Skip to content
API Enriched

Suggest WAF Exclusion Rule.

POST
/api/config/namespaces/{namespace}/cdn_loadbalancers/{name}/waf_exclusion/suggestion
curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/cdn_loadbalancers/example/waf_exclusion/suggestion \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "api_endpoint": { "collapsed_url": "example", "method": "example" }, "domain": "example", "exclude_bot_names": [ { "bot_name": "example" } ], "exclude_signature_contexts": [ { "context": "CONTEXT_ANY", "context_name": "example", "signature_id": 1 } ], "exclude_violation_contexts": [ { "context": "CONTEXT_ANY", "context_name": "example", "exclude_violation": "VIOL_NONE" } ], "name": "example", "namespace": "example", "req_path": "example", "route_uuid": "example" }'

Suggest service policy rule to set up WAF exclusion for a given WAF security event.

Examples of this operation.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
namespace
required
string

Namespace Namespace of the App type for current request.

name
required
string

Name HTTP load balancer for which this WAF exclusion will be applied.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
GetSuggestedWAFExclusionRuleReq

GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.

object
api_endpoint
object
collapsed_url
Collapsed URL

Collapsed URL is the path with identified DYN components.

string
<= 256 characters
method
method

HTTP method.

string
<= 1024 characters
domain
Domain

Domain

string format: hostname
>= 26 characters <= 256 characters
exclude_bot_names
Exclude Bot Name Contexts

Bot name contexts to be excluded for this request.

Array<object>
<= 64 items
Bot Name Context

Specifies bot to be excluded by its name.

object
bot_name
BotName

Human-readable name for the resource

string
<= 1024 characters
exclude_signature_contexts
Exclude Signature Contexts

App Firewall signature contexts to be excluded for this request.

Array<object>
<= 1024 items
App Firewall Signature Context

App Firewall signature context changes to be applied for this request.

object
context
string
default: CONTEXT_ANY
Allowed values: CONTEXT_ANY CONTEXT_BODY CONTEXT_REQUEST CONTEXT_RESPONSE CONTEXT_PARAMETER CONTEXT_HEADER CONTEXT_COOKIE CONTEXT_URL CONTEXT_URI
context_name
Context Name

Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).

string
<= 128 characters
signature_id
SignatureID

The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context.

integer format: int64
exclude_violation_contexts
Exclude Violation Contexts

App Firewall violation contexts to be excluded for this request.

Array<object>
<= 64 items
App Firewall Violation Context

App Firewall violation context changes to be applied for this request.

object
context
string
default: CONTEXT_ANY
Allowed values: CONTEXT_ANY CONTEXT_BODY CONTEXT_REQUEST CONTEXT_RESPONSE CONTEXT_PARAMETER CONTEXT_HEADER CONTEXT_COOKIE CONTEXT_URL CONTEXT_URI
context_name
Context Name

Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).

string
<= 128 characters
exclude_violation
string
default: VIOL_NONE
Allowed values: VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION VIOL_HTTP_PROTOCOL_CRLF_CHARACTERS_BEFORE_REQUEST_START VIOL_HTTP_PROTOCOL_NO_HOST_HEADER_IN_HTTP_1_1_REQUEST VIOL_HTTP_PROTOCOL_BAD_MULTIPART_PARAMETERS_PARSING VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS VIOL_HTTP_PROTOCOL_CONTENT_LENGTH_SHOULD_BE_A_POSITIVE_NUMBER VIOL_EVASION_DIRECTORY_TRAVERSALS VIOL_MALFORMED_REQUEST VIOL_EVASION_MULTIPLE_DECODING VIOL_DATA_GUARD VIOL_EVASION_APACHE_WHITESPACE VIOL_COOKIE_MODIFIED VIOL_EVASION_IIS_UNICODE_CODEPOINTS VIOL_EVASION_IIS_BACKSLASHES VIOL_EVASION_PERCENT_U_DECODING VIOL_EVASION_BARE_BYTE_DECODING VIOL_EVASION_BAD_UNESCAPE VIOL_HTTP_PROTOCOL_BAD_MULTIPART_FORMDATA_REQUEST_PARSING VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST VIOL_HTTP_PROTOCOL_HIGH_ASCII_CHARACTERS_IN_HEADERS VIOL_ENCODING VIOL_COOKIE_MALFORMED VIOL_GRAPHQL_FORMAT VIOL_GRAPHQL_MALFORMED VIOL_GRAPHQL_INTROSPECTION_QUERY
name
Name

HTTP load balancer for which this WAF exclusion will be applied.

string
>= 1 characters <= 63 characters /^[a-z]([-a-z0-9]*[a-z0-9])?$/
namespace
Namespace

Namespace of the App type for current request.

string
>= 1 characters <= 63 characters /^[a-z]([-a-z0-9]*[a-z0-9])?$/
req_path
Request Path

Request URL path.

string
<= 256 characters
route_uuid
Route UUID

Unique identifier for the request route.

string
<= 1024 characters

Responses

Section titled “Responses”

200

Section titled “200”

A successful response.

