{ "openapi": "3.0.3", "info": { "title": "Threat Campaign", "description": "APIs for configuring detection policies and attack tracking. Supports campaign analysis, risk assessment, and automated mitigation rule generation across security domains.", "version": "8.0.2", "contact": { "name": "F5 Distributed Cloud", "url": "https://docs.cloud.f5.com" }, "license": { "name": "Proprietary", "url": "https://www.f5.com/company/policies/eula" }, "x-f5xc-description-long": "APIs for configuring detection policies and attack tracking. Supports campaign analysis, risk assessment, and automated mitigation rule generation across security domains.", "x-f5xc-summary": "Detection policies, attack tracking, and automated mitigation rule generation for security operations.", "x-f5xc-cli-domain": "threat_campaign", "externalDocs": { "url": "https://docs.cloud.f5.com/docs/how-to/app-networking/http-load-balancer", "description": "F5 XC Documentation - HTTP Load Balancer" }, "x-f5xc-api-reference-url": "https://f5-sales-demo.github.io/api-specs-enriched/api-reference/virtual/", "x-f5xc-best-practices": { "common_errors": [ { "code": 400, "message": "Invalid request body", "resolution": "Validate JSON structure and required fields before submission", "prevention": "Use schema validation from OpenAPI spec" }, { "code": 401, "message": "Authentication failed", "resolution": "Verify API token is valid and not expired", "prevention": "Use environment variables for token management" }, { "code": 403, "message": "Permission denied", "resolution": "Check user role and namespace permissions", "prevention": "Verify RBAC policies before operations" }, { "code": 404, "message": "Resource not found", "resolution": "Verify resource name and namespace exist", "prevention": "List resources before attempting operations" }, { "code": 409, "message": "Resource already exists", "resolution": "Use unique name or delete existing resource", "prevention": "Check existence before creation" }, { "code": 429, "message": "Rate limit exceeded", "resolution": "Implement exponential backoff and retry logic", "prevention": "Batch operations and add delays between requests" } ], "security_notes": [ "Always use HTTPS for all API communications", "Store API tokens securely, never in source code", "Rotate API tokens regularly following security policies" ], "performance_tips": [ "Use pagination for large result sets", "Batch related operations when possible", "Cache read-only responses appropriately" ] }, "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "servers": [ { "url": "https://{tenant}.{console_url}/api/v1/{domain_prefix}/{environment}/{region}/namespaces/{namespace}", "description": "F5 Distributed Cloud Console", "variables": { "tenant": { "default": "example-corp", "description": "F5 Distributed Cloud tenant identifier (e.g., example-corp, example-partners)" }, "console_url": { "default": "console.ves.volterra.io", "description": "Console URL base (e.g., console.ves.volterra.io for production, staging.volterra.us for staging)", "enum": [ "console.ves.volterra.io", "staging.volterra.us" ] }, "environment": { "default": "production", "description": "Environment designation (production, staging, development)", "enum": [ "production", "staging", "development" ] }, "domain_prefix": { "default": "api", "description": "Domain naming prefix for consistent naming conventions" }, "region": { "default": "us-east-1", "description": "Geographic region for API deployment (e.g., us-east-1, eu-west-1)" }, "namespace": { "default": "default", "description": "Kubernetes-style namespace for environment separation (e.g., 'default', 'production', 'staging')" } } } ], "security": [ { "ApiToken": [] } ], "tags": [ { "name": "config" }, { "name": "data" }, { "name": "waf" } ], "paths": { "/api/waf/threat_campaign/{id}": { "get": { "summary": "GET Threat Campaign by ID.", "description": "GET Threat Campaign by ID.", "operationId": "ves.io.schema.app_security.ThreatCampaignAPI.GetThreatCampaignById", "responses": { "200": { "description": "A successful response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/app_securityThreatCampaign" } } } }, "401": { "description": "Returned when operation is not authorized.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "403": { "description": "Returned when there is no permission to access resource.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "404": { "description": "Returned when resource is not found.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "409": { "description": "Returned when operation on resource is conflicting with current value.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "429": { "description": "Returned when operation has been rejected as it is happening too frequently.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "500": { "description": "Returned when server encountered an error in processing API.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "503": { "description": "Returned when service is unavailable temporarily.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } }, "504": { "description": "Returned when server timed out processing request.", "content": { "application/json": { "schema": { "type": "string", "format": "string" } } } } }, "parameters": [ { "name": "id", "description": "ID\nx-required\nID with which the request will find entry.", "in": "path", "required": true, "x-displayname": "Threat Campaign ID.", "schema": { "type": "string" }, "x-f5xc-example": "cmp5641a5adbeabaf2708ce7663ad937df8" } ], "externalDocs": { "description": "Examples of this operation.", "url": "https://f5-sales-demo.github.io/api-specs-enriched/api-reference/virtual/" }, "x-ves-proto-rpc": "ves.io.schema.app_security.ThreatCampaignAPI.GetThreatCampaignById", "tags": [ "waf" ], "x-f5xc-operation-metadata": { "purpose": "Resource retrieval operation", "required_fields": [ "path.id" ], "optional_fields": [], "field_docs": {}, "conditions": { "prerequisites": [], "postconditions": [] }, "side_effects": {}, "danger_level": "low", "confirmation_required": false, "common_errors": [ { "code": 401, "message": "Authentication required", "solution": "Provide valid API credentials" }, { "code": 403, "message": "Permission denied", "solution": "Check access permissions for this operation" }, { "code": 404, "message": "Resource not found", "solution": "Verify resource name, namespace, and path" }, { "code": 409, "message": "Resource already exists", "solution": "Use different name or update existing resource" }, { "code": 429, "message": "Rate limit exceeded", "solution": "Wait before retrying the operation" }, { "code": 500, "message": "Server error", "solution": "Retry operation or contact support" } ], "performance_impact": { "latency": "low", "resource_usage": "low" } }, "x-f5xc-required-fields": [ "path.id" ], "x-f5xc-danger-level": "low", "x-f5xc-discovered-response-time": { "p50_ms": 200, "p95_ms": 800, "p99_ms": 2000, "sample_count": 0, "source": "estimate" } }, "x-displayname": "Application Security Monitoring APIs.", "x-ves-proto-service": "ves.io.schema.app_security.ThreatCampaignAPI", "x-ves-proto-service-type": "CUSTOM_PUBLIC" } }, "components": { "securitySchemes": { "ApiToken": { "type": "apiKey", "name": "Authorization", "in": "header", "description": "API Token authentication. Format: 'APIToken '" }, "apiKeyAuth": { "type": "apiKey", "in": "header", "name": "Authorization", "description": "F5 XC API Token (format: APIToken )" } }, "schemas": { "app_firewallAppFirewallViolationType": { "type": "string", "description": "List of all supported Violation Types\n\nVIOL_NONE\nVIOL_FILETYPE\nVIOL_METHOD\nVIOL_MANDATORY_HEADER\nVIOL_HTTP_RESPONSE_STATUS\nVIOL_REQUEST_MAX_LENGTH\nVIOL_FILE_UPLOAD\nVIOL_FILE_UPLOAD_IN_BODY\nVIOL_XML_MALFORMED\nVIOL_JSON_MALFORMED\nVIOL_ASM_COOKIE_MODIFIED\nVIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS\nVIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE\nVIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT\nVIOL_HTTP_PROTOCOL_NULL_IN_REQUEST\nVIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION\nVIOL_HTTP_PROTOCOL_CRLF_CHARACTERS_BEFORE_REQUEST_START\nVIOL_HTTP_PROTOCOL_NO_HOST_HEADER_IN_HTTP_1_1_REQUEST\nVIOL_HTTP_PROTOCOL_BAD_MULTIPART_PARAMETERS_PARSING\nVIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS\nVIOL_HTTP_PROTOCOL_CONTENT_LENGTH_SHOULD_BE_A_POSITIVE_NUMBER\nVIOL_EVASION_DIRECTORY_TRAVERSALS\nVIOL_MALFORMED_REQUEST\nVIOL_EVASION_MULTIPLE_DECODING\nVIOL_DATA_GUARD\nVIOL_EVASION_APACHE_WHITESPACE\nVIOL_COOKIE_MODIFIED\nVIOL_EVASION_IIS_UNICODE_CODEPOINTS\nVIOL_EVASION_IIS_BACKSLASHES\nVIOL_EVASION_PERCENT_U_DECODING\nVIOL_EVASION_BARE_BYTE_DECODING\nVIOL_EVASION_BAD_UNESCAPE\nVIOL_HTTP_PROTOCOL_BAD_MULTIPART_FORMDATA_REQUEST_PARSING\nVIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST\nVIOL_HTTP_PROTOCOL_HIGH_ASCII_CHARACTERS_IN_HEADERS\nVIOL_ENCODING\nVIOL_COOKIE_MALFORMED\nVIOL_GRAPHQL_FORMAT\nVIOL_GRAPHQL_MALFORMED\nVIOL_GRAPHQL_INTROSPECTION_QUERY.", "title": "App Firewall Violation Type", "enum": [ "VIOL_NONE", "VIOL_FILETYPE", "VIOL_METHOD", "VIOL_MANDATORY_HEADER", "VIOL_HTTP_RESPONSE_STATUS", "VIOL_REQUEST_MAX_LENGTH", "VIOL_FILE_UPLOAD", "VIOL_FILE_UPLOAD_IN_BODY", "VIOL_XML_MALFORMED", "VIOL_JSON_MALFORMED", "VIOL_ASM_COOKIE_MODIFIED", "VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS", "VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE", "VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT", "VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST", "VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION", "VIOL_HTTP_PROTOCOL_CRLF_CHARACTERS_BEFORE_REQUEST_START", "VIOL_HTTP_PROTOCOL_NO_HOST_HEADER_IN_HTTP_1_1_REQUEST", "VIOL_HTTP_PROTOCOL_BAD_MULTIPART_PARAMETERS_PARSING", "VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS", "VIOL_HTTP_PROTOCOL_CONTENT_LENGTH_SHOULD_BE_A_POSITIVE_NUMBER", "VIOL_EVASION_DIRECTORY_TRAVERSALS", "VIOL_MALFORMED_REQUEST", "VIOL_EVASION_MULTIPLE_DECODING", "VIOL_DATA_GUARD", "VIOL_EVASION_APACHE_WHITESPACE", "VIOL_COOKIE_MODIFIED", "VIOL_EVASION_IIS_UNICODE_CODEPOINTS", "VIOL_EVASION_IIS_BACKSLASHES", "VIOL_EVASION_PERCENT_U_DECODING", "VIOL_EVASION_BARE_BYTE_DECODING", "VIOL_EVASION_BAD_UNESCAPE", "VIOL_HTTP_PROTOCOL_BAD_MULTIPART_FORMDATA_REQUEST_PARSING", "VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST", "VIOL_HTTP_PROTOCOL_HIGH_ASCII_CHARACTERS_IN_HEADERS", "VIOL_ENCODING", "VIOL_COOKIE_MALFORMED", "VIOL_GRAPHQL_FORMAT", "VIOL_GRAPHQL_MALFORMED", "VIOL_GRAPHQL_INTROSPECTION_QUERY" ], "default": "VIOL_NONE", "x-displayname": "App Firewall Violation Type.", "x-ves-proto-enum": "ves.io.schema.app_firewall.AppFirewallViolationType", "x-f5xc-description-short": "List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH...", "x-f5xc-description-medium": "List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_firewallAppFirewallViolationType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"VIOL_NONE\"", "example_yaml": "VIOL_NONE\n..." }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": true }, "recommendation": { "primary": "shared", "alternatives": [], "rationale": "Security policies benefit from centralized management in shared namespace" }, "classification": { "category": "security", "multi_tenant_pattern": "shared-ref" } } }, "app_firewallAttackType": { "type": "string", "description": "List of all Attack Types\n\nATTACK_TYPE_NONE\nATTACK_TYPE_NON_BROWSER_CLIENT\nATTACK_TYPE_OTHER_APPLICATION_ATTACKS\nATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE\nATTACK_TYPE_DETECTION_EVASION\nATTACK_TYPE_VULNERABILITY_SCAN\nATTACK_TYPE_ABUSE_OF_FUNCTIONALITY\nATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS\nATTACK_TYPE_BUFFER_OVERFLOW\nATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION\nATTACK_TYPE_INFORMATION_LEAKAGE\nATTACK_TYPE_DIRECTORY_INDEXING\nATTACK_TYPE_PATH_TRAVERSAL\nATTACK_TYPE_XPATH_INJECTION\nATTACK_TYPE_LDAP_INJECTION\nATTACK_TYPE_SERVER_SIDE_CODE_INJECTION\nATTACK_TYPE_COMMAND_EXECUTION\nATTACK_TYPE_SQL_INJECTION\nATTACK_TYPE_CROSS_SITE_SCRIPTING\nATTACK_TYPE_DENIAL_OF_SERVICE\nATTACK_TYPE_HTTP_PARSER_ATTACK\nATTACK_TYPE_SESSION_HIJACKING\nATTACK_TYPE_HTTP_RESPONSE_SPLITTING\nATTACK_TYPE_FORCEFUL_BROWSING\nATTACK_TYPE_REMOTE_FILE_INCLUDE\nATTACK_TYPE_MALICIOUS_FILE_UPLOAD\nATTACK_TYPE_GRAPHQL_PARSER_ATTACK.", "title": "AttackType", "enum": [ "ATTACK_TYPE_NONE", "ATTACK_TYPE_NON_BROWSER_CLIENT", "ATTACK_TYPE_OTHER_APPLICATION_ATTACKS", "ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE", "ATTACK_TYPE_DETECTION_EVASION", "ATTACK_TYPE_VULNERABILITY_SCAN", "ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY", "ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS", "ATTACK_TYPE_BUFFER_OVERFLOW", "ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION", "ATTACK_TYPE_INFORMATION_LEAKAGE", "ATTACK_TYPE_DIRECTORY_INDEXING", "ATTACK_TYPE_PATH_TRAVERSAL", "ATTACK_TYPE_XPATH_INJECTION", "ATTACK_TYPE_LDAP_INJECTION", "ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION", "ATTACK_TYPE_COMMAND_EXECUTION", "ATTACK_TYPE_SQL_INJECTION", "ATTACK_TYPE_CROSS_SITE_SCRIPTING", "ATTACK_TYPE_DENIAL_OF_SERVICE", "ATTACK_TYPE_HTTP_PARSER_ATTACK", "ATTACK_TYPE_SESSION_HIJACKING", "ATTACK_TYPE_HTTP_RESPONSE_SPLITTING", "ATTACK_TYPE_FORCEFUL_BROWSING", "ATTACK_TYPE_REMOTE_FILE_INCLUDE", "ATTACK_TYPE_MALICIOUS_FILE_UPLOAD", "ATTACK_TYPE_GRAPHQL_PARSER_ATTACK" ], "default": "ATTACK_TYPE_NONE", "x-displayname": "Attack Types.", "x-ves-proto-enum": "ves.io.schema.app_firewall.AttackType", "x-f5xc-description-short": "List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE...", "x-f5xc-description-medium": "List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE ATTACK_TYPE_DETECTION_EVASION ATTACK_TYPE_VULNERABILITY_SCAN ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_firewallAttackType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"ATTACK_TYPE_NONE\"", "example_yaml": "ATTACK_TYPE_NONE\n..." }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": true }, "recommendation": { "primary": "shared", "alternatives": [], "rationale": "Security policies benefit from centralized management in shared namespace" }, "classification": { "category": "security", "multi_tenant_pattern": "shared-ref" } } }, "app_securityApiEndpoint": { "type": "object", "description": "API Endpoint identified by collapsed_url and method.", "title": "API Endpoint", "x-displayname": "API Endpoint.", "x-ves-proto-message": "ves.io.schema.app_security.ApiEndpoint", "properties": { "collapsed_url": { "type": "string", "description": "Collapsed URL is the path with identified DYN components.", "title": "Collapsed URL", "maxLength": 256, "x-displayname": "Collapsed URL.", "x-ves-example": "/abcd/DYN/xyz.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "/abcd/DYN/xyz", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-description-short": "Collapsed URL is the path with identified DYN components.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "method": { "type": "string", "description": "HTTP method.", "title": "method", "x-displayname": "Method", "x-f5xc-example": "GET", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "API Endpoint identified by collapsed_url and method.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityApiEndpoint", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedAPIEndpointProtectionRuleReq": { "type": "object", "description": "GET suggested API endpoint protection rule for a given path.", "title": "GetSuggestedAPIEndpointProtectionRuleReq", "x-displayname": "GET Suggested API endpoint protection Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedAPIEndpointProtectionRuleReq", "properties": { "method": { "allOf": [ { "$ref": "#/components/schemas/schemaHttpMethod" } ], "x-f5xc-example": "GET", "x-f5xc-description-short": "HTTP method (GET, POST, PUT, DELETE, etc.).", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this API endpoint protection rule applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this API endpoint protection rule applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "path": { "type": "string", "description": "Path to apply the API endpoint protection to.", "title": "Path", "maxLength": 1024, "x-displayname": "Request Path.", "x-ves-example": "/example", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/example", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-description-short": "Path to apply the API endpoint protection to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "minLength": 1, "pattern": "^[/a-zA-Z0-9._-]+$", "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested API endpoint protection rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedAPIEndpointProtectionRuleReq", "required_fields": [ "path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"path\": \"/example\"\n}", "example_yaml": "path: /example" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedAPIEndpointProtectionRuleRsp": { "type": "object", "description": "GET suggested API endpoint protection rule for a given path.", "title": "GetSuggestedAPIEndpointProtectionRuleRsp", "x-displayname": "GET Suggested API endpoint protection Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedAPIEndpointProtectionRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "rule": { "allOf": [ { "$ref": "#/components/schemas/common_wafAPIEndpointProtectionRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested API endpoint protection rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedAPIEndpointProtectionRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedBlockClientRuleReq": { "type": "object", "description": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "title": "GetSuggestedBlockClientRuleReq", "x-displayname": "GET Suggested Block Client Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedBlockClientRuleReq", "properties": { "as_description": { "type": "string", "description": "AS description.", "title": "Description", "maxLength": 256, "x-displayname": "AS Description.", "x-ves-example": "As-description.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "as-description", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "as_number": { "type": "integer", "description": "RFC 6793 defined 4-byte AS number.", "title": "as number", "format": "int64", "x-displayname": "AS Number", "x-ves-example": "4683", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-example": "4683", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-constraints": { "constraintType": "number", "category": "discovery", "minimum": 0, "maximum": 401308, "deterministic": true, "metadata": { "source": "api-probed", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "ip_prefix": { "type": "string", "description": "IP prefix string.", "title": "ip prefix", "x-displayname": "IP Prefix", "x-ves-example": "192.0.2.0/24.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.ip_prefix": "true" }, "x-f5xc-example": "192.0.2.0/24", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.ip_prefix": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "format": "cidr", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this WAF exclusion will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "user_id": { "type": "string", "description": "User ID of blocked client.", "title": "user id", "maxLength": 256, "x-displayname": "User ID", "x-ves-example": "Abc", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "abc", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedBlockClientRuleReq", "required_fields": [ "as_number", "ip_prefix" ], "mutually_exclusive_groups": [], "example_json": "{\n \"as_number\": 0,\n \"ip_prefix\": \"192.0.2.0/24\"\n}", "example_yaml": "as_number: 0\nip_prefix: 192.0.2.0/24" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedBlockClientRuleRsp": { "type": "object", "description": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "title": "GetSuggestedBlockClientRuleRsp", "x-displayname": "GET Suggested Block Client Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedBlockClientRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this WAF exclusion will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "rule": { "allOf": [ { "$ref": "#/components/schemas/common_wafSimpleClientSrcRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedBlockClientRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedDDoSMitigtionRuleReq": { "type": "object", "description": "GET suggested blocking DDoSMitigtionRule for a given IP/ASN/Country/TLS.", "title": "GetSuggestedDDoSMitigtionRuleReq", "x-displayname": "GET Suggested DDoS Mitigtion Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedDDoSMitigtionRuleReq", "properties": { "asn_list": { "allOf": [ { "$ref": "#/components/schemas/policyAsnMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "country_list": { "type": "array", "description": "Sources that are located in one of the countries in the given list.", "title": "country_list", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyCountryCode" }, "x-displayname": "Country List.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Sources that are located in one of the countries in the given list.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ip_prefix_list": { "allOf": [ { "$ref": "#/components/schemas/policyPrefixMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ja4_tls_fingerprint_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyJA4TlsFingerprintMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for ja4 tls fingerprint matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "Load balancer for which this WAF exclusion will be applied.", "title": "Name", "x-displayname": "Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "Load balancer for which this WAF exclusion will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "tls_fingerprint_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyTlsFingerprintMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for tls fingerprint matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested blocking DDoSMitigtionRule for a given IP/ASN/Country/TLS.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedDDoSMitigtionRuleReq", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedDDoSMitigtionRuleRsp": { "type": "object", "description": "GET suggested DDoS Mitigtion Rule for a given IP/ASN/Country/TLS.", "title": "GetSuggestedDDoSMitigtionRuleRsp", "x-displayname": "GET Suggested DDoS Mitigtion Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedDDoSMitigtionRuleRsp", "properties": { "found_existing_mitigation_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "mitigation_rule": { "allOf": [ { "$ref": "#/components/schemas/common_securityDDoSMitigationRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "mitigation_rule_name": { "type": "string", "description": "HTTP load balancer for which this DDoS Mitigation Rule will be applied.", "title": "Name", "x-displayname": "DDoS Mitigation Rule Name.", "x-ves-example": "VES-I/O-DDoS-mitigation-rule.", "x-f5xc-example": "ves-io-ddos-mitigation-rule", "x-f5xc-description-short": "HTTP load balancer for which this DDoS Mitigation Rule will be applied.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested DDoS Mitigtion Rule for a given IP/ASN/Country/TLS.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedDDoSMitigtionRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedOasValidationRuleReq": { "type": "object", "description": "GET suggested Open API specification validation for a given path.", "title": "GetSuggestedOasValidationRuleReq", "x-displayname": "GET Suggested Open API specification validation Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedOasValidationRuleReq", "properties": { "api_groups": { "type": "array", "description": "List of API Groups the API Endpoint is a member of.", "title": "API Groups membership", "items": { "type": "string" }, "x-displayname": "API Groups membership.", "x-f5xc-example": "[\"group-1\", \"group-2\"]", "x-f5xc-description-short": "List of API Groups the API Endpoint is a member of.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "method": { "allOf": [ { "$ref": "#/components/schemas/schemaHttpMethod" } ], "x-f5xc-example": "GET", "x-f5xc-description-short": "HTTP method (GET, POST, PUT, DELETE, etc.).", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this Open API specification validation rule applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this Open API specification validation rule applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "path": { "type": "string", "description": "Path to apply the Open API specification validation to.", "title": "Path", "maxLength": 1024, "x-displayname": "Request Path.", "x-ves-example": "/example", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/example", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-description-short": "Path to apply the Open API specification validation to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "minLength": 1, "pattern": "^[/a-zA-Z0-9._-]+$", "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested Open API specification validation for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedOasValidationRuleReq", "required_fields": [ "path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"path\": \"/example\"\n}", "example_yaml": "path: /example" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedOasValidationRuleRsp": { "type": "object", "description": "GET suggested Open API specification validation for a given path.", "title": "GetSuggestedOasValidationRuleRsp", "x-displayname": "GET Suggested Open API specification validation Rule Response.", "x-ves-oneof-field-api_validation_choice": "[\"all_endpoints_oas_validation\",\"custom_oas_validation\"]", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedOasValidationRuleRsp", "properties": { "all_endpoints_oas_validation": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationAllSpecEndpointsSettings__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "custom_oas_validation" ] }, "custom_oas_validation": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationRule__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for custom oas validation.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "all_endpoints_oas_validation" ] }, "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested Open API specification validation for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedOasValidationRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedRateLimitRuleReq": { "type": "object", "description": "GET suggested rate limit rule for a given path.", "title": "GetSuggestedRateLimitRuleReq", "x-displayname": "GET Suggested Rate Limit Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedRateLimitRuleReq", "properties": { "method": { "allOf": [ { "$ref": "#/components/schemas/schemaHttpMethod" } ], "x-f5xc-example": "GET", "x-f5xc-description-short": "HTTP method (GET, POST, PUT, DELETE, etc.).", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this rate limit rule applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this rate limit rule applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "path": { "type": "string", "description": "Path to apply the rate limit to.", "title": "Path", "maxLength": 1024, "x-displayname": "Request Path.", "x-ves-example": "/example", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/example", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "minLength": 1, "pattern": "^[/a-zA-Z0-9._-]+$", "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested rate limit rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedRateLimitRuleReq", "required_fields": [ "path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"path\": \"/example\"\n}", "example_yaml": "path: /example" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedRateLimitRuleRsp": { "type": "object", "description": "GET suggested rate limit rule for a given path.", "title": "GetSuggestedRateLimitRuleRsp", "x-displayname": "GET Suggested Rate Limit Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedRateLimitRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "rule": { "allOf": [ { "$ref": "#/components/schemas/common_wafApiEndpointRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested rate limit rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedRateLimitRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedSensitiveDataRuleReq": { "type": "object", "description": "GET suggested sensitive data rule for a given path.", "title": "GetSuggestedSensitiveDataRuleReq", "x-displayname": "GET Suggested Sensitive Data Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedSensitiveDataRuleReq", "properties": { "method": { "allOf": [ { "$ref": "#/components/schemas/schemaHttpMethod" } ], "x-f5xc-example": "GET", "x-f5xc-description-short": "HTTP method (GET, POST, PUT, DELETE, etc.).", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this sensitive data rule applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this sensitive data rule applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "path": { "type": "string", "description": "Path to apply the sensitive data to.", "title": "Path", "maxLength": 1024, "x-displayname": "Request Path.", "x-ves-example": "/example", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/example", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "minLength": 1, "pattern": "^[/a-zA-Z0-9._-]+$", "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested sensitive data rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedSensitiveDataRuleReq", "required_fields": [ "path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"path\": \"/example\"\n}", "example_yaml": "path: /example" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedSensitiveDataRuleRsp": { "type": "object", "description": "GET suggested sensitive data rule for a given path.", "title": "GetSuggestedSensitiveDataRuleRsp", "x-displayname": "GET Suggested Sensitive Data Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedSensitiveDataRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "rule": { "allOf": [ { "$ref": "#/components/schemas/http_loadbalancerSensitiveDataTypes__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested sensitive data rule for a given path.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedSensitiveDataRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedTrustClientRuleReq": { "type": "object", "description": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "title": "GetSuggestedTrustClientRuleReq", "x-displayname": "GET Suggested Trust Client Rule Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedTrustClientRuleReq", "properties": { "as_description": { "type": "string", "description": "AS description.", "title": "Description", "maxLength": 256, "x-displayname": "AS Description.", "x-ves-example": "As-description.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "as-description", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "as_number": { "type": "integer", "description": "RFC 6793 defined 4-byte AS number.", "title": "as number", "format": "int64", "x-displayname": "AS Number", "x-ves-example": "4683", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-example": "4683", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-constraints": { "constraintType": "number", "category": "discovery", "minimum": 0, "maximum": 401308, "deterministic": true, "metadata": { "source": "api-probed", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "ip_prefix": { "type": "string", "description": "IP prefix string.", "title": "ip prefix", "x-displayname": "IP Prefix", "x-ves-example": "192.0.2.0/24.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.ip_prefix": "true" }, "x-f5xc-example": "192.0.2.0/24", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.ip_prefix": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "format": "cidr", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "ip_reputation": { "type": "boolean", "description": "Indicates whether the security event is IP reputation.", "title": "IP Reputation Security Event", "format": "boolean", "x-displayname": "IP Reputation Security Event.", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Indicates whether the security event is IP reputation.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this client blocking rule will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this client blocking rule will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "sec_event_name": { "type": "string", "description": "The name of Security Event.", "title": "Security Event Name", "x-displayname": "Security Event Name.", "x-ves-example": "Malicious User Mitigation.", "x-f5xc-example": "Malicious User Mitigation", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sec_event_types": { "type": "array", "description": "List of Security Event types that should stop being generated for this client.", "title": "Security Event Types", "maxItems": 4, "items": { "$ref": "#/components/schemas/app_securitySecEventType" }, "x-displayname": "Security Event Types.", "x-ves-example": "[WAF_SEC_EVENT]", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "4", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "[WAF_SEC_EVENT]", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "4", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of Security Event types that should stop being generated for this client.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 4, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "threat_mesh": { "type": "boolean", "description": "Indicates whether the security event is threat mesh.", "title": "Threat Mesh Security Event", "format": "boolean", "x-displayname": "Threat Mesh Security Event.", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Indicates whether the security event is threat mesh.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "user_id": { "type": "string", "description": "User ID of trusted client.", "title": "user id", "maxLength": 256, "x-displayname": "User ID", "x-ves-example": "Abc", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "abc", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "GET suggested blocking SimpleClientSrcRule for a given IP/ASN.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedTrustClientRuleReq", "required_fields": [ "as_number", "ip_prefix" ], "mutually_exclusive_groups": [], "example_json": "{\n \"as_number\": 0,\n \"ip_prefix\": \"192.0.2.0/24\"\n}", "example_yaml": "as_number: 0\nip_prefix: 192.0.2.0/24" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedTrustClientRuleRsp": { "type": "object", "description": "GET suggested SimpleClientSrcRule to trust a given IP/ASN.", "title": "GetSuggestedTrustClientRuleRsp", "x-displayname": "GET Suggested Trust Client Rule Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedTrustClientRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this client rule will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this client rule will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "rule": { "allOf": [ { "$ref": "#/components/schemas/common_wafSimpleClientSrcRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested SimpleClientSrcRule to trust a given IP/ASN.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedTrustClientRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedWAFExclusionRuleReq": { "type": "object", "description": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.", "title": "GetSuggestedWAFExclusionRuleReq", "x-displayname": "GET Suggested WAF Exclusion Request.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedWAFExclusionRuleReq", "properties": { "api_endpoint": { "allOf": [ { "$ref": "#/components/schemas/app_securityApiEndpoint" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "domain": { "type": "string", "description": "Domain", "title": "Domain", "maxLength": 256, "x-displayname": "Domain", "x-ves-example": "juiceshop.com.", "x-ves-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "juiceshop.com", "x-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "format": "hostname", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 26, "format": "hostname", "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "exclude_bot_names": { "type": "array", "description": "Bot name contexts to be excluded for this request.", "title": "Exclude Bot Name Contexts", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyBotNameContext" }, "x-displayname": "Exclude Bot Name Contexts.", "x-ves-example": "Hydra, Nikto.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "Hydra, Nikto", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Bot name contexts to be excluded for this request.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_signature_contexts": { "type": "array", "description": "App Firewall signature contexts to be excluded for this request.", "title": "Exclude Signature Contexts", "maxItems": 1024, "items": { "$ref": "#/components/schemas/policyAppFirewallSignatureContext" }, "x-displayname": "Exclude App Firewall Signature Contexts.", "x-ves-example": "[[10000001, 30000000]]", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "1024", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "[[10000001, 30000000]]", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "1024", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "App Firewall signature contexts to be excluded for this request.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 1024, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_violation_contexts": { "type": "array", "description": "App Firewall violation contexts to be excluded for this request.", "title": "Exclude Violation Contexts", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyAppFirewallViolationContext" }, "x-displayname": "Exclude App Firewall Violation Contexts.", "x-ves-example": "[[VIOL_MANDATORY_HEADER, VIOL_REQUEST_MAX_LENGTH]]", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "[[VIOL_MANDATORY_HEADER, VIOL_REQUEST_MAX_LENGTH]]", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "App Firewall violation contexts to be excluded for this request.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this WAF exclusion will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "req_path": { "type": "string", "description": "Request URL path.", "title": "Request Path", "maxLength": 256, "x-displayname": "Request Path.", "x-ves-example": "/abcd/2452422c/xyz.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "/abcd/2452422c/xyz", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "route_uuid": { "type": "string", "description": "Unique identifier for the request route.", "title": "Route UUID", "x-displayname": "Route UUID.", "x-ves-example": "00000000-0000-4000-8000-25a697151bfa.", "x-ves-validation-rules": { "ves.io.schema.rules.string.pattern": "^$|^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$" }, "x-f5xc-example": "00000000-0000-4000-8000-25a697151bfa", "x-validation-rules": { "ves.io.schema.rules.string.pattern": "^$|^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$" }, "x-f5xc-description-short": "Unique identifier for the request route.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "pattern": "^$|^[a-fA-F0-9]{8}-([a-fA-F0-9]{4}-){3}[a-fA-F0-9]{12}$", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedWAFExclusionRuleReq", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityGetSuggestedWAFExclusionRuleRsp": { "type": "object", "description": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.", "title": "GetSuggestedWAFExclusionRuleRsp", "x-displayname": "GET Suggested WAF Exclusion Response.", "x-ves-proto-message": "ves.io.schema.app_security.GetSuggestedWAFExclusionRuleRsp", "properties": { "found_existing_rule": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "HTTP load balancer for which this WAF exclusion will be applied.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "x-f5xc-description-short": "HTTP load balancer for which this WAF exclusion will be applied.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "waf_exclusion_policy": { "allOf": [ { "$ref": "#/components/schemas/schemaviewsObjectRefType" } ], "x-f5xc-description-short": "Policy configuration for this feature.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-references": [ { "resource_kind": "waf_exclusion_policy", "field_path": "waf_exclusion_policy", "gated_by": null, "required": false, "cardinality": "single" } ] }, "waf_exclusion_rule": { "allOf": [ { "$ref": "#/components/schemas/policySimpleWafExclusionRule__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "GET suggested service policy rule to set up WAF rule exclusion for a given WAF security event.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityGetSuggestedWAFExclusionRuleRsp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityLoadbalancerData": { "type": "object", "description": "List of virtual hosts in all the namespaces matching filter provided in the request.", "title": "LoadbalancerData", "x-displayname": "Load Balancer data.", "x-ves-proto-message": "ves.io.schema.app_security.LoadbalancerData", "properties": { "name": { "type": "string", "description": "HTTP load balancer name.", "title": "Name", "x-displayname": "HTTP Load Balancer Name.", "x-ves-example": "VES-I/O-frontend.", "x-f5xc-example": "ves-io-frontend", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "namespace": { "type": "string", "description": "Namespace of the virtual host.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "request_data": { "allOf": [ { "$ref": "#/components/schemas/app_securityRequestData" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "security_events_data": { "allOf": [ { "$ref": "#/components/schemas/app_securitySecurityEventsData" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "List of virtual hosts in all the namespaces matching filter provided in the request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityLoadbalancerData", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityRequestData": { "type": "object", "description": "Request Data.", "title": "RequestData", "x-displayname": "Request Data.", "x-ves-proto-message": "ves.io.schema.app_security.RequestData", "properties": { "count": { "type": "string", "description": "The number of requests matching the filter for virtual host in the given namespace.", "format": "uint64", "x-displayname": "Count", "x-f5xc-example": "15", "x-f5xc-description-short": "The number of requests matching the filter for virtual host in the given namespace.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "max_time": { "type": "string", "description": "Maximum time at which request ID was found.", "title": "Maximum Time", "format": "date-time", "x-displayname": "Maximum time.", "x-ves-example": "01-01-1970T00:00:00Z.", "x-f5xc-example": "01-01-1970T00:00:00Z", "x-f5xc-description-short": "Maximum time at which request ID was found.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "min_time": { "type": "string", "description": "Minimum time at which the request ID was found.", "title": "Minimum Time", "format": "date-time", "x-displayname": "Minimum time.", "x-ves-example": "01-01-1970T00:00:00Z.", "x-f5xc-example": "01-01-1970T00:00:00Z", "x-f5xc-description-short": "Minimum time at which the request ID was found.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityRequestData", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchAfterSortValues": { "type": "object", "description": "These are timestamp and doc_id values returned by elastic search in the search request.\nClient is expected to set these values in a subsequent request to GET the next page of results.", "title": "SearchAfterSortValues", "x-displayname": "Search After Sort Values.", "x-ves-proto-message": "ves.io.schema.app_security.SearchAfterSortValues", "properties": { "last_doc_id": { "type": "string", "description": "This is a unique UUID generated by elastic search.", "title": "last_doc_id", "x-displayname": "Last Doc ID.", "x-ves-example": "-8881051689166072872.", "x-f5xc-example": "-8881051689166072872", "x-f5xc-description-short": "Unique UUID generated by elastic search.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" }, "last_timestamp": { "type": "number", "description": "Configuration parameter for last timestamp", "title": "last timestamp", "format": "double", "x-displayname": "Last Timestamp.", "x-f5xc-example": "1745695692759", "x-f5xc-description-short": "Configuration parameter for last timestamp.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "These are timestamp and doc_id values returned by elastic search in the search request.", "x-f5xc-description-medium": "These are timestamp and doc_id values returned by elastic search in the search request. Client is expected to set these values in a subsequent request to GET the next page of results.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchAfterSortValues", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchFilter": { "type": "object", "description": "Metric label filter can be specified to query specific metrics based on label match.", "title": "Search Filter", "x-displayname": "Search Filter.", "x-ves-proto-message": "ves.io.schema.app_security.SearchFilter", "properties": { "label": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchLabel" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "op": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchLabelOperator" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "value": { "type": "array", "description": "Value to be compared with.", "title": "Value", "maxItems": 5, "items": { "type": "string" }, "x-displayname": "Value", "x-ves-example": "[\"blogging-app-namespace-1\", \"namespace-2\"]", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "5" }, "x-f5xc-example": "\"[\"blogging-app-namespace-1\", \"namespace-2\"]\"", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "5" }, "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 5, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "maxLength": 15, "minLength": 3, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Metric label filter can be specified to query specific metrics based on label match.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchFilter", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchLabel": { "type": "string", "description": "List of Virtual Hosts will be returned matching the following labels.", "title": "Search Label for VH list API", "enum": [ "REQUEST_ID", "SOURCE_IP", "DOMAIN_NAME" ], "default": "REQUEST_ID", "x-displayname": "Search Label for VH List API.", "x-ves-proto-enum": "ves.io.schema.app_security.SearchLabel", "x-f5xc-description-short": "List of Virtual Hosts will be returned matching the following labels.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchLabel", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"REQUEST_ID\"", "example_yaml": "REQUEST_ID\n..." }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchLabelOperator": { "type": "string", "description": "Search Label Operator\nfoo\", \"bar\"]\"", "title": "Search Label Operator", "enum": [ "IN", "NOT_IN" ], "default": "IN", "x-displayname": "Search Label Operator.", "x-ves-proto-enum": "ves.io.schema.app_security.SearchLabelOperator", "x-f5xc-example": "field: [", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchLabelOperator", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"field: [\"", "example_yaml": "'field: ['" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchLoadBalancersRequest": { "type": "object", "description": "GET a list of virtual hosts in all the namespaces matching filter provided in the request.\nThe filter can be a) Request ID b) Source IP.", "title": "SearchLoadBalancersRequest", "x-displayname": "Search Load Balancers Request.", "x-ves-proto-message": "ves.io.schema.app_security.SearchLoadBalancersRequest", "properties": { "label_filter": { "type": "array", "description": "List of label filter expressions of the form \"label\" `Op` \"value\".\nResponse will only contain data that matches all the conditions specified in the `label_filter`.\nOne or more of the following labels can be specified in the label_filter.\n`REQUEST_ID`, `SOURCE_IP``.", "title": "Label Filter", "maxItems": 5, "items": { "$ref": "#/components/schemas/app_securitySearchFilter" }, "x-displayname": "Label Filter.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "5" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "5" }, "x-f5xc-description-short": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the .", "x-f5xc-description-medium": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the . One or more of the following labels can be specified in the label_filter. , `.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 5, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Namespace of the App type for current request.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Shared", "x-f5xc-example": "shared", "x-f5xc-description-short": "Namespace of the App type for current request.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" } }, "x-f5xc-description-short": "GET a list of virtual hosts in all the namespaces matching filter provided in the request.", "x-f5xc-description-medium": "GET a list of virtual hosts in all the namespaces matching filter provided in the request. The filter can be a) Request ID b) Source IP.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchLoadBalancersRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySearchLoadBalancersResponse": { "type": "object", "description": "List of virtual hosts in all the namespaces matching filter provided in the request.", "title": "SearchLoadBalancersResponse", "x-displayname": "Search Load Balancers Response.", "x-ves-proto-message": "ves.io.schema.app_security.SearchLoadBalancersResponse", "properties": { "loadbalancers": { "type": "array", "description": "HTTP load balancer list for which the SearchFilter is applied.", "title": "Loadbalancers", "items": { "$ref": "#/components/schemas/app_securityLoadbalancerData" }, "x-displayname": "HTTP Load Balancer List.", "x-ves-example": "[VES-I/O-frontend\", \"ns1\" , \"1\", \"0\"]", "x-f5xc-example": "\"[ves-io-frontend\", \"ns1\" , \"1\", \"0\"]\"", "x-f5xc-description-short": "HTTP load balancer list for which the SearchFilter is applied.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "List of virtual hosts in all the namespaces matching filter provided in the request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySearchLoadBalancersResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecEventType": { "type": "string", "description": "Security event can be one of the following types.", "title": "Security Event Type", "enum": [ "WAF_SEC_EVENT", "L7_POLICY_SEC_EVENT", "JS_CHALLENGE_SEC_EVENT", "CAPTCHA_CHALLENGE_SEC_EVENT", "MALICIOUS_USER_SEC_EVENT", "SVC_POLICY_SEC_EVENT", "BOT_DEFENSE_SEC_EVENT", "API_SEC_EVENT", "DDOS_SEC_EVENT", "DOS_SEC_EVENT" ], "default": "WAF_SEC_EVENT", "x-displayname": "Security Event Type.", "x-ves-proto-enum": "ves.io.schema.app_security.SecEventType", "x-f5xc-description-short": "Security event can be one of the following types.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecEventType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"WAF_SEC_EVENT\"", "example_yaml": "WAF_SEC_EVENT\n..." }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsAggregationRequest": { "type": "object", "description": "Request to GET only aggregation data for security events.", "title": "Security Events Aggregation Request", "x-displayname": "Security Events Aggregation Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsAggregationRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch security events whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated...", "x-f5xc-description-medium": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch security events for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch security events for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the security event may be specified in the query.\nVh_name - name of the virtual host\nsrc_site - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then security events matching ALL the matchers will be returned in the response.\nExample: query={country=\"United States\", city=\"California\"} will return all security events originating from California, United States.\n\nOptional: If not specified, all the security events matching the given tenant and namespace will be returned in the response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={app_type=\"blogging_app\"}", "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch security events whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Request to GET only aggregation data for security events.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsAggregationRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsAggregationResponse": { "type": "object", "description": "Response message for SecurityEventsAggregationRequest.", "title": "Security Events Aggregation Response", "x-displayname": "Security Events Aggregation Response.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsAggregationResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregation data is key'ed with the aggregation name specified in the request.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with the...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "total_hits": { "type": "string", "description": "Total number of security events that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "0", "x-f5xc-example": "0", "x-f5xc-description-short": "Total number of security events that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for SecurityEventsAggregationRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsAggregationResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsCountRequest": { "type": "object", "description": "Request to GET number of security events for a given namespace.", "title": "SecurityEventsCountRequest", "x-displayname": "Security Events Count Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsCountRequest", "properties": { "end_time": { "type": "string", "description": "End time of metric collection from which data will be considered.\nFormat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "End time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "End time of metric collection from which data will be considered.", "x-f5xc-description-medium": "End time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "group_by": { "type": "array", "description": "Aggregate data by one or more labels listed here.\n`NAMESPACE`, `VIRTUAL_HOST`, `SRC_SITE`, `SRC_INSTANCE`, `SEC_EVENT_TYPE`.\n\nOptional: If not specified, then the security events are aggregated/grouped by `VIRTUAL_HOST`, `SEC_EVENT_TYPE`.", "title": "Group by", "items": { "$ref": "#/components/schemas/metricsSecurityMetricLabel" }, "x-displayname": "Group By", "x-f5xc-description-short": "Aggregate data by one or more labels listed here. , , , , . Optional: If not specified, then the security events are aggregated/grouped by , .", "x-f5xc-description-medium": "Aggregate data by one or more labels listed here. , , , , . Optional: If not specified, then the security events are aggregated/grouped by , .", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "label_filter": { "type": "array", "description": "List of label filter expressions of the form \"label\" `Op` \"value\".\nResponse will only contain data that matches all the conditions specified in the `label_filter`.\nOne or more of the following labels can be specified in the label_filter.\n`VIRTUAL_HOST`, `SRC_SITE`, `SRC_INSTANCE`, `SEC_EVENT_TYPE`.\n\nOptional: If not specified, then the metrics will be filtered only based on the `namespace` in the request.", "title": "Label Filter", "items": { "$ref": "#/components/schemas/metricsSecurityMetricLabelFilter" }, "x-displayname": "Label Filter.", "x-f5xc-description-short": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the .", "x-f5xc-description-medium": "List of label filter expressions of the form \"label\" \"value\". Response will only contain data that matches all the conditions specified in the . One or more of the following labels can be specified in the label_filter. , , , .", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Namespace is used to scope the security events for the given namespace.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Namespace is used to scope the security events for the given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "start_time": { "type": "string", "description": "Start time of metric collection from which data will be considered.\nFormat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "Start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Start time of metric collection from which data will be considered.", "x-f5xc-description-medium": "Start time of metric collection from which data will be considered. Format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "step": { "type": "string", "description": "Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.\nThe timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days\n\nOptional: If not specified, then step size is evaluated to ", "title": "Step", "x-displayname": "Step", "x-ves-example": "15m", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_step": "true" }, "x-f5xc-example": "15m", "x-validation-rules": { "ves.io.schema.rules.string.query_step": "true" }, "x-f5xc-description-short": "Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response.", "x-f5xc-description-medium": "Step is the resolution width, which determines the number of the data points [x-axis (time)] to be returned in the response. The timestamps in the response will be t1=start_time, t2=t1+step, ... Tn=tn-1+step, where tn <= end_time.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Request to GET number of security events for a given namespace.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsCountRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsCountResponse": { "type": "object", "description": "Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.", "title": "SecurityEventsCountResponse", "x-displayname": "Security Events Count Response.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsCountResponse", "properties": { "data": { "type": "array", "description": "List of security events counter data.", "title": "Security events counter data", "items": { "$ref": "#/components/schemas/metricsSecurityEventsCounter" }, "x-displayname": "Security events counter data.", "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "step": { "type": "string", "description": "Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration.\nFormat: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.", "title": "step", "x-displayname": "Step", "x-ves-example": "30m", "x-ves-validation-rules": { "ves.io.schema.rules.string.time_interval": "true" }, "x-f5xc-example": "30m", "x-validation-rules": { "ves.io.schema.rules.string.time_interval": "true" }, "x-f5xc-description-short": "Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration.", "x-f5xc-description-medium": "Actual step size used in the response. It could be higher than the requested step due to metric rollups and the query duration. Format: [0-9][smhd], where s - seconds, m - minutes, h - hours, d - days.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.", "x-f5xc-description-medium": "Number of security events for each unique combination of group_by labels in the SecurityEventsCountRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsCountResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsData": { "type": "object", "description": "Security events data.", "title": "SecurityEventsData", "x-displayname": "Security Events Data.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsData", "properties": { "count": { "type": "string", "description": "The number of security events for virtual host in the given namespace.", "format": "uint64", "x-displayname": "Count", "x-f5xc-example": "15", "x-f5xc-description-short": "The number of security events for virtual host in the given namespace.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "max_time": { "type": "string", "description": "Maximum start time at which security event was found.", "title": "Maximum Time", "format": "date-time", "x-displayname": "Maximum time.", "x-ves-example": "01-01-1970T00:00:00Z.", "x-f5xc-example": "01-01-1970T00:00:00Z", "x-f5xc-description-short": "Maximum start time at which security event was found.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "min_time": { "type": "string", "description": "Minimum time at which the security event was found.", "title": "Minimum Time", "format": "date-time", "x-displayname": "Minimum time.", "x-ves-example": "01-01-1970T00:00:00Z.", "x-f5xc-example": "01-01-1970T00:00:00Z", "x-f5xc-description-short": "Minimum time at which the security event was found.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsData", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsRequest": { "type": "object", "description": "Request to fetch security events.", "title": "Security Events Request", "x-displayname": "Security Events Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch security events whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated...", "x-f5xc-description-medium": "Fetch security events whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "limit": { "type": "integer", "description": "Limits the number of security events returned in the response\nOptional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response.\nThe maximum value for limit is 500.", "title": "limit", "format": "int32", "x-displayname": "Limit", "x-ves-example": "100", "x-f5xc-example": "100", "x-f5xc-description-short": "Limits the number of security events returned in the response Optional: If not specified, first or last 500 security events that matches the query...", "x-f5xc-description-medium": "Limits the number of security events returned in the response Optional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.", "x-f5xc-constraints": { "constraintType": "number", "category": "policy", "minimum": 1, "maximum": 1000000, "multipleOf": 1, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch security events for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch security events for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the security event may be specified in the query.\nVh_name - name of the virtual host\nsrc_site - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then security events matching ALL the matchers will be returned in the response.\nExample: query={country=\"United States\", city=\"California\"} will return all security events originating from California, United States.\n\nOptional: If not specified, all the security events matching the given tenant and namespace will be returned in the response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={app_type=\"blogging_app\"}", "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll": { "type": "boolean", "description": "Scroll is used to retrieve large number of security events (or all security events) that matches the query.\nIf scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next\nbatch of security events until there are no more security events left to return. The number of messages in each batch is determined\nby the limit field.\nNote: Scroll is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "scroll", "format": "boolean", "x-displayname": "Scroll", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Scroll is used to retrieve large number of security events (or all security events) that matches the query.", "x-f5xc-description-medium": "Scroll is used to retrieve large number of security events (or all security events) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of security events until there are no more security events left to return. The...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "search_after": { "type": "boolean", "description": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.\nIf search_after is set to true, the sort_values in the response can be used in the API to fetch the next\nbatch of logs. The number of messages in each batch is determined by the limit field.\nNote: Search After is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "search after", "format": "boolean", "x-displayname": "Search After.", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.", "x-f5xc-description-medium": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query. If search_after is set to true, the sort_values in the response can be used in the API to fetch the next batch of logs. The number of messages in each batch is determined by the limit field.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort": { "allOf": [ { "$ref": "#/components/schemas/schemaSortOrder" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_by": { "type": "string", "description": "Optional: default is sort by last_event_time.", "title": "sort by", "x-displayname": "Sort By", "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "Optional: default is sort by last_event_time.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch security events whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch security events whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsResponse": { "type": "object", "description": "Response message for SecurityEventsRequest/SecurityEventsScrollRequest.", "title": "Security Events Response", "x-displayname": "Security Events Response.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "events": { "type": "array", "description": "List of security events that matched the query. Contains no more than 500 messages.", "title": "events", "items": { "type": "string" }, "x-displayname": "Events", "x-ves-example": "Value", "x-f5xc-example": "value", "x-f5xc-description-short": "List of security events that matched the query. Contains no more than 500 messages.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "last_sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve the next batch of security events using the scroll request.\nEmpty scroll_id indicates no more messages to scroll (EOF).\nNote: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the\nscroll request should be sent within 2 minutes upon receiving the SecurityEventsResponse.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of security events using the scroll request.", "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of security events using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" }, "total_hits": { "type": "string", "description": "Total number of security events that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "0", "x-f5xc-example": "0", "x-f5xc-description-short": "Total number of security events that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for SecurityEventsRequest/SecurityEventsScrollRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityEventsScrollRequest": { "type": "object", "description": "Scroll request is used to fetch large number of security events in multiple batches with each SecurityEventsResponse\ncontaining no more than 500 messages. To scroll through more than 500 or all WAF security events, one can use the\nSecurityEventScrollRequest. Use the scroll_id returned in the SecurityEventsResponse to fetch the next batch of security events and\none can continue this process till the scroll_id returned is \"\" which indicates no more messages to scroll.", "title": "Security Events Scroll Request", "x-displayname": "Security Events Scroll Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityEventsScrollRequest", "properties": { "namespace": { "type": "string", "description": "Fetch the WAF security events scoped by namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch the WAF security events scoped by namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "Scroll request is used to fetch large number of security events in multiple batches with each SecurityEventsResponse containing no more than 500...", "x-f5xc-description-medium": "Scroll request is used to fetch large number of security events in multiple batches with each SecurityEventsResponse containing no more than 500 messages. To scroll through more than 500 or all WAF security events, one can use the SecurityEventScrollRequest. Use the scroll_id returned in the...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityEventsScrollRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityIncidentsAggregationRequest": { "type": "object", "description": "Request to GET only aggregation data for security incidents.", "title": "Security Incidents Aggregation Request", "x-displayname": "Security Incidents Aggregation Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityIncidentsAggregationRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregations are key'ed by user-defined aggregation name.\nThe response will be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over security incidents response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch security incidents whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...", "x-f5xc-description-medium": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch security incidents for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch security incidents for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the security event may be specified in the query.\nVh_name - name of the virtual host\nsrc_site - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then security incidents matching ALL the matchers will be\nreturned in the response.\nExample: query={country=\"United States\", city=\"California\"} will return all security incidents originating from\nCalifornia, United States.\n\nOptional: If not specified, all security incidents matching the given tenant and namespace will be returned in\nthe response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={app_type=\"blogging_app\"}", "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the security event may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch security incidents whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Request to GET only aggregation data for security incidents.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityIncidentsAggregationRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityIncidentsAggregationResponse": { "type": "object", "description": "Response message for SecurityIncidentsAggregationRequest.", "title": "Security Incidents Aggregation Response", "x-displayname": "Security Incidents Aggregation Response.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityIncidentsAggregationResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregation data is key'ed with the aggregation name specified in the request.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "total_hits": { "type": "string", "description": "Total number of security incidents that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "0", "x-f5xc-example": "0", "x-f5xc-description-short": "Total number of security incidents that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for SecurityIncidentsAggregationRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityIncidentsAggregationResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityIncidentsRequest": { "type": "object", "description": "Request to fetch security incidents.", "title": "Security Incidents Request", "x-displayname": "Security Incidents Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityIncidentsRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations. The aggregations are key'ed by user-defined aggregation name. The response\nwill be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch security incidents whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...", "x-f5xc-description-medium": "Fetch security incidents whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "limit": { "type": "integer", "description": "Limits the number of security incidents returned in the response\nOptional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response.\nThe maximum value for limit is 500.", "title": "limit", "format": "int32", "x-displayname": "Limit", "x-ves-example": "100", "x-f5xc-example": "100", "x-f5xc-description-short": "Limits the number of security incidents returned in the response Optional: If not specified, first or last 500 security events that matches the...", "x-f5xc-description-medium": "Limits the number of security incidents returned in the response Optional: If not specified, first or last 500 security events that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.", "x-f5xc-constraints": { "constraintType": "number", "category": "policy", "minimum": 1, "maximum": 1000000, "multipleOf": 1, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch security incidents for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch security incidents for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the security incident may be specified in the query.\nVh_name - name of the virtual host\nsrc_site - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then security incidents matching ALL the matchers will be returned in the response.\nExample: query={country=\"United States\", city=\"California\"} will return all security events originating from California, United States.\n\nOptional: If not specified, all the security events matching the given tenant and namespace will be returned in the response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={app_type=\"blogging_app\"}", "x-f5xc-example": "\"query={app_type=\"blogging_app\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the security incident may be specified in the query. Vh_name - name of the virtual host src_site - source site city ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll": { "type": "boolean", "description": "Scroll is used to retrieve large number of security incidents (or all security incidents) that matches the query.\nIf scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next\nbatch of security events until there are no more security events left to return. The number of messages in each\nbatch is determined by the limit field.\nNote: Scroll is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "scroll", "format": "boolean", "x-displayname": "Scroll", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Scroll is used to retrieve large number of security incidents (or all security incidents) that matches the query.", "x-f5xc-description-medium": "Scroll is used to retrieve large number of security incidents (or all security incidents) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of security events until there are no more security events left to...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "search_after": { "type": "boolean", "description": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.\nIf search_after is set to true, the sort_values in the response can be used in the API to fetch the next\nbatch of logs. The number of messages in each batch is determined by the limit field.\nNote: Search After is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "search after", "format": "boolean", "x-displayname": "Search After.", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.", "x-f5xc-description-medium": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query. If search_after is set to true, the sort_values in the response can be used in the API to fetch the next batch of logs. The number of messages in each batch is determined by the limit field.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort": { "allOf": [ { "$ref": "#/components/schemas/schemaSortOrder" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_by": { "type": "string", "description": "Optional: default is sort by last_event_time.", "title": "sort by", "x-displayname": "Sort By", "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "Optional: default is sort by last_event_time.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch security incidents whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch security incidents whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityIncidentsRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityIncidentsResponse": { "type": "object", "description": "Response message for SecurityIncidentsRequest/SecurityIncidentsScrollRequest.", "title": "Security Incidents Response", "x-displayname": "Security Incidents Response.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityIncidentsResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents\nthat matched the query is large and cannot be returned in a single response message, user can GET helpful\ninsights/summary using aggregations.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security incidents response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security incidents response. If the number of security incidents that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "incidents": { "type": "array", "description": "List of security incidents that matched the query. Contains no more than 500 messages.", "title": "incidents", "items": { "type": "string" }, "x-displayname": "Incidents", "x-ves-example": "Value", "x-f5xc-example": "value", "x-f5xc-description-short": "List of security incidents that matched the query. Contains no more than 500 messages.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "last_sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve the next batch of security incidents using the scroll\nrequest.\nEmpty scroll_id indicates no more messages to scroll (EOF).\nNote: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the\nscroll request should be sent within 2 minutes upon receiving the SecurityIncidentsResponse.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of security incidents using the scroll request.", "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of security incidents using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" }, "total_hits": { "type": "string", "description": "Total number of security events that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "0", "x-f5xc-example": "0", "x-f5xc-description-short": "Total number of security events that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for SecurityIncidentsRequest/SecurityIncidentsScrollRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityIncidentsResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySecurityIncidentsScrollRequest": { "type": "object", "description": "Scroll request is used to fetch large number of security incidents in multiple batches with each SecurityIncidentsResponse\ncontaining no more than 500 messages. To scroll through more than 500 or all security incidents, one can use the\nSecurityIncidentsScrollRequest. Use the scroll_id returned in the SecurityIncidentsResponse to fetch the next batch\nof security events and one can continue this process till the scroll_id returned is \"\" which indicates no more\nmessages to scroll.", "title": "Security Incidents Scroll Request", "x-displayname": "Security Incidents Scroll Request.", "x-ves-proto-message": "ves.io.schema.app_security.SecurityIncidentsScrollRequest", "properties": { "namespace": { "type": "string", "description": "Fetch security incidents for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch security incidents for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "Scroll request is used to fetch large number of security incidents in multiple batches with each SecurityIncidentsResponse containing no more than...", "x-f5xc-description-medium": "Scroll request is used to fetch large number of security incidents in multiple batches with each SecurityIncidentsResponse containing no more than 500 messages. To scroll through more than 500 or all security incidents, one can use the SecurityIncidentsScrollRequest. Use the scroll_id returned...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySecurityIncidentsScrollRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySuspiciousUserLogsAggregationRequest": { "type": "object", "description": "Request to GET only aggregation data for suspicious user logs.", "title": "Suspicious User Logs Aggregation Request", "x-displayname": "Suspicious User Logs Aggregation Request.", "x-ves-proto-message": "ves.io.schema.app_security.SuspiciousUserLogsAggregationRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by user-defined...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch suspicious user logs whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...", "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch suspicious user logs for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch suspicious user logs for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the suspicious user logs may be specified in the query.\nVh_name - name of the virtual host\nuser - user ID\nsite - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then suspicious user logs matching ALL the matchers will be returned in the response.\n\nOptional: If not specified, all the suspicious user logs matching the given tenant and namespace will be returned in the response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={vh_name=\"vh-1\", site=\"CE-01\"}", "x-f5xc-example": "\"query={vh_name=\"vh-1\", site=\"ce-01\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the suspicious user logs may be specified in the query. Vh_name - name of the virtual host user - user ID site ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch suspicious user logs whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Request to GET only aggregation data for suspicious user logs.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySuspiciousUserLogsAggregationRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySuspiciousUserLogsAggregationResponse": { "type": "object", "description": "Response message for SuspiciousUserLogsAggregationRequest.", "title": "Suspicious User Logs Aggregation Response", "x-displayname": "Suspicious User Logs Aggregation Response.", "x-ves-proto-message": "ves.io.schema.app_security.SuspiciousUserLogsAggregationResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregation data is key'ed with the aggregation name specified in the request.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregation data is key'ed with the...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "total_hits": { "type": "string", "description": "Total number of suspicious user logs that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "1400", "x-f5xc-example": "1400", "x-f5xc-description-short": "Total number of suspicious user logs that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for SuspiciousUserLogsAggregationRequest.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySuspiciousUserLogsAggregationResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySuspiciousUserLogsRequest": { "type": "object", "description": "Request to fetch suspicious user logs.", "title": "Suspicious User Logs Request", "x-displayname": "Suspicious User Logs Request.", "x-ves-proto-message": "ves.io.schema.app_security.SuspiciousUserLogsRequest", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.\nThe aggregations are key'ed by user-defined aggregation name. The response will be key'ed with the same name.\nOptional.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the suspicious user logs response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the suspicious user logs response. If the number of logs that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations. The aggregations are key'ed by user-defined...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "end_time": { "type": "string", "description": "Fetch suspicious user logs whose timestamp <= end_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the end_time will be evaluated to start_time+10m\nIf start_time is not specified, then the end_time will be evaluated to ", "title": "end time", "x-displayname": "End Time", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be...", "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp <= end_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the end_time will be evaluated to start_time+10m If start_time is not specified, then the end_time will be evaluated to .", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "limit": { "type": "integer", "description": "Limits the number of logs returned in the response\nOptional: If not specified, first or last 500 logs that matches the query (depending on the sort order) will be returned in the response.\nThe maximum value for limit is 500.", "title": "limit", "format": "int32", "x-displayname": "Limit", "x-ves-example": "100", "x-f5xc-example": "100", "x-f5xc-description-short": "Limits the number of logs returned in the response Optional: If not specified, first or last 500 logs that matches the query (depending on the...", "x-f5xc-description-medium": "Limits the number of logs returned in the response Optional: If not specified, first or last 500 logs that matches the query (depending on the sort order) will be returned in the response. The maximum value for limit is 500.", "x-f5xc-constraints": { "constraintType": "number", "category": "policy", "minimum": 1, "maximum": 1000000, "multipleOf": 1, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "namespace": { "type": "string", "description": "Fetch suspicious user logs for a given namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch suspicious user logs for a given namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "query": { "type": "string", "description": "Query is used to specify the list of matchers\nsyntax for query := {[]}\n := \"\"\n := string\nOne or more of these fields in the suspicious user logs may be specified in the query.\nVh_name - name of the virtual host\nuser - user ID\nsite - source site\ncity - name of the city\ncountry - country code\n := string\n := [\"=\"|\"!=\"|\"=~\"|\"!~\"]\n= : equal to\n!= : not equal to\n=~ : regex match\n!~ : not regex match\nWhen more than one matcher is specified in the query, then suspicious user logs matching ALL the matchers will be returned in the response.\n\nOptional: If not specified, all the suspicious user logs matching the given tenant and namespace will be returned in the response.", "title": "query", "x-displayname": "Query", "x-ves-example": "Query={vh_name=\"vh-1\", site=\"CE-01\"}", "x-f5xc-example": "\"query={vh_name=\"vh-1\", site=\"ce-01\"}\"", "x-f5xc-description-short": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" :=...", "x-f5xc-description-medium": "Query is used to specify the list of matchers syntax for query := {[]} := \"\" := string One or more of these fields in the suspicious user logs may be specified in the query. Vh_name - name of the virtual host user - user ID site ...", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "metadata": { "source": "inferred", "confidence": 0.75, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll": { "type": "boolean", "description": "Scroll is used to retrieve large number of logs (or all logs) that matches the query.\nIf scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next\nbatch of logs until there are no logs left to return. The number of logs in each batch is determined\nby the limit field.\nNote: Scroll is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "scroll", "format": "boolean", "x-displayname": "Scroll", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Scroll is used to retrieve large number of logs (or all logs) that matches the query.", "x-f5xc-description-medium": "Scroll is used to retrieve large number of logs (or all logs) that matches the query. If scroll is set to true, the scroll_id in the response can be used in the scroll API to fetch the next batch of logs until there are no logs left to return. The number of logs in each batch is determined by...", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "search_after": { "type": "boolean", "description": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.\nIf search_after is set to true, the sort_values in the response can be used in the API to fetch the next\nbatch of logs. The number of messages in each batch is determined by the limit field.\nNote: Search After is used for processing large amount of data and therefore is not intended for real time user request.\nOptional: default is false.", "title": "search after", "format": "boolean", "x-displayname": "Search After.", "x-ves-example": "True", "x-f5xc-example": "true", "x-f5xc-description-short": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query.", "x-f5xc-description-medium": "Search After is used to retrieve large number of log messages (or all log messages) that matches the query. If search_after is set to true, the sort_values in the response can be used in the API to fetch the next batch of logs. The number of messages in each batch is determined by the limit field.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort": { "allOf": [ { "$ref": "#/components/schemas/schemaSortOrder" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_by": { "type": "string", "description": "Optional: default is sort by last_event_time.", "title": "sort by", "x-displayname": "Sort By", "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "Optional: default is sort by last_event_time.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "start_time": { "type": "string", "description": "Fetch suspicious user logs whose timestamp >= start_time\nformat: unix_timestamp|RFC 3339\n\nOptional: If not specified, then the start_time will be evaluated to end_time-10m\nIf end_time is not specified, then the start_time will be evaluated to -10m.", "title": "start time", "x-displayname": "Start Time.", "x-ves-example": "1570007981.", "x-ves-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-example": "1570007981", "x-validation-rules": { "ves.io.schema.rules.string.query_time": "true" }, "x-f5xc-description-short": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be...", "x-f5xc-description-medium": "Fetch suspicious user logs whose timestamp >= start_time format: unix_timestamp|RFC 3339 Optional: If not specified, then the start_time will be evaluated to end_time-10m If end_time is not specified, then the start_time will be evaluated to -10m.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySuspiciousUserLogsRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySuspiciousUserLogsResponse": { "type": "object", "description": "Response message for Suspicious User Logs Request.", "title": "Suspicious User Logs Response", "x-displayname": "Suspicious User Logs Response.", "x-ves-proto-message": "ves.io.schema.app_security.SuspiciousUserLogsResponse", "properties": { "aggs": { "type": "object", "description": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query\nis large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.", "title": "aggregations", "x-displayname": "Aggregations.", "x-f5xc-description-short": "Aggregations provide summary/analytics data over the security events response.", "x-f5xc-description-medium": "Aggregations provide summary/analytics data over the security events response. If the number of security events that matched the query is large and cannot be returned in a single response message, user can GET helpful insights/summary using aggregations.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "last_sort_values": { "allOf": [ { "$ref": "#/components/schemas/app_securitySearchAfterSortValues" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "logs": { "type": "array", "description": "List of log messages that matched the query. Contains no more than 500 messages.", "title": "events", "items": { "type": "string" }, "x-displayname": "Events", "x-ves-example": "Value", "x-f5xc-example": "value", "x-f5xc-description-short": "List of log messages that matched the query. Contains no more than 500 messages.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve the next batch of suspicious user logs using the scroll request.\nEmpty scroll_id indicates no more messages to scroll (EOF).\nNote: scroll_id is valid only for 2 minutes. I.e., If one intend to retrieve next batch of the result, then the\nscroll request should be sent within 2 minutes upon receiving the SuspiciousUserLogsResponse.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve the next batch of suspicious user logs using the scroll request.", "x-f5xc-description-medium": "Long Base-64 encoded string which can be used to retrieve the next batch of suspicious user logs using the scroll request. Empty scroll_id indicates no more messages to scroll (EOF).", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" }, "total_hits": { "type": "string", "description": "Total number of logs that matched the query.", "title": "total hits", "format": "uint64", "x-displayname": "Total Hits.", "x-ves-example": "100", "x-f5xc-example": "100", "x-f5xc-description-short": "Total number of logs that matched the query.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "uint64", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Response message for Suspicious User Logs Request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySuspiciousUserLogsResponse", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securitySuspiciousUserLogsScrollRequest": { "type": "object", "description": "Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse\ncontaining no more than 500 messages. To scroll through more than 500 or all messages, one can use the\nSuspiciousUserLogsScrollRequest. Use the scroll_id returned in the SuspiciousUserLogsResponse to fetch the next batch of logs\nand one can continue this process till the scroll_id returned is \"\" which indicates no more logs to scroll.", "title": "Suspicious User Logs Scroll Request", "x-displayname": "Suspicious User Logs Scroll Request.", "x-ves-proto-message": "ves.io.schema.app_security.SuspiciousUserLogsScrollRequest", "properties": { "namespace": { "type": "string", "description": "Fetch the next batch of suspicious user logs scoped by namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Bloggin-app-namespace-1.", "x-f5xc-example": "bloggin-app-namespace-1", "x-f5xc-description-short": "Fetch the next batch of suspicious user logs scoped by namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "scroll_id": { "type": "string", "description": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "title": "scroll id", "x-displayname": "Scroll ID", "x-ves-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==.", "x-f5xc-example": "DXF1ZXJ5QW5kRmV0Y2gBAAAAAAAAAD4WYm9laVYtZndUQlNsdDcwakFMNjU1QQ==", "x-f5xc-description-short": "Long Base-64 encoded string which can be used to retrieve next batch of security events.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more...", "x-f5xc-description-medium": "Scroll request is used to fetch large number of suspicious user logs in multiple batches with each SuspiciousUserLogsResponse containing no more than 500 messages. To scroll through more than 500 or all messages, one can use the SuspiciousUserLogsScrollRequest. Use the scroll_id returned in the...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securitySuspiciousUserLogsScrollRequest", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "app_securityThreatCampaign": { "type": "object", "description": "Threat Campaign object representing the created threat campaign.", "title": "Threat Campaign", "x-displayname": "Threat Campaign.", "x-ves-proto-message": "ves.io.schema.app_security.ThreatCampaign", "properties": { "attack_type": { "type": "string", "description": "The Threat Campaign Attack Type.", "title": "attack_type", "x-displayname": "Attack Type.", "x-ves-example": "Server Side Code Injection.", "x-f5xc-example": "Server Side Code Injection", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "description": { "type": "string", "description": "The Threat Campaign Description.", "title": "description", "x-displayname": "Description.", "x-ves-example": "This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a cryptocurrency miner. The same threat actor was previously detected exploiting Drupal REST Module RCE vulnerability (CVE-2019-6340).", "x-f5xc-example": "This campaign aims to identify Drupal web servers vulnerable to Drupalgeddon2 RCE vulnerability (CVE-2018-7600). The threat actor instructs the server to download and execute a cryptocurrency miner. The same threat actor was previously detected exploiting Drupal REST Module RCE vulnerability (CVE-2019-6340).", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "content", "maxLength": 1024, "minLength": 0, "characterSet": { "description": "Free text with UTF-8 support" }, "metadata": { "source": "inferred", "confidence": 0.8, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 21, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "id": { "type": "string", "description": "The Threat Campaign ID.", "title": "id", "x-displayname": "ID", "x-ves-example": "Cmp5641a5adbeabaf2708ce7663ad937df8.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "cmp5641a5adbeabaf2708ce7663ad937df8", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "intent": { "type": "string", "description": "The Threat Campaign Intent.", "title": "intent", "x-displayname": "Intent", "x-ves-example": "Malware Spreading - Crypto Currency Miner.", "x-f5xc-example": "Malware Spreading - Crypto Currency Miner", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "last_update": { "type": "string", "description": "The Threat Campaign last update time.", "title": "last_update", "x-displayname": "Last Update.", "x-ves-example": "2022/11/29 20:19:17.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "2022/11/29 20:19:17", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "malwares": { "type": "array", "description": "The Threat Campaign Malwares.", "title": "malwares", "items": { "type": "string" }, "x-displayname": "Malwares", "x-ves-example": "['Cryptocurrency Miner']", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "['Cryptocurrency Miner']", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "name": { "type": "string", "description": "The Threat Campaign Name.", "title": "name", "x-displayname": "Name", "x-ves-example": "Drupal 'Drupalgeddon2' RCE - exec48ne.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "Drupal 'Drupalgeddon2' RCE - exec48ne", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "references": { "type": "array", "description": "The Threat Campaign References.", "title": "references", "items": { "type": "string" }, "x-displayname": "References.", "x-ves-example": "['CVE-2018-7600']", "x-f5xc-example": "['CVE-2018-7600']", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "risk": { "type": "string", "description": "The Threat Campaign Risk.", "title": "risk", "x-displayname": "Risk", "x-ves-example": "High", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "High", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "systems": { "type": "array", "description": "The Threat Campaign Systems.", "title": "systems", "items": { "type": "string" }, "x-displayname": "Systems", "x-ves-example": "['PHP', 'Unix/Linux']", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "['PHP', 'Unix/Linux']", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Threat Campaign object representing the created threat campaign.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for app_securityThreatCampaign", "required_fields": [ "id", "last_update", "malwares", "name", "risk", "systems" ], "mutually_exclusive_groups": [], "example_json": "{\n \"id\": \"cmp5641a5adbeabaf2708ce7663ad937df8\",\n \"last_update\": \"2022/11/29 20:19:17\",\n \"malwares\": [\n \"value\"\n ],\n \"name\": \"Drupal 'Drupalgeddon2' RCE - exec48ne\",\n \"risk\": \"High\",\n \"systems\": [\n \"value\"\n ]\n}", "example_yaml": "id: cmp5641a5adbeabaf2708ce7663ad937df8\nlast_update: 2022/11/29 20:19:17\nmalwares:\n- value\nname: Drupal 'Drupalgeddon2' RCE - exec48ne\nrisk: High\nsystems:\n- value" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_securityDDoSClientSource": { "type": "object", "description": "DDoS Mitigation sources to be blocked.", "title": "DDoSClientSource", "x-displayname": "DDoS Client Source Choice.", "x-ves-displayorder": "1,3,5,6", "x-ves-proto-message": "ves.io.schema.views.common_security.DDoSClientSource", "properties": { "asn_list": { "allOf": [ { "$ref": "#/components/schemas/policyAsnMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "country_list": { "type": "array", "description": "Sources that are located in one of the countries in the given list.", "title": "country_list", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyCountryCode" }, "x-displayname": "Country List.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.not_in": "[0]", "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.not_in": "[0]", "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Sources that are located in one of the countries in the given list.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ja4_tls_fingerprint_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyJA4TlsFingerprintMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for ja4 tls fingerprint matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "tls_fingerprint_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyTlsFingerprintMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for tls fingerprint matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_securityDDoSClientSource", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_securityDDoSMitigationRule__ves_io_schema_app_security": { "type": "object", "description": "DDoS Mitigation Rule specifies the sources to be blocked.", "title": "DDoSMitigationRule", "x-displayname": "DDoS Mitigation Rule.", "x-ves-displayorder": "1,2,7,10", "x-ves-oneof-field-mitigation_action": "[\"block\"]", "x-ves-oneof-field-mitigation_choice": "[\"ddos_client_source\",\"ip_prefix_list\"]", "x-ves-proto-message": "ves.io.schema.views.common_security.DDoSMitigationRule", "properties": { "block": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ddos_client_source": { "allOf": [ { "$ref": "#/components/schemas/common_securityDDoSClientSource" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "ip_prefix_list" ] }, "expiration_timestamp": { "type": "string", "description": "The expiration_timestamp is the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in\nthe configuration but is not applied anymore.", "title": "expiration timestamp", "format": "date-time", "x-displayname": "Expiration Timestamp.", "x-ves-example": "2019-12-31:44:34.171543432Z.", "x-ves-validation-rules": { "ves.io.schema.rules.timestamp.within.seconds": "31536000" }, "x-f5xc-example": "2019-12-31:44:34.171543432Z", "x-validation-rules": { "ves.io.schema.rules.timestamp.within.seconds": "31536000" }, "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.", "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ip_prefix_list": { "allOf": [ { "$ref": "#/components/schemas/policyPrefixMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "ddos_client_source" ] }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "DDoS Mitigation Rule specifies the sources to be blocked.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_securityDDoSMitigationRule", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafAPIEndpointProtectionRule__ves_io_schema_app_security": { "type": "object", "description": "API Protection Rule for a specific endpoint.", "title": "API Endpoint Protection Rule", "x-displayname": "API Endpoint Protection Rule.", "x-ves-oneof-field-domain_choice": "[\"any_domain\",\"specific_domain\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.APIEndpointProtectionRule", "properties": { "action": { "allOf": [ { "$ref": "#/components/schemas/common_wafAPIProtectionRuleAction__ves_io_schema_app_security" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "any_domain": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "specific_domain" ] }, "api_endpoint_method": { "allOf": [ { "$ref": "#/components/schemas/policyHttpMethodMatcherType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "api_endpoint_path": { "type": "string", "description": "The endpoint (path) of the request.", "title": "api endpoint path", "maxLength": 1024, "x-displayname": "API Endpoint.", "x-ves-example": "/endpoint1.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/endpoint1", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "client_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyClientMatcher__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "request_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyRequestMatcher__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for request matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "specific_domain": { "type": "string", "description": "Exclusive with [any_domain]\nThe rule will apply for a specific domain.\nFor example: api.example.com.", "title": "domain", "maxLength": 128, "x-displayname": "Specific Domain.", "x-ves-example": "api.example.com.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-f5xc-example": "api.example.com", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain. For", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "format": "fqdn", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_domain" ] } }, "x-f5xc-description-short": "API Protection Rule for a specific endpoint.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafAPIEndpointProtectionRule", "required_fields": [ "api_endpoint_path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"api_endpoint_path\": \"/endpoint1\"\n}", "example_yaml": "api_endpoint_path: /endpoint1" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafAPIProtectionRuleAction__ves_io_schema_app_security": { "type": "object", "description": "The action to take if the input request matches the rule.", "title": "API Protection Rule Action", "x-displayname": "API Protection Rule Action.", "x-ves-oneof-field-action": "[\"allow\",\"deny\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.APIProtectionRuleAction", "properties": { "allow": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "deny" ] }, "deny": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "allow" ] } }, "x-f5xc-description-short": "The action to take if the input request matches the rule.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafAPIProtectionRuleAction", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafApiEndpointDetails": { "type": "object", "description": "This defines API endpoint.", "title": "ApiEndpointDetails", "x-displayname": "API Endpoint.", "x-ves-proto-message": "ves.io.schema.views.common_waf.ApiEndpointDetails", "properties": { "methods": { "type": "array", "description": "Methods to be matched.", "title": "Methods", "maxItems": 16, "items": { "$ref": "#/components/schemas/schemaHttpMethod" }, "x-displayname": "Methods", "x-ves-example": "GET", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "GET", "x-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "path": { "type": "string", "description": "Path to be matched.", "title": "Path", "maxLength": 1024, "x-displayname": "Path", "x-ves-example": "/API/v1/login.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "/api/v1/login", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "minLength": 1, "pattern": "^[/a-zA-Z0-9._-]+$", "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafApiEndpointDetails", "required_fields": [ "path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"path\": \"/api/v1/login\"\n}", "example_yaml": "path: /api/v1/login" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafApiEndpointRule__ves_io_schema_app_security": { "type": "object", "title": "ApiEndpointRule", "x-displayname": "ApiEndpointRule.", "x-ves-oneof-field-domain_choice": "[\"any_domain\",\"specific_domain\"]", "x-ves-oneof-field-rate_limiter_choice": "[\"inline_rate_limiter\",\"ref_rate_limiter\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.ApiEndpointRule", "properties": { "any_domain": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "specific_domain" ] }, "api_endpoint_method": { "allOf": [ { "$ref": "#/components/schemas/policyHttpMethodMatcherType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "api_endpoint_path": { "type": "string", "description": "The endpoint (path) of the request.", "title": "api endpoint path", "maxLength": 1024, "x-displayname": "API Endpoint.", "x-ves-example": "Value", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-example": "value", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_len": "1024", "ves.io.schema.rules.string.templated_http_path": "true" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 1024, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "client_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyClientMatcher__ves_io_schema_app_security" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "inline_rate_limiter": { "allOf": [ { "$ref": "#/components/schemas/common_wafInlineRateLimiter__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for inline rate limiter.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Inline rate-limiter settings for this domain, base-path, or endpoint rule. Select this field as the required rate_limiter_choice when no stored rate-limiter object is used.", "x-f5xc-conflicts-with": [ "ref_rate_limiter" ] }, "ref_rate_limiter": { "allOf": [ { "$ref": "#/components/schemas/schemaviewsObjectRefType" } ], "x-f5xc-description-short": "Configuration parameter for ref rate limiter.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Reference to a stored rate-limiter object for this scoped rule. Select exactly one of ref_rate_limiter and inline_rate_limiter.", "x-f5xc-conflicts-with": [ "inline_rate_limiter" ], "x-f5xc-references": [ { "resource_kind": "rate_limiter", "field_path": "ref_rate_limiter", "gated_by": { "choice": "rate_limiter_choice" }, "required": false, "cardinality": "single" } ] }, "request_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyRequestMatcher__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for request matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "specific_domain": { "type": "string", "description": "Exclusive with [any_domain]\nThe rule will apply for a specific domain.", "title": "domain", "maxLength": 128, "x-displayname": "Specific Domain.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "format": "fqdn", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_domain" ] } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafApiEndpointRule", "required_fields": [ "api_endpoint_path" ], "mutually_exclusive_groups": [], "example_json": "{\n \"api_endpoint_path\": \"value\"\n}", "example_yaml": "api_endpoint_path: value" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafClientSrcRuleAction": { "type": "string", "description": "Action that should be taken when client identifier matches the rule.", "title": "action", "enum": [ "SKIP_PROCESSING_WAF", "SKIP_PROCESSING_BOT", "SKIP_PROCESSING_MUM", "SKIP_PROCESSING_IP_REPUTATION", "SKIP_PROCESSING_API_PROTECTION", "SKIP_PROCESSING_OAS_VALIDATION", "SKIP_PROCESSING_DDOS_PROTECTION", "SKIP_PROCESSING_THREAT_MESH", "SKIP_PROCESSING_MALWARE_PROTECTION" ], "default": "SKIP_PROCESSING_WAF", "x-displayname": "Action", "x-ves-proto-enum": "ves.io.schema.views.common_waf.ClientSrcRuleAction", "x-f5xc-description-short": "Action that should be taken when client identifier matches the rule.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafClientSrcRuleAction", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"SKIP_PROCESSING_WAF\"", "example_yaml": "SKIP_PROCESSING_WAF\n..." }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafCustomFallThroughMode__ves_io_schema_app_security": { "type": "object", "description": "Define the fall through settings.", "title": "Custom Fall Through Mode", "x-displayname": "Custom Fall Through Mode.", "x-ves-proto-message": "ves.io.schema.views.common_waf.CustomFallThroughMode", "properties": { "open_api_validation_rules": { "type": "array", "description": "Rule or policy definition", "title": "Custom Fall Through Rule List", "maxItems": 15, "items": { "$ref": "#/components/schemas/common_wafFallThroughRule__ves_io_schema_app_security" }, "x-displayname": "Custom Fall Through Rule List.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "15", "ves.io.schema.rules.repeated.unique_metadata_name": "true" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "15", "ves.io.schema.rules.repeated.unique_metadata_name": "true" }, "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 15, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafCustomFallThroughMode", "required_fields": [ "open_api_validation_rules" ], "mutually_exclusive_groups": [], "example_json": "{\n \"open_api_validation_rules\": [\n {}\n ]\n}", "example_yaml": "open_api_validation_rules:\n- {}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafFallThroughRule__ves_io_schema_app_security": { "type": "object", "description": "Fall Through Rule for a specific endpoint, base-path, or API group.", "title": "Fall Through Rule", "x-displayname": "Fall Through Rule.", "x-ves-oneof-field-action_choice": "[\"action_block\",\"action_report\",\"action_skip\"]", "x-ves-oneof-field-condition_type_choice": "[\"api_endpoint\",\"api_group\",\"base_path\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.FallThroughRule", "properties": { "action_block": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "action_report", "action_skip" ] }, "action_report": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "action_block", "action_skip" ] }, "action_skip": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "action_block", "action_report" ] }, "api_endpoint": { "allOf": [ { "$ref": "#/components/schemas/common_wafApiEndpointDetails" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_group", "base_path" ] }, "api_group": { "type": "string", "description": "Exclusive with [api_endpoint base_path]\nThe API group which this validation applies to.", "title": "api_group", "maxLength": 128, "x-displayname": "API Group", "x-ves-example": "Oas-all-operations.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "oas-all-operations", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Exclusive with [api_endpoint base_path] The API group which this validation applies to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_endpoint", "base_path" ] }, "base_path": { "type": "string", "description": "Exclusive with [api_endpoint api_group]\nThe base path which this validation applies to.", "title": "base path", "maxLength": 128, "x-displayname": "Base Path", "x-ves-example": "/API/v1", "x-ves-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "/api/v1", "x-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Exclusive with [api_endpoint api_group] The base path which this validation applies to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_endpoint", "api_group" ] }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Fall Through Rule for a specific endpoint, base-path, or API group.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafFallThroughRule", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafHttpHeaderMatcherList": { "type": "object", "description": "Request header name and value pairs.", "title": "HTTP Header", "x-displayname": "HTTP Header.", "x-ves-proto-message": "ves.io.schema.views.common_waf.HttpHeaderMatcherList", "properties": { "headers": { "type": "array", "description": "List of HTTP header name and value pairs.", "title": "headers", "maxItems": 16, "items": { "$ref": "#/components/schemas/ioschemaHeaderMatcherType" }, "x-displayname": "HTTP Headers.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "16" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "16" }, "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "List of HTTP header name and value pairs.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "minItems": 0, "uniqueItems": false, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafHttpHeaderMatcherList", "required_fields": [ "headers" ], "mutually_exclusive_groups": [], "example_json": "{\n \"headers\": [\n {\n \"name\": \"Content-Type\"\n }\n ]\n}", "example_yaml": "headers:\n- name: Content-Type" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafInlineRateLimiter__ves_io_schema_app_security": { "type": "object", "title": "InlineRateLimiter", "x-displayname": "InlineRateLimiter.", "x-ves-oneof-field-count_by_choice": "[\"ref_user_id\",\"use_http_lb_user_id\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.InlineRateLimiter", "properties": { "ref_user_id": { "allOf": [ { "$ref": "#/components/schemas/schemaviewsObjectRefType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only", "x-f5xc-conflicts-with": [ "use_http_lb_user_id" ], "x-f5xc-references": [ { "resource_kind": "user_identification", "field_path": "ref_user_id", "gated_by": { "choice": "count_by_choice" }, "required": false, "cardinality": "single" } ] }, "threshold": { "type": "integer", "description": "The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period.", "title": "threshold", "format": "int64", "x-displayname": "Threshold", "x-ves-example": "1", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gt": "0", "ves.io.schema.rules.uint32.lte": "8192" }, "x-f5xc-example": "1", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gt": "0", "ves.io.schema.rules.uint32.lte": "8192" }, "x-f5xc-description-short": "The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period.", "x-f5xc-description-medium": "The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period.", "x-f5xc-constraints": { "constraintType": "number", "category": "discovery", "minimum": 1, "maximum": 8192, "multipleOf": 1, "metadata": { "source": "api-probed", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "unit": { "allOf": [ { "$ref": "#/components/schemas/rate_limiterRateLimitPeriodUnit" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "use_http_lb_user_id": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only", "x-f5xc-conflicts-with": [ "ref_user_id" ] } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafInlineRateLimiter", "required_fields": [ "threshold" ], "mutually_exclusive_groups": [], "example_json": "{\n \"threshold\": 0\n}", "example_yaml": "threshold: 0" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiFallThroughMode__ves_io_schema_app_security": { "type": "object", "description": "Determine what to do with unprotected endpoints (not in the OpenAPI specification file (a.k.a. Swagger) or doesn't have a specific rule in custom rules)", "title": "Fall Through Mode", "x-displayname": "Fall Through Mode.", "x-ves-oneof-field-fall_through_mode_choice": "[\"fall_through_mode_allow\",\"fall_through_mode_custom\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiFallThroughMode", "properties": { "fall_through_mode_allow": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for fall through mode allow.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "fall_through_mode_custom" ] }, "fall_through_mode_custom": { "allOf": [ { "$ref": "#/components/schemas/common_wafCustomFallThroughMode__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for fall through mode custom.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "fall_through_mode_allow" ] } }, "x-required": true, "x-f5xc-description-short": "Determine what to do with unprotected endpoints (not in the OpenAPI specification file (a.k.a.", "x-f5xc-description-medium": "Determine what to do with unprotected endpoints (not in the OpenAPI specification file (a.k.a. Swagger) or doesn't have a specific rule in custom rules).", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiFallThroughMode", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationAllSpecEndpointsSettings__ves_io_schema_app_security": { "type": "object", "description": "Settings for API Inventory validation.", "title": "OpenAPI Validation API Inventory Settings", "x-displayname": "API Inventory.", "x-ves-oneof-field-oversized_body_choice": "[]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationAllSpecEndpointsSettings", "properties": { "fall_through_mode": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiFallThroughMode__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for fall through mode.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "settings": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationCommonSettings__ves_io_schema_app_security" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "validation_mode": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationMode__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for validation mode.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationAllSpecEndpointsSettings", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationCommonSettings__ves_io_schema_app_security": { "type": "object", "description": "OpenAPI specification validation settings relevant for \"API Inventory\" enforcement and for \"Custom list\" enforcement.", "title": "OpenAPI specification validation common settings", "x-displayname": "Common Settings.", "x-ves-oneof-field-fail_configuration": "[]", "x-ves-oneof-field-oversized_body_choice": "[\"oversized_body_fail_validation\",\"oversized_body_skip_validation\"]", "x-ves-oneof-field-property_validation_settings_choice": "[\"property_validation_settings_custom\",\"property_validation_settings_default\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationCommonSettings", "properties": { "oversized_body_fail_validation": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "oversized_body_skip_validation" ] }, "oversized_body_skip_validation": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "oversized_body_fail_validation" ] }, "property_validation_settings_custom": { "allOf": [ { "$ref": "#/components/schemas/common_wafValidationPropertySetting__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for property validation settings custom.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "property_validation_settings_default" ] }, "property_validation_settings_default": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for property validation settings default.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "property_validation_settings_custom" ] } }, "x-f5xc-description-short": "OpenAPI specification validation settings relevant for \"API Inventory\" enforcement and for \"Custom list\" enforcement.", "x-f5xc-description-medium": "OpenAPI specification validation settings relevant for \"API Inventory\" enforcement and for \"Custom list\" enforcement.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationCommonSettings", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationMode__ves_io_schema_app_security": { "type": "object", "description": "Validation mode of OpenAPI specification.\nWhen a validation mismatch occurs on a request to one of the endpoints listed on the OpenAPI specification file (a.k.a. Swagger)", "title": "Validation Mode", "x-displayname": "Validation Mode.", "x-ves-oneof-field-response_validation_mode_choice": "[\"response_validation_mode_active\",\"skip_response_validation\"]", "x-ves-oneof-field-validation_mode_choice": "[\"skip_validation\",\"validation_mode_active\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationMode", "properties": { "response_validation_mode_active": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationModeActiveResponse__ves_io_schema_app_security" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "skip_response_validation" ] }, "skip_response_validation": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "response_validation_mode_active" ] }, "skip_validation": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "validation_mode_active" ] }, "validation_mode_active": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationModeActive__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Enable OpenAPI validation and explicitly select enforcement_report to allow and log invalid traffic, or enforcement_block to reject invalid...", "x-f5xc-description-medium": "Enable OpenAPI validation and explicitly select enforcement_report to allow and log invalid traffic, or enforcement_block to reject invalid requests with HTTP 403.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Enable OpenAPI validation and explicitly select enforcement_report to allow and log invalid traffic, or enforcement_block to reject invalid requests with HTTP 403.", "x-f5xc-conflicts-with": [ "skip_validation" ] } }, "x-required": true, "x-f5xc-description-short": "Validation mode of OpenAPI specification.", "x-f5xc-description-medium": "Validation mode of OpenAPI specification. When a validation mismatch occurs on a request to one of the endpoints listed on the OpenAPI specification file (a.k.a. Swagger).", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationMode", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationModeActive__ves_io_schema_app_security": { "type": "object", "description": "Validation mode properties of request.", "title": "Open API Validation Mode Active For Request", "x-displayname": "Open API Validation Mode Active.", "x-ves-oneof-field-validation_enforcement_type": "[\"enforcement_block\",\"enforcement_report\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationModeActive", "properties": { "enforcement_block": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties.", "x-f5xc-description-medium": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties. Invalid requests are returned as HTTP 403.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties. Invalid requests are returned as HTTP 403.", "x-f5xc-conflicts-with": [ "enforcement_report" ] }, "enforcement_report": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-description-medium": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-conflicts-with": [ "enforcement_block" ] }, "request_validation_properties": { "type": "array", "description": "List of properties of the request to validate according to the OpenAPI specification file (a.k.a. Swagger)", "title": "Request Validation Properties", "minItems": 1, "items": { "$ref": "#/components/schemas/schemaOpenApiValidationProperties" }, "x-displayname": "Request Validation Properties.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.not_in": "[7]", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.not_in": "[7]", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of properties of the request to validate according to the OpenAPI specification file (a.k.a.", "x-f5xc-description-medium": "List of properties of the request to validate according to the OpenAPI specification file (a.k.a. Swagger).", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "minItems": 1, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationModeActive", "required_fields": [ "request_validation_properties" ], "mutually_exclusive_groups": [], "example_json": "{\n \"request_validation_properties\": [\n \"PROPERTY_QUERY_PARAMETERS\"\n ]\n}", "example_yaml": "request_validation_properties:\n- PROPERTY_QUERY_PARAMETERS" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationModeActiveResponse__ves_io_schema_app_security": { "type": "object", "description": "Validation mode properties of response.", "title": "Open API Validation Mode Active For Response", "x-displayname": "Open API Validation Mode Active.", "x-ves-oneof-field-validation_enforcement_type": "[\"enforcement_block\",\"enforcement_report\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationModeActiveResponse", "properties": { "enforcement_block": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties.", "x-f5xc-description-medium": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties. Invalid requests are returned as HTTP 403.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Blocking validation: reject traffic that violates the selected OpenAPI validation properties. Invalid requests are returned as HTTP 403.", "x-f5xc-conflicts-with": [ "enforcement_report" ] }, "enforcement_report": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-description-medium": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Report-only validation: record OpenAPI violations while allowing the request or response to continue.", "x-f5xc-conflicts-with": [ "enforcement_block" ] }, "response_validation_properties": { "type": "array", "description": "List of properties of the response to validate according to the OpenAPI specification file (a.k.a. Swagger)", "title": "Response Validation Properties", "minItems": 1, "items": { "$ref": "#/components/schemas/schemaOpenApiValidationProperties" }, "x-displayname": "Response Validation Properties.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.in": "[2,4,5,7]", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.items.enum.in": "[2,4,5,7]", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of properties of the response to validate according to the OpenAPI specification file (a.k.a.", "x-f5xc-description-medium": "List of properties of the response to validate according to the OpenAPI specification file (a.k.a. Swagger).", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "minItems": 1, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationModeActiveResponse", "required_fields": [ "response_validation_properties" ], "mutually_exclusive_groups": [], "example_json": "{\n \"response_validation_properties\": [\n \"PROPERTY_QUERY_PARAMETERS\"\n ]\n}", "example_yaml": "response_validation_properties:\n- PROPERTY_QUERY_PARAMETERS" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafOpenApiValidationRule__ves_io_schema_app_security": { "type": "object", "description": "OpenAPI Validation Rule for a specific endpoint, base-path, or API group.", "title": "OpenAPI Validation Rule", "x-displayname": "OpenAPI Validation Rule.", "x-ves-oneof-field-condition_type_choice": "[\"api_endpoint\",\"api_group\",\"base_path\"]", "x-ves-oneof-field-domain_choice": "[\"any_domain\",\"specific_domain\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.OpenApiValidationRule", "properties": { "any_domain": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "specific_domain" ] }, "api_endpoint": { "allOf": [ { "$ref": "#/components/schemas/common_wafApiEndpointDetails" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_group", "base_path" ] }, "api_group": { "type": "string", "description": "Exclusive with [api_endpoint base_path]\nThe API group which this validation applies to.", "title": "api_group", "maxLength": 128, "x-displayname": "API Group", "x-ves-example": "Oas-all-operations.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "oas-all-operations", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Exclusive with [api_endpoint base_path] The API group which this validation applies to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_endpoint", "base_path" ] }, "base_path": { "type": "string", "description": "Exclusive with [api_endpoint api_group]\nThe base path which this validation applies to.", "title": "base path", "maxLength": 128, "x-displayname": "Base Path", "x-ves-example": "/API/v1", "x-ves-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "/api/v1", "x-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Exclusive with [api_endpoint api_group] The base path which this validation applies to.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "api_endpoint", "api_group" ] }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "specific_domain": { "type": "string", "description": "Exclusive with [any_domain]\nThe rule will apply for a specific domain.", "title": "domain", "maxLength": 128, "x-displayname": "Specific Domain.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128", "ves.io.schema.rules.string.vh_domain": "true" }, "x-f5xc-description-short": "Exclusive with [any_domain] The rule will apply for a specific domain.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "format": "fqdn", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_domain" ] }, "validation_mode": { "allOf": [ { "$ref": "#/components/schemas/common_wafOpenApiValidationMode__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for validation mode.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "OpenAPI Validation Rule for a specific endpoint, base-path, or API group.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafOpenApiValidationRule", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafSimpleClientSrcRule__ves_io_schema_app_security": { "type": "object", "description": "Simple client source rule specifies the sources to be blocked or trusted (skip WAF)", "title": "SimpleClientSrcRule", "x-displayname": "Client Rule.", "x-ves-oneof-field-action_choice": "[\"bot_skip_processing\",\"skip_processing\",\"waf_skip_processing\"]", "x-ves-oneof-field-client_source_choice": "[\"as_number\",\"http_header\",\"ip_prefix\",\"ipv6_prefix\",\"user_identifier\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.SimpleClientSrcRule", "properties": { "actions": { "type": "array", "description": "Actions that should be taken when client identifier matches the rule.", "title": "actions", "maxItems": 10, "items": { "$ref": "#/components/schemas/common_wafClientSrcRuleAction" }, "x-displayname": "Actions", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.enum.defined_only": "true", "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "10", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.enum.defined_only": "true", "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "10", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Actions that should be taken when client identifier matches the rule.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 10, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "as_number": { "type": "integer", "description": "Exclusive with [http_header ip_prefix ipv6_prefix user_identifier]\nRFC 6793 defined 4-byte AS number.", "title": "as number", "format": "int64", "x-displayname": "AS Number", "x-ves-example": "4683", "x-ves-validation-rules": { "ves.io.schema.rules.uint32.gte": "1", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-example": "4683", "x-validation-rules": { "ves.io.schema.rules.uint32.gte": "1", "ves.io.schema.rules.uint32.lte": "401308" }, "x-f5xc-description-short": "Exclusive with [http_header ip_prefix ipv6_prefix user_identifier] RFC 6793 defined 4-byte AS number.", "x-f5xc-description-medium": "Exclusive with [http_header ip_prefix ipv6_prefix user_identifier] RFC 6793 defined 4-byte AS number.", "x-f5xc-constraints": { "constraintType": "number", "category": "discovery", "minimum": 1, "maximum": 401308, "deterministic": true, "metadata": { "source": "api-probed", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "http_header", "ip_prefix", "ipv6_prefix", "user_identifier" ] }, "bot_skip_processing": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "skip_processing", "waf_skip_processing" ] }, "expiration_timestamp": { "type": "string", "description": "The expiration_timestamp is the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in\nthe configuration but is not applied anymore.", "title": "expiration timestamp", "format": "date-time", "x-displayname": "Expiration Timestamp.", "x-ves-example": "2019-12-31:44:34.171543432Z.", "x-ves-validation-rules": { "ves.io.schema.rules.timestamp.within.seconds": "31536000" }, "x-f5xc-example": "2019-12-31:44:34.171543432Z", "x-validation-rules": { "ves.io.schema.rules.timestamp.within.seconds": "31536000" }, "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.", "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "http_header": { "allOf": [ { "$ref": "#/components/schemas/common_wafHttpHeaderMatcherList" } ], "x-f5xc-description-short": "Configuration parameter for http header.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "as_number", "ip_prefix", "ipv6_prefix", "user_identifier" ] }, "ip_prefix": { "type": "string", "description": "Exclusive with [as_number http_header ipv6_prefix user_identifier]\nIPv4 prefix string.", "title": "ip prefix", "x-displayname": "IPv4 Prefix.", "x-ves-example": "192.0.2.0/24.", "x-ves-validation-rules": { "ves.io.schema.rules.string.ipv4_prefix": "true" }, "x-f5xc-example": "192.0.2.0/24", "x-validation-rules": { "ves.io.schema.rules.string.ipv4_prefix": "true" }, "x-f5xc-description-short": "Exclusive with [as_number http_header ipv6_prefix user_identifier] IPv4 prefix string.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "as_number", "http_header", "ipv6_prefix", "user_identifier" ] }, "ipv6_prefix": { "type": "string", "description": "Exclusive with [as_number http_header ip_prefix user_identifier]\nIPv6 prefix string.", "title": "ipv6 prefix", "x-displayname": "IPv6 Prefix.", "x-ves-example": "2001::1/64.", "x-ves-validation-rules": { "ves.io.schema.rules.string.ipv6_prefix": "true" }, "x-f5xc-example": "2001::1/64", "x-validation-rules": { "ves.io.schema.rules.string.ipv6_prefix": "true" }, "x-f5xc-description-short": "Exclusive with [as_number http_header ip_prefix user_identifier] IPv6 prefix string.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "as_number", "http_header", "ip_prefix", "user_identifier" ] }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "skip_processing": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "bot_skip_processing", "waf_skip_processing" ] }, "user_identifier": { "type": "string", "description": "Exclusive with [as_number http_header ip_prefix ipv6_prefix]\nIdentify user based on user identifier. User identifier value needs to be copied from security event.", "title": "user identifier", "maxLength": 256, "x-displayname": "User Identifier.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-description-short": "Exclusive with [as_number http_header ip_prefix ipv6_prefix] Identify user based on user identifier.", "x-f5xc-description-medium": "Exclusive with [as_number http_header ip_prefix ipv6_prefix] Identify user based on user identifier. User identifier value needs to be copied from security event.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-field-mutability": "read-only", "x-f5xc-conflicts-with": [ "as_number", "http_header", "ip_prefix", "ipv6_prefix" ] }, "waf_skip_processing": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "bot_skip_processing", "skip_processing" ] } }, "x-f5xc-description-short": "Simple client source rule specifies the sources to be blocked or trusted (skip WAF).", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafSimpleClientSrcRule", "required_fields": [ "actions" ], "mutually_exclusive_groups": [], "example_json": "{\n \"actions\": [\n \"SKIP_PROCESSING_WAF\"\n ]\n}", "example_yaml": "actions:\n- SKIP_PROCESSING_WAF" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafValidationPropertySetting__ves_io_schema_app_security": { "type": "object", "description": "Custom property validation settings.", "title": "Validation Property settings", "x-displayname": "Validation Property Settings.", "x-ves-proto-message": "ves.io.schema.views.common_waf.ValidationPropertySetting", "properties": { "queryParameters": { "allOf": [ { "$ref": "#/components/schemas/common_wafValidationSettingForQueryParameters__ves_io_schema_app_security" } ], "x-f5xc-description-short": "Configuration parameter for queryParameters.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafValidationPropertySetting", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "common_wafValidationSettingForQueryParameters__ves_io_schema_app_security": { "type": "object", "description": "Custom settings for query parameters validation.", "title": "Validation Settings For Query Parameters", "x-displayname": "Validation Settings For Query Parameters.", "x-ves-oneof-field-additional_parameters_choice": "[\"allow_additional_parameters\",\"disallow_additional_parameters\"]", "x-ves-proto-message": "ves.io.schema.views.common_waf.ValidationSettingForQueryParameters", "properties": { "allow_additional_parameters": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for allow additional parameters.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "disallow_additional_parameters" ] }, "disallow_additional_parameters": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for disallow additional parameters.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "allow_additional_parameters" ] } }, "x-f5xc-description-short": "Custom settings for query parameters validation.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for common_wafValidationSettingForQueryParameters", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "http_loadbalancerBodySectionMaskingOptions": { "type": "object", "description": "OPTIONS for HTTP Body Masking.", "title": "Body Section Masking Options", "x-displayname": "Body Section Masking OPTIONS.", "x-ves-proto-message": "ves.io.schema.views.http_loadbalancer.BodySectionMaskingOptions", "properties": { "fields": { "type": "array", "description": "List of JSON Path field values. Use square brackets with an underscore [_] to indicate array elements (e.g., person.emails[_]). To reference JSON keys that contain spaces, enclose the entire path in double quotes. For example: \"person.first name\".", "title": "Field Values", "minItems": 1, "maxItems": 16, "items": { "type": "string", "minLength": 1, "maxLength": 256 }, "x-displayname": "Values", "x-ves-example": "['user.email', 'credit_card']", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.string.json_path": "true", "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.min_bytes": "1", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['user.email', 'credit_card']", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.string.json_path": "true", "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.min_bytes": "1", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of JSON Path field values. Use square brackets with an underscore [_] to indicate array elements (e.g., person.emails[_]).", "x-f5xc-description-medium": "List of JSON Path field values. Use square brackets with an underscore [_] to indicate array elements (e.g., person.emails[_]). To reference JSON keys that contain spaces, enclose the entire path in double quotes.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "minItems": 1, "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for http_loadbalancerBodySectionMaskingOptions", "required_fields": [ "fields" ], "mutually_exclusive_groups": [], "example_json": "{\n \"fields\": [\n \"value\"\n ]\n}", "example_yaml": "fields:\n- value" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": true }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "networking", "multi_tenant_pattern": "per-tenant" } } }, "http_loadbalancerSensitiveDataTypes__ves_io_schema_app_security": { "type": "object", "description": "Settings to mask sensitive data in request/response payload.", "title": "Sensitive Data Types", "x-displayname": "Sensitive Data Types.", "x-ves-oneof-field-masking_mode_choice": "[\"mask\",\"report\"]", "x-ves-oneof-field-type_condition_type_choice": "[\"api_endpoint\"]", "x-ves-proto-message": "ves.io.schema.views.http_loadbalancer.SensitiveDataTypes", "properties": { "api_endpoint": { "allOf": [ { "$ref": "#/components/schemas/common_wafApiEndpointDetails" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "body": { "allOf": [ { "$ref": "#/components/schemas/http_loadbalancerBodySectionMaskingOptions" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "mask": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "report" ] }, "report": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "mask" ] } }, "x-f5xc-description-short": "Settings to mask sensitive data in request/response payload.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for http_loadbalancerSensitiveDataTypes", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": true }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "networking", "multi_tenant_pattern": "per-tenant" } } }, "ioschemaHeaderMatcherType": { "type": "object", "description": "Header match is done using the name of the header and its value.\nThe value match is done using one of the following\nregex match on value\nexact match of value\npresence of header\n\nHeader Match can also be inverse of above, which be used to check\nmissing header or\nnon-matching value.", "title": "HeaderMatcherType", "x-displayname": "Header to Match.", "x-ves-oneof-field-value_match": "[\"exact\",\"presence\",\"regex\"]", "x-ves-proto-message": "ves.io.schema.HeaderMatcherType", "properties": { "exact": { "type": "string", "description": "Exclusive with [presence regex]\nHeader value to match exactly.", "title": "exact", "maxLength": 256, "x-displayname": "Exact", "x-ves-example": "Application/JSON.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.not_empty": "true" }, "x-f5xc-example": "application/json", "x-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.not_empty": "true" }, "x-f5xc-description-short": "Exclusive with [presence regex] Header value to match exactly.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "byteLength": { "max": 256 }, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "presence", "regex" ] }, "invert_match": { "type": "boolean", "description": "Invert the result of the match to detect missing header or non-matching value.", "title": "invert_match", "format": "boolean", "x-displayname": "NOT of match.", "x-f5xc-description-short": "Invert the result of the match to detect missing header or non-matching value.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "name": { "type": "string", "description": "Name of the header.", "title": "name", "minLength": 1, "maxLength": 63, "x-displayname": "Name", "x-ves-example": "Content-Type.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.http_header_field": "true", "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.min_bytes": "1" }, "x-f5xc-example": "Content-Type", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.http_header_field": "true", "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.min_bytes": "1" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "minLength": 1, "maxLength": 63, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true, "byteLength": { "max": 256, "min": 1 } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "presence": { "type": "boolean", "description": "Exclusive with [exact regex]\nIf true, check for presence of header.", "title": "presence", "format": "boolean", "x-displayname": "Presence", "x-f5xc-description-short": "Exclusive with [exact regex] If true, check for presence of header.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "exact", "regex" ] }, "regex": { "type": "string", "description": "Exclusive with [exact presence]\nRegex match of the header value in re2 format.", "title": "regex", "maxLength": 256, "x-displayname": "Regex", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.not_empty": "true", "ves.io.schema.rules.string.regex": "true" }, "x-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.not_empty": "true", "ves.io.schema.rules.string.regex": "true" }, "x-f5xc-description-short": "Exclusive with [exact presence] Regex match of the header value in re2 format.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "minLength": 1, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "byteLength": { "max": 256 }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "exact", "presence" ] } }, "x-f5xc-description-short": "Header match is done using the name of the header and its value.", "x-f5xc-description-medium": "Header match is done using the name of the header and its value. The value match is done using one of the following regex match on value exact match of value presence of header Header Match can also be inverse of above, which be used to check missing header or non-matching value.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for ioschemaHeaderMatcherType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"Content-Type\"\n}", "example_yaml": "name: Content-Type" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "ioschemaObjectRefType": { "type": "object", "description": "This type establishes a 'direct reference' from one object(the referrer) to another(the referred).\nSuch a reference is in form of tenant/namespace/name for public API and Uid for private API\nThis type of reference is called direct because the relation is explicit and concrete (as opposed\nto selector reference which builds a group based on labels of selectee objects)", "title": "ObjectRefType", "x-displayname": "Object reference.", "x-ves-proto-message": "ves.io.schema.ObjectRefType", "properties": { "kind": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen kind will hold the referred object's kind (e.g. \"route\")", "title": "kind", "x-displayname": "Kind", "x-ves-example": "Virtual_site.", "x-f5xc-example": "virtual_site", "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. \"route\")", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. \"route\").", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "readOnly": true, "minLength": 12, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "name": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen name will hold the referred object's(e.g. Route's) name.", "title": "name", "x-displayname": "Name", "x-ves-example": "Contactus-route.", "x-f5xc-example": "contactus-route", "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. Route's) name.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 6, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "namespace": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen namespace will hold the referred object's(e.g. Route's) namespace.", "title": "namespace", "x-displayname": "Namespace", "x-ves-example": "Ns1", "x-f5xc-example": "ns1", "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. Route's) namespace.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "tenant": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen tenant will hold the referred object's(e.g. Route's) tenant.", "title": "tenant", "x-displayname": "Tenant", "x-ves-example": "Example-corp.", "x-f5xc-example": "example-corp", "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. Route's) tenant.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "readOnly": true, "x-field-mutability": "read-only", "minLength": 12, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "uid": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen uid will hold the referred object's(e.g. Route's) uid.", "title": "uid", "x-displayname": "UID", "x-ves-example": "00000000-0000-4000-8000-0df41b679859.", "x-f5xc-example": "00000000-0000-4000-8000-0df41b679859", "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g. Route's) uid.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "readOnly": true, "x-field-mutability": "read-only", "minLength": 36, "format": "uuid", "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Type establishes a 'direct reference' from one object(the referrer) to another(the referred).", "x-f5xc-description-medium": "Type establishes a 'direct reference' from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for ioschemaObjectRefType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityEventsCounter": { "type": "object", "description": "SecurityEventsCounter contains the timeseries data of security events counter.", "title": "Security Events Counter", "x-displayname": "Security Events Counter.", "x-ves-proto-message": "ves.io.schema.app_security.metrics.SecurityEventsCounter", "properties": { "id": { "allOf": [ { "$ref": "#/components/schemas/metricsSecurityEventsId" } ], "x-f5xc-example": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "metric": { "type": "array", "description": "List of metric values.", "title": "Metric Values", "items": { "$ref": "#/components/schemas/metricsSecurityMetricValue" }, "x-displayname": "Metric Values.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "SecurityEventsCounter contains the timeseries data of security events counter.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityEventsCounter", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityEventsId": { "type": "object", "description": "SecurityEventsId uniquely identifies an entry in the response for security events metrics query.\nSecurity events counter is aggregated based on the MetricLabel specified in the group_by field in the request.\nTherefore, only the fields that corresponds to the MetricLabel in the group_by will have non-empty\nvalue in the response.", "title": "SecurityEventsId", "x-displayname": "Security Events ID.", "x-ves-proto-message": "ves.io.schema.app_security.metrics.SecurityEventsId", "properties": { "namespace": { "type": "string", "description": "Namespace for which the security event was generated.", "title": "Namespace", "x-displayname": "Namespace", "x-ves-example": "Blogging-app-namespace-1.", "x-f5xc-example": "blogging-app-namespace-1", "x-f5xc-description-short": "Namespace for which the security event was generated.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "naming", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "inferred", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "sec_event_type": { "type": "string", "description": "Event or occurrence data", "title": "Security Event Type", "x-displayname": "Security Event Type.", "x-ves-example": "WAF", "x-f5xc-example": "WAF", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "src_instance": { "type": "string", "description": "Instance or deployment identifier", "title": "Source Instance", "x-displayname": "Source Instance.", "x-ves-example": "IN", "x-f5xc-example": "IN", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "src_site": { "type": "string", "description": "Site or location identifier", "title": "Source Site", "x-displayname": "Source Site.", "x-ves-example": "Greatblogs-CE.", "x-f5xc-example": "greatblogs-ce", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "vh_name": { "type": "string", "description": "Human-readable name for the resource", "title": "Virtual Host", "x-displayname": "Virtual Host.", "x-ves-example": "Greatblogs-vhost.", "x-f5xc-example": "greatblogs-vhost", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "SecurityEventsId uniquely identifies an entry in the response for security events metrics query.", "x-f5xc-description-medium": "SecurityEventsId uniquely identifies an entry in the response for security events metrics query. Security events counter is aggregated based on the MetricLabel specified in the group_by field in the request. Therefore, only the fields that corresponds to the MetricLabel in the group_by will have...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityEventsId", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityMetricLabel": { "type": "string", "description": "Labels in the security events metrics.\n\nSecurity events metric can be sliced and diced based\non one or more labels listed below.", "enum": [ "NAMESPACE", "VH_NAME", "SEC_EVENT_TYPE", "SRC_SITE", "SRC_INSTANCE" ], "default": "NAMESPACE", "x-displayname": "Security Events Metric Labels.", "x-ves-proto-enum": "ves.io.schema.app_security.metrics.SecurityMetricLabel", "x-f5xc-description-short": "Labels in the security events metrics. Security events metric can be sliced and diced based on one or more labels listed below.", "x-f5xc-description-medium": "Labels in the security events metrics. Security events metric can be sliced and diced based on one or more labels listed below.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityMetricLabel", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"NAMESPACE\"", "example_yaml": "NAMESPACE\n..." }, "x-f5xc-cli-domain": "label", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityMetricLabelFilter": { "type": "object", "description": "Label based filtering for Security Events metrics.\n\nSecurity Events metrics are tagged with labels mentioned in MetricLabel.\nMetric label filter can be specified to query specific metrics based on label match.", "x-displayname": "Security Events Metric Label Filter.", "x-ves-proto-message": "ves.io.schema.app_security.metrics.SecurityMetricLabelFilter", "properties": { "label": { "allOf": [ { "$ref": "#/components/schemas/metricsSecurityMetricLabel" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "op": { "allOf": [ { "$ref": "#/components/schemas/metricsSecurityMetricLabelOp" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "value": { "type": "string", "description": "Value to be compared with.", "title": "Value", "x-displayname": "Value", "x-ves-example": "Blogging-app-namespace-1.", "x-f5xc-example": "blogging-app-namespace-1", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 3, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Label based filtering for Security Events metrics. Security Events metrics are tagged with labels mentioned in MetricLabel.", "x-f5xc-description-medium": "Label based filtering for Security Events metrics. Security Events metrics are tagged with labels mentioned in MetricLabel. Metric label filter can be specified to query specific metrics based on label match.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityMetricLabelFilter", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "label", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityMetricLabelOp": { "type": "string", "description": "The operator to use when querying Security Events metrics with labels.", "title": "Security Events Metric Label Operator", "enum": [ "EQ", "NEQ" ], "default": "EQ", "x-displayname": "Security Events Metric Label Operator.", "x-ves-proto-enum": "ves.io.schema.app_security.metrics.SecurityMetricLabelOp", "x-f5xc-description-short": "The operator to use when querying Security Events metrics with labels.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityMetricLabelOp", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"EQ\"", "example_yaml": "EQ\n..." }, "x-f5xc-cli-domain": "label", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "metricsSecurityMetricValue": { "type": "object", "description": "Value returned for a Security Events Metrics query.", "title": "Metric Value", "x-displayname": "Metric Value.", "x-ves-proto-message": "ves.io.schema.app_security.metrics.SecurityMetricValue", "properties": { "timestamp": { "type": "number", "description": "Timestamp", "title": "Timestamp", "format": "double", "x-displayname": "Timestamp", "x-ves-example": "1570007981.", "x-f5xc-example": "1570007981", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "value": { "type": "string", "description": "Configuration parameter for value", "title": "Value", "x-displayname": "Value", "x-ves-example": "15", "x-f5xc-example": "15", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 3, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Value returned for a Security Events Metrics query.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for metricsSecurityMetricValue", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAppFirewallAttackTypeContext": { "type": "object", "description": "App Firewall Attack Type context changes to be applied for this request.", "title": "App Firewall Attack Type Context", "x-displayname": "App Firewall Attack Type Context.", "x-ves-proto-message": "ves.io.schema.policy.AppFirewallAttackTypeContext", "properties": { "context": { "allOf": [ { "$ref": "#/components/schemas/policyDetectionContext" } ], "x-f5xc-description-medium": "Exclusion scope. Use CONTEXT_PARAMETER with context_name for one parameter, CONTEXT_COOKIE for one cookie, or CONTEXT_ANY only for an intentionally global scope.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Exclusion scope. Use CONTEXT_PARAMETER with context_name for one parameter, CONTEXT_COOKIE for one cookie, or CONTEXT_ANY only for an intentionally global scope." }, "context_name": { "type": "string", "description": "Parameter, cookie, or header name selected by context. For a parameter-scoped WAF exception, set context to CONTEXT_PARAMETER and name only the intended parameter.", "title": "Context Name", "maxLength": 128, "x-displayname": "Context Name.", "x-ves-example": "Example: user-agent for Header.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "example-resource", "x-f5xc-description-short": "Parameter, cookie, or header name selected by context.", "x-f5xc-description-medium": "Parameter, cookie, or header name selected by context. For a parameter-scoped WAF exception, set context to CONTEXT_PARAMETER and name only the intended parameter.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_attack_type": { "allOf": [ { "$ref": "#/components/schemas/app_firewallAttackType" } ], "x-f5xc-description-short": "Attack-type enum excluded in this context, for example ATTACK_TYPE_CROSS_SITE_SCRIPTING.", "x-f5xc-description-medium": "Attack-type enum excluded in this context, for example ATTACK_TYPE_CROSS_SITE_SCRIPTING. Other attack types remain enforced.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "description": "Attack-type enum excluded in this context, for example ATTACK_TYPE_CROSS_SITE_SCRIPTING. Other attack types remain enforced." } }, "x-f5xc-description-short": "App Firewall Attack Type context changes to be applied for this request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAppFirewallAttackTypeContext", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAppFirewallDetectionControl": { "type": "object", "description": "Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria.", "title": "App Firewall Detection Control", "x-displayname": "App Firewall Detection Control.", "x-ves-proto-message": "ves.io.schema.policy.AppFirewallDetectionControl", "properties": { "exclude_attack_type_contexts": { "type": "array", "description": "Exclude an entire attack type only in the named context. For migrated per-parameter exceptions, prefer this over signature-ID exclusions because one payload can trigger several signatures; unrelated parameters and attack types remain protected.", "title": "Exclude Attack Types Contexts", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyAppFirewallAttackTypeContext" }, "x-displayname": "Attack Types.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Exclude an entire attack type only in the named context.", "x-f5xc-description-medium": "Exclude an entire attack type only in the named context. For migrated per-parameter exceptions, prefer this over signature-ID exclusions because one payload can trigger several signatures; unrelated parameters and attack types remain protected.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_bot_name_contexts": { "type": "array", "description": "Bot Names to be excluded for the defined match criteria.", "title": "Exclude Bot Names Contexts", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyBotNameContext" }, "x-displayname": "Bot Names", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "example-resource", "x-f5xc-description-short": "Bot Names to be excluded for the defined match criteria.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_signature_contexts": { "type": "array", "description": "Signature IDs to be excluded for the defined match criteria.", "title": "Exclude Signature Contexts", "maxItems": 1024, "items": { "$ref": "#/components/schemas/policyAppFirewallSignatureContext" }, "x-displayname": "Signature IDs.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "1024", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "1024", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Signature IDs to be excluded for the defined match criteria.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 1024, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_violation_contexts": { "type": "array", "description": "Violations to be excluded for the defined match criteria.", "title": "Exclude Violation Contexts", "maxItems": 64, "items": { "$ref": "#/components/schemas/policyAppFirewallViolationContext" }, "x-displayname": "Violations.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Violations to be excluded for the defined match criteria.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria.", "x-f5xc-description-medium": "Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAppFirewallDetectionControl", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAppFirewallSignatureContext": { "type": "object", "description": "App Firewall signature context changes to be applied for this request.", "title": "App Firewall Signature Context", "x-displayname": "App Firewall Signature Context.", "x-ves-proto-message": "ves.io.schema.policy.AppFirewallSignatureContext", "properties": { "context": { "allOf": [ { "$ref": "#/components/schemas/policyDetectionContext" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "context_name": { "type": "string", "description": "Relevant only for contexts: Header, Cookie and Parameter.\nName of the Context that the WAF Exclusion Rules will check.\nWildcard matching can be used by prefixing or suffixing the context name\nwith an wildcard asterisk (*).", "title": "Context Name", "maxLength": 128, "x-displayname": "Context Name.", "x-ves-example": "Example: user-agent for Header.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "exampleuser-agent for Header", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check.", "x-f5xc-description-medium": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "signature_id": { "type": "integer", "description": "The allowed values for signature ID are 0 and in the range of 200000001-299999999.\n0 implies that all signatures will be excluded for the specified context.", "title": "SignatureID", "format": "int64", "x-displayname": "SignatureID.", "x-ves-example": "10000001", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "299999999" }, "x-f5xc-example": "10000001", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.uint32.gte": "0", "ves.io.schema.rules.uint32.lte": "299999999" }, "x-f5xc-description-short": "The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the...", "x-f5xc-description-medium": "The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context.", "x-f5xc-constraints": { "constraintType": "number", "category": "discovery", "minimum": 0, "maximum": 299999999, "deterministic": true, "metadata": { "source": "api-probed", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "x-field-mutability": "read-only" } }, "x-f5xc-description-short": "App Firewall signature context changes to be applied for this request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAppFirewallSignatureContext", "required_fields": [ "signature_id" ], "mutually_exclusive_groups": [], "example_json": "{\n \"signature_id\": 0\n}", "example_yaml": "signature_id: 0" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAppFirewallViolationContext": { "type": "object", "description": "App Firewall violation context changes to be applied for this request.", "title": "App Firewall Violation Context", "x-displayname": "App Firewall Violation Context.", "x-ves-proto-message": "ves.io.schema.policy.AppFirewallViolationContext", "properties": { "context": { "allOf": [ { "$ref": "#/components/schemas/policyDetectionContext" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "context_name": { "type": "string", "description": "Relevant only for contexts: Header, Cookie and Parameter.\nName of the Context that the WAF Exclusion Rules will check.\nWildcard matching can be used by prefixing or suffixing the context name\nwith an wildcard asterisk (*).", "title": "Context Name", "maxLength": 128, "x-displayname": "Context Name.", "x-ves-example": "Example: user-agent for Header.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-example": "exampleuser-agent for Header", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "128" }, "x-f5xc-description-short": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check.", "x-f5xc-description-medium": "Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*).", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 128, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exclude_violation": { "allOf": [ { "$ref": "#/components/schemas/app_firewallAppFirewallViolationType" } ], "x-f5xc-description-short": "Configuration parameter for exclude violation.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "App Firewall violation context changes to be applied for this request.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAppFirewallViolationContext", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAsnMatchList": { "type": "object", "description": "An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer.", "title": "Asn Match List", "x-displayname": "ASN Match List.", "x-ves-proto-message": "ves.io.schema.policy.AsnMatchList", "properties": { "as_numbers": { "type": "array", "description": "An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer.", "title": "as numbers", "minItems": 1, "maxItems": 16, "items": { "type": "integer", "format": "int64" }, "x-displayname": "AS Numbers.", "x-ves-example": "[713, 7932, 847325, 4683, 15269, 1000001]", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "[713, 7932, 847325, 4683, 15269, 1000001]", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.min_items": "1", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy.", "x-f5xc-description-medium": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "minItems": 1, "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy.", "x-f5xc-description-medium": "Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAsnMatchList", "required_fields": [ "as_numbers" ], "mutually_exclusive_groups": [], "example_json": "{\n \"as_numbers\": [\n 0\n ]\n}", "example_yaml": "as_numbers:\n- 0" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyAsnMatcherType": { "type": "object", "description": "Match any AS number contained in the list of bgp_asn_sets.", "title": "asn matcher type", "x-displayname": "ASN Matcher.", "x-ves-proto-message": "ves.io.schema.policy.AsnMatcherType", "properties": { "asn_sets": { "type": "array", "description": "A list of references to bgp_asn_set objects.", "title": "asn_sets", "maxItems": 4, "items": { "$ref": "#/components/schemas/ioschemaObjectRefType" }, "x-displayname": "BGP ASN Sets.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "4" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "4" }, "x-f5xc-description-short": "List of references to bgp_asn_set objects.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 4, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Match any AS number contained in the list of bgp_asn_sets.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyAsnMatcherType", "required_fields": [ "asn_sets" ], "mutually_exclusive_groups": [], "example_json": "{\n \"asn_sets\": [\n {}\n ]\n}", "example_yaml": "asn_sets:\n- {}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyBotNameContext": { "type": "object", "description": "Specifies bot to be excluded by its name.", "title": "Bot Name Context", "x-displayname": "Bot Name", "x-ves-proto-message": "ves.io.schema.policy.BotNameContext", "properties": { "bot_name": { "type": "string", "description": "Human-readable name for the resource", "title": "BotName", "x-displayname": "Bot Name", "x-ves-example": "Hydra", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "x-f5xc-example": "Hydra", "x-validation-rules": { "ves.io.schema.rules.message.required": "true" }, "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Specifies bot to be excluded by its name.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyBotNameContext", "required_fields": [ "bot_name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"bot_name\": \"Hydra\"\n}", "example_yaml": "bot_name: Hydra" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyClientMatcher__ves_io_schema_app_security": { "type": "object", "description": "Client conditions for matching a rule.", "title": "Client Matcher", "x-displayname": "Client Matcher.", "x-ves-oneof-field-client_choice": "[\"any_client\",\"client_selector\",\"ip_threat_category_list\"]", "x-ves-oneof-field-ip_asn_choice": "[\"any_ip\",\"asn_list\",\"asn_matcher\",\"ip_matcher\",\"ip_prefix_list\"]", "x-ves-proto-message": "ves.io.schema.policy.ClientMatcher", "properties": { "any_client": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "client_selector", "ip_threat_category_list" ] }, "any_ip": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "asn_list", "asn_matcher", "ip_matcher", "ip_prefix_list" ] }, "asn_list": { "allOf": [ { "$ref": "#/components/schemas/policyAsnMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_ip", "asn_matcher", "ip_matcher", "ip_prefix_list" ] }, "asn_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyAsnMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for asn matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_ip", "asn_list", "ip_matcher", "ip_prefix_list" ] }, "client_selector": { "allOf": [ { "$ref": "#/components/schemas/schemaLabelSelectorType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_client", "ip_threat_category_list" ] }, "ip_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyIpMatcherType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_ip", "asn_list", "asn_matcher", "ip_prefix_list" ] }, "ip_prefix_list": { "allOf": [ { "$ref": "#/components/schemas/policyPrefixMatchList" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_ip", "asn_list", "asn_matcher", "ip_matcher" ] }, "ip_threat_category_list": { "allOf": [ { "$ref": "#/components/schemas/schemapolicyIPThreatCategoryListType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_client", "client_selector" ] }, "tls_fingerprint_matcher": { "allOf": [ { "$ref": "#/components/schemas/policyTlsFingerprintMatcherType" } ], "x-f5xc-description-short": "Configuration parameter for tls fingerprint matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyClientMatcher", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyCookieMatcherType__ves_io_schema_app_security": { "type": "object", "description": "A cookie matcher specifies the name of a single cookie and the criteria to match it. The input has a list of values for each\ncookie in the request.\nA cookie matcher can check for one of the following:\n* Presence or absence of the cookie\n* At least one of the values for the cookie in the request satisfies the MatcherType item.", "title": "CookieMatcherType", "x-displayname": "Cookie Matcher.", "x-ves-displayorder": "1,6,4", "x-ves-oneof-field-match": "[\"check_not_present\",\"check_present\",\"item\"]", "x-ves-proto-message": "ves.io.schema.policy.CookieMatcherType", "properties": { "check_not_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check not present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_present", "item" ] }, "check_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_not_present", "item" ] }, "invert_matcher": { "type": "boolean", "description": "Invert Match of the expression defined.