--- description: Add, promote, review, refine, and delete HTTP request operations in Web Assets. title: Manage operations image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/security/llms.txt > Use this file to discover all available pages before exploring further. # Manage operations Last updated Jul 31, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/security/web-assets/manage-operations/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) ## Operation states Each operation has one of the following states: | State | Meaning | | --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | full | An operation that you promoted, added manually, or created from a schema. Full operations are used for matching, logging, detections, and rules. | | candidate | An operation that Cloudflare discovered from traffic. Candidate operations are used for matching, logging, detections, and rules before you manually review them. | | shadow | An operation that exists in Web Assets but is not used for matching, logging, detections, or rules. | You do not need to promote every discovered operation to the `full` state. Candidate operations provide operation context automatically, while full operations support additional learning and protections. ## Discovery requirements If an operation does not appear in Web Assets, Cloudflare may not have observed enough valid requests over a continuous period. Discovery only processes requests that satisfy all of the following requirements: * The request must return a `2xx` response code from the Cloudflare edge. * The request must not come directly from Cloudflare Workers. * The operation must receive at least 500 requests within a 10-day period. ## Discovered operations Discovery continuously identifies operations from proxied HTTP traffic. Discovery groups similar request paths together by using path normalization. For example, discovery can group these requests: ```txt GET https://api.example.com/profile/238 GET https://api.example.com/profile/392 ``` Discovery can group them into one operation: ```txt GET api.example.com/profile/{var1} ``` Discovered operations are used for matching before you manually refine them. This provides operation context for discovered traffic without requiring you to promote every discovery first. Discovery-backed matching is subject to plan availability and system limits. Cloudflare currently sends up to 3,000 operations per zone to the edge for matching. Operations in the `full` state are prioritized first, followed by operations in the `candidate` state. ## Promote an operation Promote a candidate or shadow operation to move it into the `full` state and start profile learning. The **Learn profile** action is available to API Shield customers using unified operation discovery and other customers with access to profile learning. After promotion, Cloudflare learns the expected request structure from observed traffic. For API endpoints, API Shield also collects data to learn and report additional context: * Request structures through [schema learning](https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/) * Normal request volume through [rate limit recommendations](https://developers.cloudflare.com/api-shield/security/volumetric-abuse-detection/) * Authentication usage through [Authentication Posture](https://developers.cloudflare.com/api-shield/security/authentication-posture/) * Persisted security findings through [API endpoint risk labels](https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-labels/#risk-labels) Each feature has separate data and timing requirements. For example, [schema learning](https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/#limitations) requires an operation to remain full for at least 24 hours. Full operations can also use protections that require a known API endpoint, including [Schema Validation](https://developers.cloudflare.com/api-shield/security/schema-validation/), [fallthrough rules](https://developers.cloudflare.com/api-shield/security/schema-validation/#add-validation-by-adding-a-fallthrough-rule), and [sequence mitigation](https://developers.cloudflare.com/api-shield/security/sequence-mitigation/). 1. In the Cloudflare dashboard, go to the **Web Assets** page with the **Operations** tab highlighted. [Go to **Web assets** ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/web-assets) 2. Open the row actions for a candidate or shadow operation. 3. Select **Learn profile**. After promotion, the row action changes to **Profile learned**. ## Traffic matching behavior Cloudflare matches each request to one operation at the edge. When more than one operation pattern could match the same request, the more specific operation wins. Matching priority Operations in the `full` state always match before operations in the `candidate` state. For example, these operations could both match `GET https://example.com/checkout/pay`: ```txt GET example.com/checkout/pay GET example.com/checkout/{var1} ``` Cloudflare uses `GET example.com/checkout/pay` because it is more specific. For the same method, hostname pattern, and path pattern, Cloudflare generates the same operation UUID. This keeps operation identity stable when the same operation is found again. ## Add operations manually Add an operation manually when traffic you want to protect has not been discovered, or when you want to define the operation structure yourself. 1. In the Cloudflare dashboard, go to the **Web Assets** page with **Operations** tab highlighted. [Go to **Web assets** ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/web-assets) 2. Select **Add operation**. 3. Choose **Manually add**. 4. Select the HTTP method, enter the hostname pattern and path pattern. 5. Confirm with **Add operation**. ## Use variables in operation patterns When you add an operation manually, use variables to match similar traffic with one operation. For path variables, enclose the variable in braces: ```txt /api/users/{var1}/details ``` For hostname variables, the variable must occupy a complete hostname label. Cloudflare supports patterns such as: ```txt {hostVar1}.example.com foo.{hostVar1}.example.com {hostVar2}.{hostVar1}.example.com ``` Do not combine a hostname variable with other characters in the same label. The following pattern is not supported: ```txt foo-{hostVar1}.example.com ``` ## Add operations from schemas If you already maintain OpenAPI schemas, you can continue uploading them to create operations. Schema upload is also used by [API Shield](https://developers.cloudflare.com/api-shield/) for schema validation. For more information, refer to [Schema Validation](https://developers.cloudflare.com/api-shield/security/schema-validation/) and [schema learning](https://developers.cloudflare.com/api-shield/management-and-monitoring/endpoint-management/schema-learning/). ## Refine operations Refine operations when the current grouping does not match how the traffic should be grouped or protected. For example, you may want separate operations for login and password reset traffic, even if both routes share part of the same path structure. You may also want to replace several narrow operations with one broader operation when they represent the same application behavior. Review overlapping operations before making changes. Cloudflare matches a request to one operation. A broad operation can change how similar requests are grouped, while a narrow operation can isolate one flow from related traffic. 1. In the Cloudflare dashboard, go to the **Web Assets** page with the **Operations** tab highlighted. [Go to **Web assets** ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/web-assets) 2. Open the row actions for the operation. 3. Select **Edit operation**. 4. Update the HTTP method, hostname pattern, or path pattern. 5. Select **Save**. Editing a candidate or shadow operation promotes it to the `full` state with the edited values. Editing this operation will change its ID Cloudflare computes operation IDs from the HTTP method, hostname, and path. Cloudflare relearns labels, schemas, and rate limiting recommendations for an operation with a new ID. ## Delete operations You can delete operations one at a time or in bulk. 1. In the Cloudflare dashboard, go to the **Web Assets** page with **Operations** tab highlighted. [Go to **Web assets** ↗](https://dash.cloudflare.com/?to=/:account/:zone/security/web-assets) 2. Select the operation(s) that you want to delete. 3. Confirm with **Delete operations**. Note After you delete an operation, Cloudflare no longer matches future traffic to that operation. If Cloudflare later discovers similar traffic, the traffic may appear again as a discovered operation. ## Use the Cloudflare API You can interact with operations through the Cloudflare API. For more information, refer to [operations API documentation](https://developers.cloudflare.com/api/resources/api%5Fgateway/subresources/discovery/subresources/operations/methods/list/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/security/web-assets/manage-operations/#page","headline":"Manage operations · Security dashboard docs","description":"Add, promote, review, refine, and delete HTTP request operations in Web Assets.","url":"https://developers.cloudflare.com/security/web-assets/manage-operations/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-07-31","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ```