Skip to content
Cloudflare API
Start here
API Reference
Firewall
Rules

Create firewall rules

client.firewall.rules.create(RuleCreateParams { zone_id, action, filter } params, RequestOptionsoptions?): SinglePage<FirewallRule { id, action, description, 5 more } >
POST/zones/{zone_id}/firewall/rules

This endpoint has been deprecated and returns 410 Gone. Please use the Rulesets API instead.

Create one or more firewall rules.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Firewall Services Write
ParametersExpand Collapse
params: RuleCreateParams { zone_id, action, filter }
zone_id: string

Path param: Defines an identifier.

maxLength32
action: Action

Body param: The action to perform when the threshold of matched traffic within the configured period is exceeded.

mode?: "simulate" | "ban" | "challenge" | 2 more

The action to perform.

One of the following:
"simulate"
"ban"
"challenge"
"js_challenge"
"managed_challenge"
response?: Response { body, content_type }

A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional. Notes: If you omit this object, Cloudflare will use the default HTML error page. If “mode” is “challenge”, “managed_challenge”, or “js_challenge”, Cloudflare will use the zone challenge pages and you should not provide the “response” object.

body?: string

The response body to return. The value must conform to the configured content type.

maxLength10240
content_type?: string

The content type of the body. Must be one of the following: text/plain, text/xml, or application/json.

maxLength50
timeout?: number

The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period. Notes: If “mode” is “challenge”, “managed_challenge”, or “js_challenge”, Cloudflare will use the zone’s Challenge Passage time and you should not provide this value.

maximum86400
minimum1
filter: FirewallFilter { id, description, expression, 2 more }

Body param

id?: string

The unique identifier of the filter.

maxLength32
minLength32
description?: string

An informative summary of the filter.

maxLength500
expression?: string

The filter expression. For more information, refer to Expressions.

paused?: boolean

When true, indicates that the filter is currently paused.

ref?: string

A short reference tag. Allows you to select related filters.

maxLength50
ReturnsExpand Collapse
FirewallRule { id, action, description, 5 more }
id?: string

The unique identifier of the firewall rule.

maxLength32
action?: Action

The action to apply to a matched request. The log action is only available on an Enterprise plan.

One of the following:
"block"
"challenge"
"js_challenge"
"managed_challenge"
"allow"
"log"
"bypass"
description?: string

An informative summary of the firewall rule.

maxLength500
filter?: FirewallFilter { id, description, expression, 2 more } | DeletedFilter { id, deleted }
One of the following:
FirewallFilter { id, description, expression, 2 more }
id?: string

The unique identifier of the filter.

maxLength32
minLength32
description?: string

An informative summary of the filter.

maxLength500
expression?: string

The filter expression. For more information, refer to Expressions.

paused?: boolean

When true, indicates that the filter is currently paused.

ref?: string

A short reference tag. Allows you to select related filters.

maxLength50
DeletedFilter { id, deleted }
id: string

The unique identifier of the filter.

maxLength32
minLength32
deleted: boolean

When true, indicates that the firewall rule was deleted.

paused?: boolean

When true, indicates that the firewall rule is currently paused.

priority?: number

The priority of the rule. Optional value used to define the processing order. A lower number indicates a higher priority. If not provided, rules with a defined priority will be processed before rules without a priority.

maximum2147483647
minimum0
products?: Array<Product>
One of the following:
"zoneLockdown"
"uaBlock"
"bic"
"hot"
"securityLevel"
"rateLimit"
"waf"
ref?: string

A short reference tag. Allows you to select related firewall rules.

maxLength50

Create firewall rules

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

// Automatically fetches more pages as needed.
for await (const firewallRule of client.firewall.rules.create({
  zone_id: '023e105f4ecef8ad9ca31a8372d0c353',
  action: {},
  filter: {},
})) {
  console.log(firewallRule.id);
}
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": "372e67954025e0ba6aaa6d586b9e0b60",
      "action": "block",
      "description": "Blocks traffic identified during investigation for MIR-31",
      "filter": {
        "id": "372e67954025e0ba6aaa6d586b9e0b61",
        "description": "Restrict access from these browsers on this address range.",
        "expression": "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.addr ne 172.16.22.155",
        "paused": false,
        "ref": "FIL-100"
      },
      "paused": false,
      "priority": 50,
      "products": [
        "waf"
      ],
      "ref": "MIR-31"
    }
  ],
  "success": true,
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "result": [
    {
      "id": "372e67954025e0ba6aaa6d586b9e0b60",
      "action": "block",
      "description": "Blocks traffic identified during investigation for MIR-31",
      "filter": {
        "id": "372e67954025e0ba6aaa6d586b9e0b61",
        "description": "Restrict access from these browsers on this address range.",
        "expression": "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.addr ne 172.16.22.155",
        "paused": false,
        "ref": "FIL-100"
      },
      "paused": false,
      "priority": 50,
      "products": [
        "waf"
      ],
      "ref": "MIR-31"
    }
  ],
  "success": true,
  "result_info": {
    "count": 1,
    "page": 1,
    "per_page": 20,
    "total_count": 2000
  }
}