleActionParametersStaleIfError]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_while_revalidate: Optional[RuleRulesetsSetCacheControlRuleActionParametersStaleWhileRevalidate]A cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
exposed_credential_check: Optional[RuleRulesetsSetCacheControlRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsSetCacheControlRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SetCacheSettingsRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
A list of additional ports that caching should be enabled on.
browser_ttl: Optional[ActionParametersBrowserTTL]How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
Whether the request's response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
cache_key: Optional[ActionParametersCacheKey]Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Whether to separate cached content based on the visitor's device type.
Whether to protect from web cache deception attacks, while allowing static assets to be cached.
custom_key: Optional[ActionParametersCacheKeyCustomKey]Which components of the request are included or excluded from the cache key.
Which components of the request are included or excluded from the cache key.
header: Optional[ActionParametersCacheKeyCustomKeyHeader]Which headers to include in the cache key.
Which headers to include in the cache key.
A list of headers to check for the presence of. The presence of these headers is included in the cache key.
query_string: Optional[ActionParametersCacheKeyCustomKeyQueryString]Which query string parameters to include in or exclude from the cache key.
Which query string parameters to include in or exclude from the cache key.
cache_reserve: Optional[ActionParametersCacheReserve]Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
Settings to determine whether the request's response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
edge_ttl: Optional[ActionParametersEdgeTTL]How long the Cloudflare edge network should cache the response.
How long the Cloudflare edge network should cache the response.
status_code_ttl: Optional[List[ActionParametersEdgeTTLStatusCodeTTL]]A list of TTLs to apply to specific status codes or status code ranges.
A list of TTLs to apply to specific status codes or status code ranges.
Whether to generate Cloudflare error pages for issues from the origin server.
A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
shared_dictionary: Optional[ActionParametersSharedDictionary]Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class RuleRulesetsSetCacheTagsRule: …
action_parameters: Optional[RuleRulesetsSetCacheTagsRuleActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
class RuleRulesetsSetCacheTagsRuleActionParametersAddCacheTagsValues: …Add cache tags using a list of values.
Add cache tags using a list of values.
class RuleRulesetsSetCacheTagsRuleActionParametersAddCacheTagsExpression: …Add cache tags using an expression.
Add cache tags using an expression.
class RuleRulesetsSetCacheTagsRuleActionParametersRemoveCacheTagsValues: …Remove cache tags using a list of values.
Remove cache tags using a list of values.
class RuleRulesetsSetCacheTagsRuleActionParametersRemoveCacheTagsExpression: …Remove cache tags using an expression.
Remove cache tags using an expression.
class RuleRulesetsSetCacheTagsRuleActionParametersSetCacheTagsValues: …Set cache tags using a list of values.
Set cache tags using a list of values.
exposed_credential_check: Optional[RuleRulesetsSetCacheTagsRuleExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[RuleRulesetsSetCacheTagsRuleRatelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SetConfigRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
Whether to disable Cloudflare Apps.
Whether to enable Mirage.
Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
request_body_buffering: Optional[Literal["none", "standard", "full"]]The request body buffering mode.
The request body buffering mode.
security_level: Optional[Literal["off", "essentially_off", "low", 3 more]]The Security Level to configure.
The Security Level to configure.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
class SkipRule: …
action_parameters: Optional[ActionParameters]The parameters configuring the rule's action.
The parameters configuring the rule's action.
A phase to skip the execution of. This option is only compatible with the products option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
products: Optional[List[Literal["bic", "hot", "rateLimit", 4 more]]]A list of legacy security products to skip the execution of.
A list of legacy security products to skip the execution of.
A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
exposed_credential_check: Optional[ExposedCredentialCheck]Configuration for exposed credential checking.
Configuration for exposed credential checking.
ratelimit: Optional[Ratelimit]An object configuring the rule's rate limit behavior.
An object configuring the rule's rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule's expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
Update an account or zone entry point ruleset
import os
from cloudflare import Cloudflare
client = Cloudflare(
api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted
)
phase = client.rulesets.phases.update(
ruleset_phase="http_request_firewall_custom",
account_id="account_id",
)
print(phase.id){
"errors": [
{
"message": "something bad happened",
"code": 10000,
"source": {
"pointer": "/rules/0/action"
}
}
],
"messages": [
{
"message": "something bad happened",
"code": 10000,
"source": {
"pointer": "/rules/0/action"
}
}
],
"result": {
"id": "2f2feab2026849078ba485f918791bdc",
"kind": "root",
"last_updated": "2000-01-01T00:00:00.000000Z",
"name": "My ruleset",
"phase": "http_request_firewall_custom",
"rules": [
{
"last_updated": "2000-01-01T00:00:00.000000Z",
"version": "1",
"id": "3a03d665bac047339bb530ecb439a90d",
"action": "block",
"action_parameters": {
"response": {
"content": "{\n \"success\": false,\n \"error\": \"you have been blocked\"\n}",
"content_type": "application/json",
"status_code": 400
}
},
"categories": [
"directory-traversal"
],
"description": "Block the request.",
"enabled": true,
"exposed_credential_check": {
"password_expression": "url_decode(http.request.body.form[\\\"password\\\"][0])",
"username_expression": "url_decode(http.request.body.form[\\\"username\\\"][0])"
},
"expression": "ip.src eq 1.1.1.1",
"logging": {
"enabled": true
},
"ratelimit": {
"characteristics": [
"cf.colo.id"
],
"period": 60,
"counting_expression": "http.request.body.raw eq \"abcd\"",
"mitigation_timeout": 600,
"requests_per_period": 1000,
"requests_to_origin": true,
"score_per_period": 400,
"score_response_header_name": "my-score"
},
"ref": "my_ref"
}
],
"version": "1",
"description": "A description for my ruleset."
},
"success": true
}Returns Examples
{
"errors": [
{
"message": "something bad happened",
"code": 10000,
"source": {
"pointer": "/rules/0/action"
}
}
],
"messages": [
{
"message": "something bad happened",
"code": 10000,
"source": {
"pointer": "/rules/0/action"
}
}
],
"result": {
"id": "2f2feab2026849078ba485f918791bdc",
"kind": "root",
"last_updated": "2000-01-01T00:00:00.000000Z",
"name": "My ruleset",
"phase": "http_request_firewall_custom",
"rules": [
{
"last_updated": "2000-01-01T00:00:00.000000Z",
"version": "1",
"id": "3a03d665bac047339bb530ecb439a90d",
"action": "block",
"action_parameters": {
"response": {
"content": "{\n \"success\": false,\n \"error\": \"you have been blocked\"\n}",
"content_type": "application/json",
"status_code": 400
}
},
"categories": [
"directory-traversal"
],
"description": "Block the request.",
"enabled": true,
"exposed_credential_check": {
"password_expression": "url_decode(http.request.body.form[\\\"password\\\"][0])",
"username_expression": "url_decode(http.request.body.form[\\\"username\\\"][0])"
},
"expression": "ip.src eq 1.1.1.1",
"logging": {
"enabled": true
},
"ratelimit": {
"characteristics": [
"cf.colo.id"
],
"period": 60,
"counting_expression": "http.request.body.raw eq \"abcd\"",
"mitigation_timeout": 600,
"requests_per_period": 1000,
"requests_to_origin": true,
"score_per_period": 400,
"score_response_header_name": "my-score"
},
"ref": "my_ref"
}
],
"version": "1",
"description": "A description for my ruleset."
},
"success": true
}