Configuration reference

Use these conventions to read and adapt the shared resource fragments. Each guide shows the fields needed for its outcome and its required relationships; add them to the matching resource in your environment.

Resource fragments

The JavaScript Object Notation (JSON) snippets show fields under spec. Keep their object and array structure when you add them to a resource. Add routes and rules to existing lists without overwriting unrelated entries. Where the schema offers alternative response choices, select only one.

Fragment fields	Owning resource	References to replace
routes, more_option, https_auto_cert, challenges, masking rules, api_rate_limit	HTTP load balancer	<ORIGIN_POOL_NAME>, <APP_FIREWALL_NAME>, <RATE_LIMITER_NAME> and <XC_NAMESPACE>, where shown.
blocking_page	Application firewall	Attach this firewall from the load balancer using <APP_FIREWALL_NAME> and <XC_NAMESPACE>.
rules naming the client header	User identification	Name this resource wherever <USER_IDENTIFICATION_NAME> appears.
limits, user_identification	Rate limiter	Reference <USER_IDENTIFICATION_NAME> and <XC_NAMESPACE>; attach this limiter as <RATE_LIMITER_NAME>.

Reuse each placeholder consistently across the fragments in its guide. The Rate limits guide shows the complete identification → limiter → load-balancer attachment → custom-body relationship.

Response-body encoding

Encode the message as UTF-8 (8-bit Unicode Transformation Format), convert those bytes to Base64 with = padding, then prepend string:///. The prefix counts toward the field’s length limit. Examples show exact encoded values; decoded previews display markup as code without executing it.

When customizing a challenge page, keep F5’s verification script or CAPTCHA controls in place so visitors can complete it. The Error responses guide explains the measured {{request_id}} substitution and repeat-request check.

Complete configuration sources

• Load-balancer and application-firewall examples include the load-balancer, firewall, rate-limiter and user-identification resources.
• Inactive Bot Defense examples show the block and redirect alternatives.
• Provider requirements list the required provider versions.