Get security configuration
const url = 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security';
const options = {
method: 'GET',
headers: {'API-Version': '2026-06-01.beta', 'API-Key': '<API-Key>'}
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}curl --request GET \
--url http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security \
--header 'API-Key: <API-Key>' \
--header 'API-Version: 2026-06-01.beta'Returns the current WAF, bot management, geo-blocking, rate limiting, CAPTCHA, and IP access control configuration for the cluster.
Required scope: clusters:security:read
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Header Parameters
Section titled “Header Parameters”Responses
Section titled “Responses”The request has succeeded.
Security policy configuration for this cluster.
object
object
Action taken when a security rule matches.
Detection sensitivity. Higher levels add more rules but increase false-positive rates.
Active rule categories. Required when preset is custom.
object
Protocol Enforcement (rules 920xxx, ~30–40 rules) — HTTP protocol violations and malformed requests.
Protocol Attacks (rules 921xxx, ~25–30 rules) — CRLF injection, HTTP request smuggling, and header attacks.
Local File Inclusion (rules 930xxx, ~15–20 rules) — Path traversal attacks and directory access attempts.
Remote File Inclusion (rules 931xxx, ~10–15 rules) — Remote URL inclusion and SSRF attacks.
Remote Code Execution (rules 932xxx, 60+ rules) — Command injection, shell attacks, and code execution.
PHP Injection (rules 933xxx, ~30–40 rules) — PHP function exploitation and serialization attacks.
Cross-Site Scripting (rules 941xxx, ~50–60 rules) — Script injection, event handlers, and DOM-based XSS.
SQL Injection (rules 942xxx, ~55–65 rules) — Database query manipulation and blind SQLi attacks.
Session Fixation (rules 943xxx, ~15–20 rules) — Session manipulation, JWT attacks, and cookie poisoning.
Java/JVM Attacks (rules 944xxx, ~20–30 rules) — Log4Shell, Spring4Shell, and Java deserialization.
Data Leakage Prevention (rules 950–954xxx, 50+ rules) — Credit cards, SSNs, stack traces, and error messages.
Webshell Detection (rules 955xxx, ~20–30 rules) — Backdoor scripts and malicious shell detection.
object
URL paths exempt from WAF inspection.
object
OWASP CRS rule identifiers to disable.
Restrict this exclusion to specific URL paths. Applies globally when omitted.
object
Action taken when a security rule matches.
User-agent regex patterns to always allow through.
User-agent regex patterns to always block.
object
ISO 3166-1 alpha-2 country codes. Overseas territories have their own codes, distinct from their mainland: for example GP (Guadeloupe), MQ (Martinique) and RE (Réunion) are not covered by FR, so an allowlist for France and its overseas territories must list them explicitly.
object
Global requests-per-minute ceiling across all clients.
Per-source-IP requests-per-minute ceiling.
object
URL path to apply the limit to.
Maximum requests per minute for this path.
object
Realm IDs where CAPTCHA challenges are presented during the login flow.
object
Whether IP access control is enabled. When false, no path rules are enforced.
object
URL path prefix to restrict.
Individual IP addresses (IPv4 or IPv6) to allow.
CIDR ranges to allow.
Example
{
"waf": {
"mode": "detect",
"preset": "full_crs"
},
"bot_management": {
"mode": "detect",
"challenge_mode": "none"
},
"geo_blocking": {
"mode": "allowlist"
}
}Access is unauthorized.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Access is forbidden.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}The server cannot find the requested resource.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Headers
Section titled “Headers”Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}