Validate data loss prevention matches with Cloudflare Workers

Data loss prevention (DLP) can run a Cloudflare Worker in your account when a pattern matches. Use your Worker to apply organization-specific checks, adjust confidence, or reject the match.

Custom functions appear in the entry editor when this feature is available for your account. You can attach them to custom pattern entries.

Set up your Workers account

Set up Workers in the same Cloudflare account where you configure DLP. If you have not used Workers before, follow the Workers getting started guide.
Configure a Workers subdomain for that account.

Create a validation Worker

Deploy the Worker to the account where you configure DLP. Export a class named DlpValidationEntrypoint with a validate method. Import its base class and types from @cloudflare/zt-types.

npm i @cloudflare/zt-types

yarn add @cloudflare/zt-types

pnpm add @cloudflare/zt-types

bun add @cloudflare/zt-types

The method receives a DlpValidationInput with the entry ID, match offsets, and request method and URL. Its excerpt is base64-encoded and contains the match with surrounding context. The userId field is optional.

src/index.jsjs

import { DlpValidation } from "@cloudflare/zt-types";

export class DlpValidationEntrypoint extends DlpValidation {
	async validate(input) {
		if (input.entryId === "entry-id-to-reject") {
			return { score: "veto" };
		}

		return { score: 0 };
	}
}

src/index.tsts

import {
	DlpValidation,
	type DlpValidationInput,
	type DlpValidationResult,
} from "@cloudflare/zt-types";

export class DlpValidationEntrypoint extends DlpValidation {
	async validate(input: DlpValidationInput): Promise<DlpValidationResult> {
		if (input.entryId === "entry-id-to-reject") {
			return { score: "veto" };
		}

		return { score: 0 };
	}
}

Replace the example condition with your validation logic. Return a score from -1 to 1 to adjust confidence. Positive scores increase confidence. Negative scores decrease it. A score of 0 leaves confidence unchanged. Return "veto" to reject the match.

Attach a Worker to a pattern entry

Log in to Cloudflare One and go to Data loss prevention > Detection entries.
Go to Detection entries ↗
From the Pattern tab, add a pattern entry or edit an existing custom pattern entry.
In Validators, select Custom functions.
Select Add custom function.
Select Create new, or select Use existing and choose a saved function.
For a new function, enter a name and select an eligible Worker.
(Optional) For a new function, choose the default behavior for Worker errors or timeouts.
For a new function, select Create. Select Save on the pattern entry.

Default behavior options are No fallback, Veto, or Score. Scores range from -1 to 1.

To use the pattern entry in DLP scanning, add it to a custom DLP profile.