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "item": { "allOf": [ { "$ref": "#/components/schemas/policyMatcherType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "maxLength": 26, "minLength": 15, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "x-f5xc-conflicts-with": [ "check_not_present", "check_present" ] }, "name": { "type": "string", "description": "A case-sensitive cookie name.", "title": "name", "maxLength": 63, "x-displayname": "Cookie Name.", "x-ves-example": "Session", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-example": "Session", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true, "byteLength": { "max": 256 } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" } }, "x-f5xc-description-short": "Cookie matcher specifies the name of a single cookie and the criteria to match it.", "x-f5xc-description-medium": "Cookie matcher specifies the name of a single cookie and the criteria to match it. The input has a list of values for each cookie in the request. A cookie matcher can check for one of the following: * Presence or absence of the cookie * At least one of the values for the cookie in the request...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyCookieMatcherType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"Session\"\n}", "example_yaml": "name: Session" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyCountryCode": { "type": "string", "description": "ISO 3166 Aplpha-2 country codes.", "title": "CountryCode", "enum": [ "COUNTRY_NONE", "COUNTRY_AD", "COUNTRY_AE", "COUNTRY_AF", "COUNTRY_AG", "COUNTRY_AI", "COUNTRY_AL", "COUNTRY_AM", "COUNTRY_AN", "COUNTRY_AO", "COUNTRY_AQ", "COUNTRY_AR", "COUNTRY_AS", "COUNTRY_AT", "COUNTRY_AU", "COUNTRY_AW", "COUNTRY_AX", "COUNTRY_AZ", "COUNTRY_BA", "COUNTRY_BB", "COUNTRY_BD", "COUNTRY_BE", "COUNTRY_BF", "COUNTRY_BG", "COUNTRY_BH", "COUNTRY_BI", "COUNTRY_BJ", "COUNTRY_BL", "COUNTRY_BM", "COUNTRY_BN", "COUNTRY_BO", "COUNTRY_BQ", "COUNTRY_BR", "COUNTRY_BS", "COUNTRY_BT", "COUNTRY_BV", "COUNTRY_BW", "COUNTRY_BY", "COUNTRY_BZ", "COUNTRY_CA", "COUNTRY_CC", "COUNTRY_CD", "COUNTRY_CF", "COUNTRY_CG", "COUNTRY_CH", "COUNTRY_CI", "COUNTRY_CK", "COUNTRY_CL", "COUNTRY_CM", "COUNTRY_CN", "COUNTRY_CO", "COUNTRY_CR", "COUNTRY_CS", "COUNTRY_CU", "COUNTRY_CV", "COUNTRY_CW", "COUNTRY_CX", "COUNTRY_CY", "COUNTRY_CZ", "COUNTRY_DE", "COUNTRY_DJ", "COUNTRY_DK", "COUNTRY_DM", "COUNTRY_DO", "COUNTRY_DZ", "COUNTRY_EC", "COUNTRY_EE", "COUNTRY_EG", "COUNTRY_EH", "COUNTRY_ER", "COUNTRY_ES", "COUNTRY_ET", "COUNTRY_FI", "COUNTRY_FJ", "COUNTRY_FK", "COUNTRY_FM", "COUNTRY_FO", "COUNTRY_FR", "COUNTRY_GA", "COUNTRY_GB", "COUNTRY_GD", "COUNTRY_GE", "COUNTRY_GF", "COUNTRY_GG", "COUNTRY_GH", "COUNTRY_GI", "COUNTRY_GL", "COUNTRY_GM", "COUNTRY_GN", "COUNTRY_GP", "COUNTRY_GQ", "COUNTRY_GR", "COUNTRY_GS", "COUNTRY_GT", "COUNTRY_GU", "COUNTRY_GW", "COUNTRY_GY", "COUNTRY_HK", "COUNTRY_HM", "COUNTRY_HN", "COUNTRY_HR", "COUNTRY_HT", "COUNTRY_HU", "COUNTRY_ID", "COUNTRY_IE", "COUNTRY_IL", "COUNTRY_IM", "COUNTRY_IN", "COUNTRY_IO", "COUNTRY_IQ", "COUNTRY_IR", "COUNTRY_IS", "COUNTRY_IT", "COUNTRY_JE", "COUNTRY_JM", "COUNTRY_JO", "COUNTRY_JP", "COUNTRY_KE", "COUNTRY_KG", "COUNTRY_KH", "COUNTRY_KI", "COUNTRY_KM", "COUNTRY_KN", "COUNTRY_KP", "COUNTRY_KR", "COUNTRY_KW", "COUNTRY_KY", "COUNTRY_KZ", "COUNTRY_LA", "COUNTRY_LB", "COUNTRY_LC", "COUNTRY_LI", "COUNTRY_LK", "COUNTRY_LR", "COUNTRY_LS", "COUNTRY_LT", "COUNTRY_LU", "COUNTRY_LV", "COUNTRY_LY", "COUNTRY_MA", "COUNTRY_MC", "COUNTRY_MD", "COUNTRY_ME", "COUNTRY_MF", "COUNTRY_MG", "COUNTRY_MH", "COUNTRY_MK", "COUNTRY_ML", "COUNTRY_MM", "COUNTRY_MN", "COUNTRY_MO", "COUNTRY_MP", "COUNTRY_MQ", "COUNTRY_MR", "COUNTRY_MS", "COUNTRY_MT", "COUNTRY_MU", "COUNTRY_MV", "COUNTRY_MW", "COUNTRY_MX", "COUNTRY_MY", "COUNTRY_MZ", "COUNTRY_NA", "COUNTRY_NC", "COUNTRY_NE", "COUNTRY_NF", "COUNTRY_NG", "COUNTRY_NI", "COUNTRY_NL", "COUNTRY_NO", "COUNTRY_NP", "COUNTRY_NR", "COUNTRY_NU", "COUNTRY_NZ", "COUNTRY_OM", "COUNTRY_PA", "COUNTRY_PE", "COUNTRY_PF", "COUNTRY_PG", "COUNTRY_PH", "COUNTRY_PK", "COUNTRY_PL", "COUNTRY_PM", "COUNTRY_PN", "COUNTRY_PR", "COUNTRY_PS", "COUNTRY_PT", "COUNTRY_PW", "COUNTRY_PY", "COUNTRY_QA", "COUNTRY_RE", "COUNTRY_RO", "COUNTRY_RS", "COUNTRY_RU", "COUNTRY_RW", "COUNTRY_SA", "COUNTRY_SB", "COUNTRY_SC", "COUNTRY_SD", "COUNTRY_SE", "COUNTRY_SG", "COUNTRY_SH", "COUNTRY_SI", "COUNTRY_SJ", "COUNTRY_SK", "COUNTRY_SL", "COUNTRY_SM", "COUNTRY_SN", "COUNTRY_SO", "COUNTRY_SR", "COUNTRY_SS", "COUNTRY_ST", "COUNTRY_SV", "COUNTRY_SX", "COUNTRY_SY", "COUNTRY_SZ", "COUNTRY_TC", "COUNTRY_TD", "COUNTRY_TF", "COUNTRY_TG", "COUNTRY_TH", "COUNTRY_TJ", "COUNTRY_TK", "COUNTRY_TL", "COUNTRY_TM", "COUNTRY_TN", "COUNTRY_TO", "COUNTRY_TR", "COUNTRY_TT", "COUNTRY_TV", "COUNTRY_TW", "COUNTRY_TZ", "COUNTRY_UA", "COUNTRY_UG", "COUNTRY_UM", "COUNTRY_US", "COUNTRY_UY", "COUNTRY_UZ", "COUNTRY_VA", "COUNTRY_VC", "COUNTRY_VE", "COUNTRY_VG", "COUNTRY_VI", "COUNTRY_VN", "COUNTRY_VU", "COUNTRY_WF", "COUNTRY_WS", "COUNTRY_XK", "COUNTRY_XT", "COUNTRY_YE", "COUNTRY_YT", "COUNTRY_ZA", "COUNTRY_ZM", "COUNTRY_ZW" ], "default": "COUNTRY_NONE", "x-displayname": "Country Code.", "x-ves-proto-enum": "ves.io.schema.policy.CountryCode", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyCountryCode", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"COUNTRY_NONE\"", "example_yaml": "COUNTRY_NONE\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyDetectionContext": { "type": "string", "description": "The available contexts for Exclusion rules.\n\n- CONTEXT_ANY: CONTEXT_ANY\n\nDetection will be excluded for all contexts.\n- CONTEXT_BODY: CONTEXT_BODY\n\nDetection will be excluded for the request body.\n- CONTEXT_REQUEST: CONTEXT_REQUEST\n\nDetection will be excluded for the request.\n- CONTEXT_RESPONSE: CONTEXT_RESPONSE\n\n- CONTEXT_PARAMETER: CONTEXT_PARAMETER\n\nDetection will be excluded for the parameters. The parameter name is required in the Context name field. If the field is left empty, the detection will be excluded for all parameters.\n- CONTEXT_HEADER: CONTEXT_HEADER\n\nDetection will be excluded for the headers. The header name is required in the Context name field. If the field is left empty, the detection will be excluded for all headers.\n- CONTEXT_COOKIE: CONTEXT_COOKIE\n\nDetection will be excluded for the cookies. The cookie name is required in the Context name field. If the field is left empty, the detection will be excluded for all cookies.\n- CONTEXT_URL: CONTEXT_URL\n\nDetection will be excluded for the request URL.\n- CONTEXT_URI: CONTEXT_URI.", "title": "Detection Context", "enum": [ "CONTEXT_ANY", "CONTEXT_BODY", "CONTEXT_REQUEST", "CONTEXT_RESPONSE", "CONTEXT_PARAMETER", "CONTEXT_HEADER", "CONTEXT_COOKIE", "CONTEXT_URL", "CONTEXT_URI" ], "default": "CONTEXT_ANY", "x-displayname": "WAF Exclusion Context OPTIONS.", "x-ves-proto-enum": "ves.io.schema.policy.DetectionContext", "x-f5xc-description-short": "The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY...", "x-f5xc-description-medium": "The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyDetectionContext", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"CONTEXT_ANY\"", "example_yaml": "CONTEXT_ANY\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyHttpMethodMatcherType": { "type": "object", "description": "A HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list.\nThe result of the match based on the method list is inverted if invert_matcher is true.", "title": "HttpMethodMatcherType", "x-displayname": "HTTP Method Matcher.", "x-ves-proto-message": "ves.io.schema.policy.HttpMethodMatcherType", "properties": { "invert_matcher": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Method Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "methods": { "type": "array", "description": "List of methods values to match against.", "title": "methods", "maxItems": 16, "items": { "$ref": "#/components/schemas/schemaHttpMethod" }, "x-displayname": "Method List.", "x-ves-example": "['GET', 'POST', 'DELETE']", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['GET', 'POST', 'DELETE']", "x-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of methods values to match against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "HTTP method matcher specifies a list of methods to match an input HTTP method.", "x-f5xc-description-medium": "HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list. The result of the match based on the method list is inverted if invert_matcher is true.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyHttpMethodMatcherType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyIPThreatCategory": { "type": "string", "description": "The IP threat categories to use when a policy based IP threat category is configured.\n\n- SPAM_SOURCES: SPAM_SOURCES\n\n- WINDOWS_EXPLOITS: WINDOWS_EXPLOITS\n\n- WEB_ATTACKS: WEB_ATTACKS\n\n- BOTNETS: BOTNETS\n\n- SCANNERS: SCANNERS\n\n- REPUTATION: REPUTATION\n\n- PHISHING: PHISHING\n\n- PROXY: PROXY\n\n- MOBILE_THREATS: MOBILE_THREATS\n\n- TOR_PROXY: TOR_PROXY\n\n- DENIAL_OF_SERVICE: DENIAL_OF_SERVICE\n\n- NETWORK: NETWORK.", "title": "IP Threat Category", "enum": [ "SPAM_SOURCES", "WINDOWS_EXPLOITS", "WEB_ATTACKS", "BOTNETS", "SCANNERS", "REPUTATION", "PHISHING", "PROXY", "MOBILE_THREATS", "TOR_PROXY", "DENIAL_OF_SERVICE", "NETWORK" ], "default": "SPAM_SOURCES", "x-displayname": "IP Threat Category.", "x-ves-proto-enum": "ves.io.schema.policy.IPThreatCategory", "x-f5xc-description-short": "The IP threat categories to use when a policy based IP threat category is configured. - SPAM_SOURCES: SPAM_SOURCES - WINDOWS_EXPLOITS...", "x-f5xc-description-medium": "The IP threat categories to use when a policy based IP threat category is configured. - SPAM_SOURCES: SPAM_SOURCES - WINDOWS_EXPLOITS: WINDOWS_EXPLOITS - WEB_ATTACKS: WEB_ATTACKS - BOTNETS: BOTNETS - SCANNERS: SCANNERS - REPUTATION: REPUTATION - PHISHING: PHISHING - PROXY: PROXY ...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyIPThreatCategory", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"SPAM_SOURCES\"", "example_yaml": "SPAM_SOURCES\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyIpMatcherType": { "type": "object", "description": "Match any IP prefix contained in the list of ip_prefix_sets.\nThe result of the match is inverted if invert_matcher is true.", "title": "ip matcher type", "x-displayname": "IP Prefix Matcher.", "x-ves-proto-message": "ves.io.schema.policy.IpMatcherType", "properties": { "invert_matcher": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert IP Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "prefix_sets": { "type": "array", "description": "A list of references to ip_prefix_set objects.", "title": "prefix_sets", "maxItems": 4, "items": { "$ref": "#/components/schemas/ioschemaObjectRefType" }, "x-displayname": "IP Prefix Sets.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "4" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "4" }, "x-f5xc-description-short": "List of references to ip_prefix_set objects.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 4, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true.", "x-f5xc-description-medium": "Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyIpMatcherType", "required_fields": [ "prefix_sets" ], "mutually_exclusive_groups": [], "example_json": "{\n \"prefix_sets\": [\n {}\n ]\n}", "example_yaml": "prefix_sets:\n- {}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyJA4TlsFingerprintMatcherType": { "type": "object", "description": "An extended version of JA3 that includes additional fields for more comprehensive fingerprinting of\nSSL/TLS clients and potentially has a different structure and length.", "title": "JA4TlsFingerprintMatcherType", "x-displayname": "JA4 TLS Fingerprint Matcher.", "x-ves-proto-message": "ves.io.schema.policy.JA4TlsFingerprintMatcherType", "properties": { "exact_values": { "type": "array", "description": "A list of exact JA4 TLS fingerprint to match the input JA4 TLS fingerprint against.", "title": "exact values", "maxItems": 16, "items": { "type": "string" }, "x-displayname": "Exact Values.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "36", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "36", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of exact JA4 TLS fingerprint to match the input JA4 TLS fingerprint against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different...", "x-f5xc-description-medium": "Extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different structure and length.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyJA4TlsFingerprintMatcherType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyJWTClaimMatcherType__ves_io_schema_app_security": { "type": "object", "description": "A JWT claim matcher specifies the name of a single JWT claim and the criteria for the input request to match it.\nThe input has a list of actual values for each JWT claim name in the JWT payload.\nA JWT claim matcher can check for one of the following:\n* Presence or absence of the JWT Claim in the input\n* At least one of the values for the JWT Claim in the input satisfies the MatcherType item.", "title": "JWTClaimMatcherType", "x-displayname": "JWT Claim Matcher.", "x-ves-displayorder": "1,2,6", "x-ves-oneof-field-match": "[\"check_not_present\",\"check_present\",\"item\"]", "x-ves-proto-message": "ves.io.schema.policy.JWTClaimMatcherType", "properties": { "check_not_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check not present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_present", "item" ] }, "check_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_not_present", "item" ] }, "invert_matcher": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "item": { "allOf": [ { "$ref": "#/components/schemas/policyMatcherType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "maxLength": 26, "minLength": 15, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "x-f5xc-conflicts-with": [ "check_not_present", "check_present" ] }, "name": { "type": "string", "description": "JWT claim name.", "title": "name", "maxLength": 63, "x-displayname": "JWT Claim Name.", "x-ves-example": "User_id", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-example": "user_id", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true, "byteLength": { "max": 256 } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" } }, "x-f5xc-description-short": "JWT claim matcher specifies the name of a single JWT claim and the criteria for the input request to match it.", "x-f5xc-description-medium": "JWT claim matcher specifies the name of a single JWT claim and the criteria for the input request to match it. The input has a list of actual values for each JWT claim name in the JWT payload. A JWT claim matcher can check for one of the following: * Presence or absence of the JWT Claim in the...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyJWTClaimMatcherType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"user_id\"\n}", "example_yaml": "name: user_id" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyKnownTlsFingerprintClass": { "type": "string", "description": "Specifies known TLS fingerprint classes\n\n- TLS_FINGERPRINT_NONE: TLS_FINGERPRINT_NONE\n\nNo TLS fingerprint\n- ANY_MALICIOUS_FINGERPRINT: ANY_MALICIOUS_FINGERPRINT\n\nTLS fingerprints known to be associated with malicious clients\n- ADWARE: ADWARE\n\nTLS fingerprints known to be associated with adware\n- ADWIND: ADWIND\n\nTLS fingerprints known to be associated with adwind\n- DRIDEX: DRIDEX\n\nTLS fingerprints known to be associated with dridex\n- GOOTKIT: GOOTKIT\n\nTLS fingerprints known to be associated with gootkit\n- GOZI: GOZI\n\nTLS fingerprints known to be associated with gozi\n- JBIFROST: JBIFROST\n\nTLS fingerprints known to be associated with jbifrost\n- QUAKBOT: QUAKBOT\n\nTLS fingerprints known to be associated with quakbot\n- RANSOMWARE: RANSOMWARE\n\nTLS fingerprints known to be associated with ransomware\n- TROLDESH: TROLDESH\n\nTLS fingerprints known to be associated with troldesh\n- TOFSEE: TOFSEE\n\nTLS fingerprints known to be associated with tofsee\n- TORRENTLOCKER: TORRENTLOCKER\n\nTLS fingerprints known to be associated with torrentlocker\n- TRICKBOT: TRICKBOT\n\nTLS fingerprints known to be associated with trickbot.", "title": "TLS known fingerprint class", "enum": [ "TLS_FINGERPRINT_NONE", "ANY_MALICIOUS_FINGERPRINT", "ADWARE", "ADWIND", "DRIDEX", "GOOTKIT", "GOZI", "JBIFROST", "QUAKBOT", "RANSOMWARE", "TROLDESH", "TOFSEE", "TORRENTLOCKER", "TRICKBOT" ], "default": "TLS_FINGERPRINT_NONE", "x-displayname": "TLS known fingerprint class.", "x-ves-proto-enum": "ves.io.schema.policy.KnownTlsFingerprintClass", "x-f5xc-description-short": "Specifies known TLS fingerprint classes - TLS_FINGERPRINT_NONE: TLS_FINGERPRINT_NONE No TLS fingerprint - ANY_MALICIOUS_FINGERPRINT...", "x-f5xc-description-medium": "Specifies known TLS fingerprint classes - TLS_FINGERPRINT_NONE: TLS_FINGERPRINT_NONE No TLS fingerprint - ANY_MALICIOUS_FINGERPRINT: ANY_MALICIOUS_FINGERPRINT TLS fingerprints known to be associated with malicious clients - ADWARE: ADWARE TLS fingerprints known to be associated with adware ...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyKnownTlsFingerprintClass", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"TLS_FINGERPRINT_NONE\"", "example_yaml": "TLS_FINGERPRINT_NONE\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyMatcherType": { "type": "object", "description": "A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set\nof supported match criteria includes a list of exact values and a list of regular expressions.", "title": "MatcherType", "x-displayname": "Matcher", "x-ves-proto-message": "ves.io.schema.policy.MatcherType", "properties": { "exact_values": { "type": "array", "description": "A list of exact values to match the input against.", "title": "exact values", "maxItems": 64, "items": { "type": "string", "maxLength": 256 }, "x-displayname": "Exact Values.", "x-ves-example": "['new york', 'london', 'sydney', 'tokyo', 'cairo']", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['new york', 'london', 'sydney', 'tokyo', 'cairo']", "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "64", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of exact values to match the input against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 64, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "regex_values": { "type": "array", "description": "A list of regular expressions to match the input against.", "title": "regex values", "maxItems": 16, "items": { "type": "string", "maxLength": 256 }, "x-displayname": "Regex Values.", "x-ves-example": "['^new .*$', 'san f.*', '.* del .*']", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.items.string.regex": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['^new .*$', 'san f.*', '.* del .*']", "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.max_bytes": "256", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.items.string.regex": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of regular expressions to match the input against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "transformers": { "type": "array", "description": "An ordered list of transformers (starting from index 0) to be applied to the path before matching.", "title": "transformers", "maxItems": 9, "items": { "$ref": "#/components/schemas/policyTransformer" }, "x-displayname": "Transformers.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "9", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "\"[BASE64_DECODE, LOWER_CASE]", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "9", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "Ordered list of transformers (starting from index 0) to be applied to the path before matching.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 9, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied.", "x-f5xc-description-medium": "Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyMatcherType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyPrefixMatchList": { "type": "object", "description": "List of IP Prefix strings to match against.", "title": "IP Prefix Match List", "x-displayname": "IP Prefix Match List.", "x-ves-proto-message": "ves.io.schema.policy.PrefixMatchList", "properties": { "invert_match": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Match Result.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "ip_prefixes": { "type": "array", "description": "List of IPv4 prefix strings.", "title": "ip prefixes", "maxItems": 128, "items": { "type": "string" }, "x-displayname": "IPv4 Prefix List.", "x-ves-example": "192.0.2.0/24.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.ipv4_prefix": "true", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "128", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "192.0.2.0/24", "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.ipv4_prefix": "true", "ves.io.schema.rules.repeated.items.string.not_empty": "true", "ves.io.schema.rules.repeated.max_items": "128", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 128, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "List of IP Prefix strings to match against.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyPrefixMatchList", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyRequestMatcher__ves_io_schema_app_security": { "type": "object", "description": "Request conditions for matching a rule.", "title": "Request Matcher", "x-displayname": "Request Matcher.", "x-ves-proto-message": "ves.io.schema.policy.RequestMatcher", "properties": { "cookie_matchers": { "type": "array", "description": "A list of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances\nof CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name.\nNote that all specified cookie matcher predicates must evaluate to true.", "title": "cookie matchers", "maxItems": 16, "items": { "$ref": "#/components/schemas/policyCookieMatcherType__ves_io_schema_app_security" }, "x-displayname": "Cookie Matchers.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-f5xc-description-short": "List of predicates for all cookies that need to be matched.", "x-f5xc-description-medium": "List of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances of CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "headers": { "type": "array", "description": "A list of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType\ninstances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type.\nNote that all specified header predicates must evaluate to true.", "title": "headers", "maxItems": 16, "items": { "$ref": "#/components/schemas/schemapolicyHeaderMatcherType__ves_io_schema_app_security" }, "x-displayname": "HTTP Headers.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "List of predicates for various HTTP headers that need to match.", "x-f5xc-description-medium": "List of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType instances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "minItems": 0, "uniqueItems": false, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "jwt_claims": { "type": "array", "description": "A list of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType\ninstances. The actual JWT claims values are extracted from the JWT payload as a list of strings.\nNote that all specified JWT claim predicates must evaluate to true.\nNote that this feature only works on LBs with JWT Validation feature enabled.", "title": "JWT claims", "maxItems": 16, "items": { "$ref": "#/components/schemas/policyJWTClaimMatcherType__ves_io_schema_app_security" }, "x-displayname": "JWT Claims.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-f5xc-description-short": "List of predicates for various JWT claims that need to match.", "x-f5xc-description-medium": "List of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType instances. The actual JWT claims values are extracted from the JWT payload as a list of strings.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "query_params": { "type": "array", "description": "A list of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances\nof QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query parameter name.\nNote that all specified query parameter predicates must evaluate to true.", "title": "query params", "maxItems": 16, "items": { "$ref": "#/components/schemas/schemapolicyQueryParameterMatcherType__ves_io_schema_app_security" }, "x-displayname": "HTTP Query Parameters.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16" }, "x-f5xc-description-short": "List of predicates for all query parameters that need to be matched.", "x-f5xc-description-medium": "List of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances of QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query...", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyRequestMatcher", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policySimpleWafExclusionRule__ves_io_schema_app_security": { "type": "object", "description": "Simple WAF exclusion rule specifies a simple set of match conditions to be matched to skip a list of WAF detections.", "title": "SimpleWafExclusionRule", "x-displayname": "WAF Exclusion Rule.", "x-ves-displayorder": "10,3,16,7,14,9", "x-ves-oneof-field-domain_choice": "[\"any_domain\",\"exact_value\",\"suffix_value\"]", "x-ves-oneof-field-path_choice": "[\"any_path\",\"path_prefix\",\"path_regex\"]", "x-ves-oneof-field-waf_advanced_configuration": "[\"app_firewall_detection_control\",\"waf_skip_processing\"]", "x-ves-proto-message": "ves.io.schema.policy.SimpleWafExclusionRule", "properties": { "any_domain": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "exact_value", "suffix_value" ] }, "any_path": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "path_prefix", "path_regex" ] }, "app_firewall_detection_control": { "allOf": [ { "$ref": "#/components/schemas/policyAppFirewallDetectionControl" } ], "x-f5xc-description-short": "Configuration parameter for app firewall detection control.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "waf_skip_processing" ] }, "exact_value": { "type": "string", "description": "Exclusive with [any_domain suffix_value]\nExact domain name.", "title": "exact value", "minLength": 1, "maxLength": 256, "x-displayname": "Exact Value.", "x-ves-example": "abc.zyz.com.", "x-ves-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256", "ves.io.schema.rules.string.min_len": "1" }, "x-f5xc-example": "abc.zyz.com", "x-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256", "ves.io.schema.rules.string.min_len": "1" }, "x-f5xc-description-short": "Exclusive with [any_domain suffix_value] Exact domain name.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "minLength": 1, "maxLength": 256, "format": "hostname", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_domain", "suffix_value" ] }, "expiration_timestamp": { "type": "string", "description": "The expiration_timestamp is the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in\nthe configuration but is not applied anymore.", "title": "expiration timestamp", "format": "date-time", "x-displayname": "Expiration Timestamp.", "x-ves-example": "2019-12-31:44:34.171543432Z.", "x-f5xc-example": "2019-12-31:44:34.171543432Z", "x-f5xc-description-short": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired.", "x-f5xc-description-medium": "Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore.", "maxLength": 1024, "x-f5xc-constraints": { "constraintType": "string", "category": "general", "maxLength": 1024, "format": "date-time", "metadata": { "source": "inferred", "confidence": 0.85, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "metadata": { "allOf": [ { "$ref": "#/components/schemas/schemaMessageMetaType" } ], "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "methods": { "type": "array", "description": "Methods to be matched.", "title": "Methods", "maxItems": 16, "items": { "$ref": "#/components/schemas/schemaHttpMethod" }, "x-displayname": "Methods", "x-ves-example": "GET", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "GET", "x-validation-rules": { "ves.io.schema.rules.repeated.items.enum.defined_only": "true", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "path_prefix": { "type": "string", "description": "Exclusive with [any_path path_regex]\nPath prefix to match (e.g. The value / will match on all paths)", "title": "prefix", "maxLength": 256, "x-displayname": "Prefix", "x-ves-example": "/register/.", "x-ves-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "/register/", "x-validation-rules": { "ves.io.schema.rules.string.http_path": "true", "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-description-short": "Exclusive with [any_path path_regex] Path prefix to match (e.g. The value / will match on all paths)", "x-f5xc-description-medium": "Exclusive with [any_path path_regex] Path prefix to match (e.g. The value / will match on all paths).", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_path", "path_regex" ] }, "path_regex": { "type": "string", "description": "Exclusive with [any_path path_prefix]\nDefine the regex for the path. For example, the regex ^/.*$ will match on all paths.", "title": "Path Regex", "maxLength": 256, "x-displayname": "Path Regex.", "x-ves-example": "/blog_id/.*.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.regex": "true" }, "x-f5xc-example": "/blog_id/.*", "x-validation-rules": { "ves.io.schema.rules.string.max_bytes": "256", "ves.io.schema.rules.string.regex": "true" }, "x-f5xc-description-short": "Exclusive with [any_path path_prefix] Define the regex for the path. For example, the regex ^/.