Media typeapplication/json
GetSuggestedWAFExclusionRuleRsp

GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.

object
found_existing_rule
object
name
Name

HTTP load balancer for which this WAF exclusion will be applied.

string
>= 1 characters <= 63 characters /^[a-z]([-a-z0-9]*[a-z0-9])?$/
waf_exclusion_policy
object
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 1 characters <= 128 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 1 characters <= 63 characters /^[a-z]([-a-z0-9]*[a-z0-9])?$/
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 12 characters <= 64 characters
waf_exclusion_rule
object
any_domain
object
any_path
object
app_firewall_detection_control
object
exclude_attack_type_contexts
Exclude Attack Types Contexts

Exclude an entire attack type only in the named context. For migrated per-parameter exceptions, prefer this over signature-ID exclusions because one payload can trigger several signatures; unrelated parameters and attack types remain protected.

Array<object>
<= 64 items
App Firewall Attack Type Context

App Firewall Attack Type context changes to be applied for this request.

object
context

Exclusion scope. Use CONTEXT_PARAMETER with context_name for one parameter, CONTEXT_COOKIE for one cookie, or CONTEXT_ANY only for an intentionally global scope.

string
default: CONTEXT_ANY
Allowed values: CONTEXT_ANY CONTEXT_BODY CONTEXT_REQUEST CONTEXT_RESPONSE CONTEXT_PARAMETER CONTEXT_HEADER CONTEXT_COOKIE CONTEXT_URL CONTEXT_URI
context_name
Context Name

Parameter, cookie, or header name selected by context. For a parameter-scoped WAF exception, set context to CONTEXT_PARAMETER and name only the intended parameter.

string
<= 128 characters
exclude_attack_type

Attack-type enum excluded in this context, for example ATTACK_TYPE_CROSS_SITE_SCRIPTING. Other attack types remain enforced.

string
default: ATTACK_TYPE_NONE
Allowed values: ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE ATTACK_TYPE_DETECTION_EVASION ATTACK_TYPE_VULNERABILITY_SCAN ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS ATTACK_TYPE_BUFFER_OVERFLOW ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION ATTACK_TYPE_INFORMATION_LEAKAGE ATTACK_TYPE_DIRECTORY_INDEXING ATTACK_TYPE_PATH_TRAVERSAL ATTACK_TYPE_XPATH_INJECTION ATTACK_TYPE_LDAP_INJECTION ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION ATTACK_TYPE_COMMAND_EXECUTION ATTACK_TYPE_SQL_INJECTION ATTACK_TYPE_CROSS_SITE_SCRIPTING ATTACK_TYPE_DENIAL_OF_SERVICE ATTACK_TYPE_HTTP_PARSER_ATTACK ATTACK_TYPE_SESSION_HIJACKING ATTACK_TYPE_HTTP_RESPONSE_SPLITTING ATTACK_TYPE_FORCEFUL_BROWSING ATTACK_TYPE_REMOTE_FILE_INCLUDE ATTACK_TYPE_MALICIOUS_FILE_UPLOAD ATTACK_TYPE_GRAPHQL_PARSER_ATTACK
exclude_bot_name_contexts
Exclude Bot Names Contexts

Bot Names to be excluded for the defined match criteria.

Array<object>
<= 64 items
Bot Name Context

Specifies bot to be excluded by its name.

object
bot_name
BotName

Human-readable name for the resource

string
<= 1024 characters
exclude_signature_contexts
Exclude Signature Contexts

Signature IDs to be excluded for the defined match criteria.

Array<object>
<= 1024 items
App Firewall Signature Context

App Firewall signature context changes to be applied for this request.

object
context
string
default: CONTEXT_ANY
Allowed values: CONTEXT_ANY CONTEXT_BODY CONTEXT_REQUEST CONTEXT_RESPONSE CONTEXT_PARAMETER CONTEXT_HEADER CONTEXT_COOKIE CONTEXT_URL CONTEXT_URI
context_name
Context Name

Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).

string
<= 128 characters
signature_id
SignatureID

The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context.

integer format: int64
exclude_violation_contexts
Exclude Violation Contexts

Violations to be excluded for the defined match criteria.

Array<object>
<= 64 items
App Firewall Violation Context

App Firewall violation context changes to be applied for this request.

object
context
string
default: CONTEXT_ANY
Allowed values: CONTEXT_ANY CONTEXT_BODY CONTEXT_REQUEST CONTEXT_RESPONSE CONTEXT_PARAMETER CONTEXT_HEADER CONTEXT_COOKIE CONTEXT_URL CONTEXT_URI
context_name
Context Name

Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).

string
<= 128 characters
exclude_violation
string
default: VIOL_NONE
Allowed values: VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION VIOL_HTTP_PROTOCOL_CRLF_CHARACTERS_BEFORE_REQUEST_START VIOL_HTTP_PROTOCOL_NO_HOST_HEADER_IN_HTTP_1_1_REQUEST VIOL_HTTP_PROTOCOL_BAD_MULTIPART_PARAMETERS_PARSING VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS VIOL_HTTP_PROTOCOL_CONTENT_LENGTH_SHOULD_BE_A_POSITIVE_NUMBER VIOL_EVASION_DIRECTORY_TRAVERSALS VIOL_MALFORMED_REQUEST VIOL_EVASION_MULTIPLE_DECODING VIOL_DATA_GUARD VIOL_EVASION_APACHE_WHITESPACE VIOL_COOKIE_MODIFIED VIOL_EVASION_IIS_UNICODE_CODEPOINTS VIOL_EVASION_IIS_BACKSLASHES VIOL_EVASION_PERCENT_U_DECODING VIOL_EVASION_BARE_BYTE_DECODING VIOL_EVASION_BAD_UNESCAPE VIOL_HTTP_PROTOCOL_BAD_MULTIPART_FORMDATA_REQUEST_PARSING VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST VIOL_HTTP_PROTOCOL_HIGH_ASCII_CHARACTERS_IN_HEADERS VIOL_ENCODING VIOL_COOKIE_MALFORMED VIOL_GRAPHQL_FORMAT VIOL_GRAPHQL_MALFORMED VIOL_GRAPHQL_INTROSPECTION_QUERY
exact_value
exact value

Exclusive with [any_domain suffix_value] Exact domain name.

string
>= 1 characters <= 256 characters
expiration_timestamp
expiration timestamp

The expiration_timestamp is the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.

string format: date-time
<= 1024 characters
metadata
object
description
description

Human readable description.

string
>= 21 characters <= 256 characters
name
name

This is the name of the message. The value of name has to follow DNS-1035 format.

string
>= 1 characters <= 63 characters /^[a-z]([-a-z0-9]*[a-z0-9])?$/
methods
Methods

Methods to be matched.

Array<string>
<= 16 items
Allowed values: ANY GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH COPY
path_prefix
prefix

Exclusive with [any_path path_regex] Path prefix to match (e.g. The value / will match on all paths)

string
<= 256 characters
path_regex
Path Regex

Exclusive with [any_path path_prefix] Define the regex for the path. For example, the regex ^/.*$ will match on all paths.

string
<= 256 characters
suffix_value
suffix value

Exclusive with [any_domain exact_value] Suffix of domain name e.g “xyz.com” will match “*.xyz.com” and “xyz.com”

string
>= 1 characters <= 256 characters
waf_skip_processing
object
Example
{
  "waf_exclusion_rule": {
    "app_firewall_detection_control": {
      "exclude_attack_type_contexts": [
        {
          "context": "CONTEXT_ANY",
          "exclude_attack_type": "ATTACK_TYPE_NONE"
        }
      ],
      "exclude_signature_contexts": [
        {
          "context": "CONTEXT_ANY"
        }
      ],
      "exclude_violation_contexts": [
        {
          "context": "CONTEXT_ANY",
          "exclude_violation": "VIOL_NONE"
        }
      ]
    },
    "methods": [
      "ANY"
    ]
  }
}

401

Section titled “401”

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

403

Section titled “403”

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

404

Section titled “404”

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

409

Section titled “409”

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

429

Section titled “429”

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

500

Section titled “500”

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

503

Section titled “503”

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

504

Section titled “504”

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example