*$ will match on all paths.", "x-f5xc-description-medium": "Exclusive with [any_path path_prefix] Define the regex for the path. For example, the regex ^/.*$ will match on all paths.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "byteLength": { "max": 256 }, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_path", "path_prefix" ] }, "suffix_value": { "type": "string", "description": "Exclusive with [any_domain exact_value]\nSuffix of domain name e.g \"xyz.com\" will match \"*.xyz.com\" and \"xyz.com\"", "title": "suffix value", "minLength": 1, "maxLength": 256, "x-displayname": "Suffix Value.", "x-ves-example": "xyz.com", "x-ves-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256", "ves.io.schema.rules.string.min_len": "1" }, "x-f5xc-example": "xyz.com", "x-validation-rules": { "ves.io.schema.rules.string.hostname": "true", "ves.io.schema.rules.string.max_len": "256", "ves.io.schema.rules.string.min_len": "1" }, "x-f5xc-description-short": "Exclusive with [any_domain exact_value] Suffix of domain name e.g \"xyz.com\" will match \"*.xyz.com\" and \"xyz.com\".", "x-f5xc-description-medium": "Exclusive with [any_domain exact_value] Suffix of domain name e.g \"xyz.com\" will match \"*.xyz.com\" and \"xyz.com\".", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "minLength": 1, "maxLength": 256, "format": "hostname", "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "any_domain", "exact_value" ] }, "waf_skip_processing": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "app_firewall_detection_control" ] } }, "x-f5xc-description-short": "Simple WAF exclusion rule specifies a simple set of match conditions to be matched to skip a list of WAF detections.", "x-f5xc-description-medium": "Simple WAF exclusion rule specifies a simple set of match conditions to be matched to skip a list of WAF detections.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policySimpleWafExclusionRule", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "virtual", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyTlsFingerprintMatcherType": { "type": "object", "description": "A TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positive match criteria includes a list of known\nclasses of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied and the input\nfingerprint is not one of the excluded values.", "title": "TlsFingerprintMatcherType", "x-displayname": "TLS Fingerprint Matcher.", "x-ves-proto-message": "ves.io.schema.policy.TlsFingerprintMatcherType", "properties": { "classes": { "type": "array", "description": "A list of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against.", "title": "classes", "maxItems": 16, "items": { "$ref": "#/components/schemas/policyKnownTlsFingerprintClass" }, "x-displayname": "TLS fingerprint classes.", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "\"['ADWARE', 'TRICKBOT']", "x-validation-rules": { "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "exact_values": { "type": "array", "description": "A list of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against.", "title": "exact values", "maxItems": 16, "items": { "type": "string" }, "x-displayname": "Exact Values.", "x-ves-example": "['ed6dfd54b01ebe31b7a65b88abfa7297', '16efcf0e00504ddfedde13bfea997952', 'de364c46b0dfc283b5e38c79ceae3f8f']", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "32", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['ed6dfd54b01ebe31b7a65b88abfa7297', '16efcf0e00504ddfedde13bfea997952', 'de364c46b0dfc283b5e38c79ceae3f8f']", "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "32", "ves.io.schema.rules.repeated.max_items": "16", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 16, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "excluded_values": { "type": "array", "description": "A list of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one\nor more known TLS fingerprint classes in the enclosing matcher.", "title": "excluded values", "maxItems": 32, "items": { "type": "string" }, "x-displayname": "Excluded Values.", "x-ves-example": "['fb00055a1196aeea8d1bc609885ba953', 'b386946a5a44d1ddcc843bc75336dfce']", "x-ves-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "32", "ves.io.schema.rules.repeated.max_items": "32", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "['fb00055a1196aeea8d1bc609885ba953', 'b386946a5a44d1ddcc843bc75336dfce']", "x-validation-rules": { "ves.io.schema.rules.repeated.items.string.len": "32", "ves.io.schema.rules.repeated.max_items": "32", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-description-short": "List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint.", "x-f5xc-description-medium": "List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one or more known TLS fingerprint classes in the enclosing matcher.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 32, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } } }, "x-f5xc-description-short": "TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint.", "x-f5xc-description-medium": "TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positive match criteria includes a list of known classes of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyTlsFingerprintMatcherType", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "policyTransformer": { "type": "string", "description": "Transformers to be applied on the part of the request before matching.\n\n- TRANSFORMER_NONE: transformer none\n\nNo transformers enabled\n- LOWER_CASE: lower case\n\nConvert string to lower case\n- UPPER_CASE: upper case\n\nConvert string to upper case\n- BASE64_DECODE: base64 decode\n\nDecode string assuming base64 encoding\n- NORMALIZE_PATH: normalize path\n\nNormalize URL path so that /a/b/../c will be transformed to /a/c\n- REMOVE_WHITESPACE: remove whitespace\n\nRemove whitespaces\n- URL_DECODE: URL decode\n\nDecode string assuming URL encoding as per rfc1738\n- TRIM_LEFT: trim left\n\nRemove whitespace from the left side of the input string\n- TRIM_RIGHT: trim right\n\nRemove whitespace from the right side of the input string\n- TRIM: trim\n\nRemove whitespace from the both sides of the input string.", "title": "Transformer", "enum": [ "LOWER_CASE", "UPPER_CASE", "BASE64_DECODE", "NORMALIZE_PATH", "REMOVE_WHITESPACE", "URL_DECODE", "TRIM_LEFT", "TRIM_RIGHT", "TRIM" ], "x-displayname": "Transformer.", "x-ves-proto-enum": "ves.io.schema.policy.Transformer", "x-f5xc-description-short": "Transformers to be applied on the part of the request before matching. - TRANSFORMER_NONE: transformer none No transformers enabled - LOWER_CASE...", "x-f5xc-description-medium": "Transformers to be applied on the part of the request before matching. - TRANSFORMER_NONE: transformer none No transformers enabled - LOWER_CASE: lower case Convert string to lower case - UPPER_CASE: upper case Convert string to upper case - BASE64_DECODE: base64 decode Decode string assuming...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for policyTransformer", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"LOWER_CASE\"", "example_yaml": "LOWER_CASE\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "rate_limiterRateLimitPeriodUnit": { "type": "string", "description": "Unit for the period per which the rate limit is applied.\n\n- SECOND: Second\n\nRate limit period unit is seconds\n- MINUTE: Minute\n\nRate limit period unit is minutes\n- HOUR: Hour\n\nRate limit period unit is hours\n- DAY: Day\n\nRate limit period unit is days.", "title": "RateLimitPeriodUnit", "enum": [ "SECOND", "MINUTE", "HOUR" ], "default": "SECOND", "x-displayname": "Rate Limit Period Unit.", "x-ves-proto-enum": "ves.io.schema.rate_limiter.RateLimitPeriodUnit", "x-f5xc-description-short": "Unit for the period per which the rate limit is applied. - SECOND: Second Rate limit period unit is seconds - MINUTE: Minute Rate limit period...", "x-f5xc-description-medium": "Unit for the period per which the rate limit is applied. - SECOND: Second Rate limit period unit is seconds - MINUTE: Minute Rate limit period unit is minutes - HOUR: Hour Rate limit period unit is hours - DAY: Day Rate limit period unit is days.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for rate_limiterRateLimitPeriodUnit", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"SECOND\"", "example_yaml": "SECOND\n..." }, "x-f5xc-cli-domain": "rate_limiting", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": true }, "recommendation": { "primary": "shared", "alternatives": [], "rationale": "Rate limiters benefit from centralized management for consistent enforcement" }, "classification": { "category": "security", "multi_tenant_pattern": "shared-ref" } } }, "schemaEmpty": { "type": "object", "description": "This can be used for messages where no values are needed.", "title": "Empty", "x-displayname": "Empty", "x-ves-proto-message": "ves.io.schema.Empty", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaEmpty", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "{}", "example_yaml": "{}" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemaHttpMethod": { "type": "string", "description": "Specifies the HTTP method used to access a resource.\n\nAny HTTP Method.", "title": "HttpMethod", "enum": [ "ANY", "GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH", "COPY" ], "default": "ANY", "x-displayname": "HTTP Method.", "x-ves-proto-enum": "ves.io.schema.HttpMethod", "x-f5xc-description-short": "Specifies the HTTP method used to access a resource. Any HTTP Method.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaHttpMethod", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"ANY\"", "example_yaml": "ANY\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemaLabelSelectorType": { "type": "object", "description": "This type can be used to establish a 'selector reference' from one object(called selector) to\na set of other objects(called selectees) based on the value of expressions.\nA label selector is a label query over a set of resources. An empty label selector matches all objects.\nA null label selector matches no objects. Label selector is immutable.\nExpressions is a list of strings of label selection expression.\nEach string has \",\" separated values which are \"AND\" and all strings are logically \"OR\".\nBNF for expression string\n ::= | \",\" \n ::= [!] KEY [ | ]\n ::= \"\" | \n ::= | \n ::= \"notin\"\n ::= \"in\"\n ::= \"(\" \")\"\n ::= VALUE | VALUE \",\" \n ::= [\"=\"|\"==\"|\"!=\"] VALUE.", "title": "LabelSelectorType", "x-displayname": "Label Selector.", "x-ves-proto-message": "ves.io.schema.LabelSelectorType", "properties": { "expressions": { "type": "array", "description": "Expressions contains the Kubernetes style label expression for selections.", "title": "expressions", "maxItems": 1, "items": { "type": "string", "minLength": 1, "maxLength": 4096 }, "x-displayname": "Selector Expression.", "x-ves-example": "Region in (us-west1, us-west2),tier in (staging)", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.string.k8s_label_selector": "true", "ves.io.schema.rules.repeated.items.string.max_len": "4096", "ves.io.schema.rules.repeated.items.string.min_len": "1", "ves.io.schema.rules.repeated.max_items": "1" }, "x-f5xc-example": "region in (us-west1, us-west2),tier in (staging)", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.items.string.k8s_label_selector": "true", "ves.io.schema.rules.repeated.items.string.max_len": "4096", "ves.io.schema.rules.repeated.items.string.min_len": "1", "ves.io.schema.rules.repeated.max_items": "1" }, "x-f5xc-description-short": "Expressions contains the Kubernetes style label expression for selections.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 1, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-description-short": "Type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the...", "x-f5xc-description-medium": "Type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaLabelSelectorType", "required_fields": [ "expressions" ], "mutually_exclusive_groups": [], "example_json": "{\n \"expressions\": [\n \"value\"\n ]\n}", "example_yaml": "expressions:\n- value" }, "x-f5xc-cli-domain": "label", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "system" ], "enforced": false }, "recommendation": { "primary": "system", "alternatives": [], "rationale": "Label management is platform-level" }, "classification": { "category": "infrastructure", "multi_tenant_pattern": "none" } } }, "schemaMessageMetaType": { "type": "object", "description": "MessageMetaType is metadata (common attributes) of a message that only certain messages\nhave. This information is propagated to the metadata of a child object that gets created\nfrom the containing message during view processing.\nThe information in this type can be specified by user during create and replace APIs.", "title": "MessageMetaType", "x-displayname": "Message Metadata.", "x-ves-proto-message": "ves.io.schema.MessageMetaType", "properties": { "description": { "type": "string", "description": "Human readable description.", "title": "description", "maxLength": 256, "x-displayname": "Description.", "x-ves-example": "Virtual Host for Example Corp website.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-example": "Virtual Host for Example Corp website", "x-validation-rules": { "ves.io.schema.rules.string.max_len": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "minLength": 0, "characterSet": { "description": "Free text with UTF-8 support" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 21, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" }, "name": { "type": "string", "description": "This is the name of the message.\nThe value of name has to follow DNS-1035 format.", "title": "name", "minLength": 1, "x-displayname": "Name", "x-ves-example": "Example-corp-web.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.min_len": "1", "ves.io.schema.rules.string.ves_object_name": "true" }, "x-f5xc-example": "example-corp-web", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.min_len": "1", "ves.io.schema.rules.string.ves_object_name": "true" }, "x-f5xc-description-short": "Name of the message. The value of name has to follow DNS-1035 format.", "maxLength": 63, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "minLength": 1, "maxLength": 63, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" } }, "x-f5xc-description-short": "MessageMetaType is metadata (common attributes) of a message that only certain messages have.", "x-f5xc-description-medium": "MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaMessageMetaType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"example-corp-web\"\n}", "example_yaml": "name: example-corp-web" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemaOpenApiValidationProperties": { "type": "string", "description": "List of required properties to validate against the OpenAPI spec\n\nValidate that all query parameters are according to the OpenAPI specification\nValidate that all path parameters are according to the OpenAPI specification\nValidate that the content type of the request is according to the OpenAPI specification\nValidate that all cookies are according to the OpenAPI specification\nValidate that all HTTP headers are according to the OpenAPI specification\nValidate that the body is according to the OpenAPI specification\nValidate that the security schema is according to the OpenAPI specification\nValidate that the response code is according to the OpenAPI specification.", "title": "OpenApiValidationProperties", "enum": [ "PROPERTY_QUERY_PARAMETERS", "PROPERTY_PATH_PARAMETERS", "PROPERTY_CONTENT_TYPE", "PROPERTY_COOKIE_PARAMETERS", "PROPERTY_HTTP_HEADERS", "PROPERTY_HTTP_BODY", "PROPERTY_SECURITY_SCHEMA", "PROPERTY_RESPONSE_CODE" ], "default": "PROPERTY_QUERY_PARAMETERS", "x-displayname": "OpenAPI Validation Properties.", "x-ves-proto-enum": "ves.io.schema.OpenApiValidationProperties", "x-f5xc-description-short": "List of required properties to validate against the OpenAPI spec Validate that all query parameters are according to the OpenAPI specification...", "x-f5xc-description-medium": "List of required properties to validate against the OpenAPI spec Validate that all query parameters are according to the OpenAPI specification Validate that all path parameters are according to the OpenAPI specification Validate that the content type of the request is according to the OpenAPI...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaOpenApiValidationProperties", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"PROPERTY_QUERY_PARAMETERS\"", "example_yaml": "PROPERTY_QUERY_PARAMETERS\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemaSortOrder": { "type": "string", "description": "Sort algorithm\n\nSort in descending order\nSort in ascending order.", "title": "SortOrder", "enum": [ "DESCENDING", "ASCENDING" ], "default": "DESCENDING", "x-displayname": "Sort Order.", "x-ves-proto-enum": "ves.io.schema.SortOrder", "x-f5xc-description-short": "Sort algorithm Sort in descending order Sort in ascending order.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaSortOrder", "required_fields": [], "mutually_exclusive_groups": [], "example_json": "\"DESCENDING\"", "example_yaml": "DESCENDING\n..." }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemapolicyHeaderMatcherType__ves_io_schema_app_security": { "type": "object", "description": "A header matcher specifies the name of a single HTTP header and the criteria for the input request to match it. The input has a list of actual values for each\nheader name in the original HTTP request.\nA header matcher can check for one of the following:\n* Presence or absence of the header in the input\n* At least one of the values for the header in the input satisfies the MatcherType item.", "title": "HeaderMatcherType", "x-displayname": "Header Matcher.", "x-ves-displayorder": "1,6,4", "x-ves-oneof-field-match": "[\"check_not_present\",\"check_present\",\"item\"]", "x-ves-proto-message": "ves.io.schema.policy.HeaderMatcherType", "properties": { "check_not_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check not present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_present", "item" ] }, "check_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_not_present", "item" ] }, "invert_matcher": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Header Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "item": { "allOf": [ { "$ref": "#/components/schemas/policyMatcherType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "maxLength": 26, "minLength": 15, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "x-f5xc-conflicts-with": [ "check_not_present", "check_present" ] }, "name": { "type": "string", "description": "A case-insensitive HTTP header name.", "title": "name", "maxLength": 63, "x-displayname": "Header Name.", "x-ves-example": "Accept-Encoding.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.http_header_field": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-example": "Accept-Encoding", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.http_header_field": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter, may contain lowercase alphanumeric and hyphens, must end with alphanumeric", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true, "byteLength": { "max": 256 } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" } }, "x-f5xc-description-short": "Header matcher specifies the name of a single HTTP header and the criteria for the input request to match it.", "x-f5xc-description-medium": "Header matcher specifies the name of a single HTTP header and the criteria for the input request to match it. The input has a list of actual values for each header name in the original HTTP request. A header matcher can check for one of the following: * Presence or absence of the header in the...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemapolicyHeaderMatcherType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"Accept-Encoding\"\n}", "example_yaml": "name: Accept-Encoding" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemapolicyIPThreatCategoryListType": { "type": "object", "description": "List of IP threat categories.", "title": "IP Threat Category List Type", "x-displayname": "IP Threat Category List Type.", "x-ves-proto-message": "ves.io.schema.policy.IPThreatCategoryListType", "properties": { "ip_threat_categories": { "type": "array", "description": "The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions.", "title": "IP Threat Categories", "maxItems": 32, "items": { "$ref": "#/components/schemas/policyIPThreatCategory" }, "x-displayname": "List of IP Threat Categories to choose.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "32", "ves.io.schema.rules.repeated.unique": "true" }, "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.repeated.max_items": "32", "ves.io.schema.rules.repeated.unique": "true" }, "x-f5xc-example": "{\"key\": \"value\"}", "x-f5xc-description-short": "The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions.", "x-f5xc-description-medium": "The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions.", "x-f5xc-constraints": { "constraintType": "array", "category": "discovery", "maxItems": 32, "uniqueItems": true, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } } }, "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemapolicyIPThreatCategoryListType", "required_fields": [ "ip_threat_categories" ], "mutually_exclusive_groups": [], "example_json": "{\n \"ip_threat_categories\": [\n \"SPAM_SOURCES\"\n ]\n}", "example_yaml": "ip_threat_categories:\n- SPAM_SOURCES" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemapolicyQueryParameterMatcherType__ves_io_schema_app_security": { "type": "object", "description": "A query parameter matcher specifies the name of a single query parameter and the criteria for the input request to match it. The input has a list of actual\nvalues for each query parameter name in the original HTTP request.\nA query parameter matcher can check for one of the following:\n* Presence or absence of the query parameter in the input\n* At least one of the values for the query parameter in the input satisfies the MatcherType item.", "title": "QueryParameterMatcherType", "x-displayname": "Query Parameter Matcher.", "x-ves-displayorder": "1,6,4", "x-ves-oneof-field-match": "[\"check_not_present\",\"check_present\",\"item\"]", "x-ves-proto-message": "ves.io.schema.policy.QueryParameterMatcherType", "properties": { "check_not_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check not present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_present", "item" ] }, "check_present": { "allOf": [ { "$ref": "#/components/schemas/schemaEmpty" } ], "x-f5xc-description-short": "Configuration parameter for check present.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "x-f5xc-conflicts-with": [ "check_not_present", "item" ] }, "invert_matcher": { "type": "boolean", "description": "Invert the match result.", "title": "invert_matcher", "format": "boolean", "x-displayname": "Invert Query Parameter Matcher.", "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false } }, "item": { "allOf": [ { "$ref": "#/components/schemas/policyMatcherType" } ], "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "maxLength": 26, "minLength": 15, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "x-f5xc-conflicts-with": [ "check_not_present", "check_present" ] }, "key": { "type": "string", "description": "A case-sensitive HTTP query parameter name.", "title": "key", "maxLength": 256, "x-displayname": "Query Parameter Name.", "x-ves-example": "Sourceid", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-example": "sourceid", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "256" }, "x-f5xc-description-short": "Case-sensitive HTTP query parameter name.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 256, "byteLength": { "max": 256 }, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false }, "minLength": 7, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Query parameter matcher specifies the name of a single query parameter and the criteria for the input request to match it.", "x-f5xc-description-medium": "Query parameter matcher specifies the name of a single query parameter and the criteria for the input request to match it. The input has a list of actual values for each query parameter name in the original HTTP request. A query parameter matcher can check for one of the following: * Presence or...", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemapolicyQueryParameterMatcherType", "required_fields": [ "key" ], "mutually_exclusive_groups": [], "example_json": "{\n \"key\": \"sourceid\"\n}", "example_yaml": "key: sourceid" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } }, "schemaviewsObjectRefType": { "type": "object", "description": "This type establishes a direct reference from one object(the referrer) to another(the referred).\nSuch a reference is in form of tenant/namespace/name.", "title": "ObjectRefType", "x-displayname": "Object reference.", "x-ves-proto-message": "ves.io.schema.views.ObjectRefType", "properties": { "name": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen name will hold the referred object's(e.g. Route's) name.", "title": "name", "minLength": 1, "maxLength": 128, "x-displayname": "Name", "x-ves-example": "Contacts-route.", "x-ves-required": "true", "x-ves-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "128", "ves.io.schema.rules.string.min_bytes": "1" }, "x-f5xc-example": "contacts-route", "x-validation-rules": { "ves.io.schema.rules.message.required": "true", "ves.io.schema.rules.string.max_bytes": "128", "ves.io.schema.rules.string.min_bytes": "1" }, "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. Route's) name.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "minLength": 1, "maxLength": 128, "byteLength": { "max": 128, "min": 1 }, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": true, "create": true, "update": false, "read": false } }, "namespace": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen namespace will hold the referred object's(e.g. Route's) namespace.", "title": "namespace", "maxLength": 63, "x-displayname": "Namespace", "x-ves-example": "Ns1", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_bytes": "64" }, "x-f5xc-example": "ns1", "x-validation-rules": { "ves.io.schema.rules.string.max_bytes": "64" }, "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. Route's) namespace.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 63, "minLength": 1, "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$", "characterSet": { "allowed": "[a-z0-9-]", "restricted": "[^a-z0-9-]", "required": "[a-z0-9]", "description": "Lowercase letter start, alphanumeric with hyphens, alphanumeric end" }, "format": "dns-label", "formatDescription": "DNS-1035 label: must start with a lowercase letter", "validation": { "rfc": "RFC 1035", "standard": "DNS-1035 label (alpha-first)" }, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" }, "deterministic": true, "byteLength": { "max": 64 } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "minLength": 1, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00", "pattern": "^[a-z]([-a-z0-9]*[a-z0-9])?$" }, "tenant": { "type": "string", "description": "When a configuration object(e.g. Virtual_host) refers to another(e.g route)\nthen tenant will hold the referred object's(e.g. Route's) tenant.", "title": "tenant", "maxLength": 64, "x-displayname": "Tenant", "x-ves-example": "Example-corp.", "x-ves-validation-rules": { "ves.io.schema.rules.string.max_bytes": "64" }, "x-f5xc-example": "example-corp", "x-validation-rules": { "ves.io.schema.rules.string.max_bytes": "64" }, "x-f5xc-description-short": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g.", "x-f5xc-description-medium": "When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. Route's) tenant.", "x-f5xc-constraints": { "constraintType": "string", "category": "discovery", "maxLength": 64, "byteLength": { "max": 64 }, "deterministic": true, "metadata": { "source": "discovery", "confidence": 0.99, "validatedAt": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-required-for": { "minimum_config": false, "create": false, "update": false, "read": false }, "readOnly": true, "x-field-mutability": "read-only", "minLength": 12, "x-reconciled-from-discovery": true, "x-reconciled-at": "2026-09-24T11:00:01+00:00" } }, "x-f5xc-description-short": "Type establishes a direct reference from one object(the referrer) to another(the referred).", "x-f5xc-description-medium": "Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name.", "x-f5xc-minimum-configuration": { "description": "Minimum configuration for schemaviewsObjectRefType", "required_fields": [ "name" ], "mutually_exclusive_groups": [], "example_json": "{\n \"name\": \"contacts-route\"\n}", "example_yaml": "name: contacts-route" }, "x-f5xc-cli-domain": "other", "x-f5xc-namespace-profile": { "constraint": { "allowed": [ "custom", "default", "shared" ], "enforced": false }, "recommendation": { "primary": "custom", "alternatives": [], "rationale": "Standard tenant resource" }, "classification": { "category": "application", "multi_tenant_pattern": "per-tenant" } } } }, "responses": {}, "parameters": {}, "requestBodies": {} } }