Update security configuration
const url = 'http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security';
const options = {
method: 'PATCH',
headers: {
'API-Version': '2026-06-01.beta',
'API-Key': '<API-Key>',
'Content-Type': 'application/json'
},
body: '{"waf":{"enabled":true,"mode":"detect","paranoia_level":1,"preset":"full_crs","enabled_categories":{"protocol_enforcement":true,"protocol_attacks":true,"local_file_inclusion":true,"remote_file_inclusion":true,"remote_code_execution":true,"php_injection":true,"cross_site_scripting":true,"sql_injection":true,"session_fixation":true,"java_attacks":true,"data_leakage":true,"webshell_detection":true},"exclusions":{"paths":["example"],"rules":[{"rule_ids":["example"],"paths":["example"]}]}},"bot_management":{"enabled":true,"mode":"detect","challenge_mode":"none","whitelisted_agents":["example"],"blacklisted_agents":["example"]},"geo_blocking":{"enabled":true,"mode":"allowlist","countries":["example"]},"rate_limiting":{"enabled":true,"global_rpm":1,"per_ip_rpm":1,"endpoint_limits":[{"path":"example","rpm":1}]},"captcha":{"enabled":true,"enabled_realms":["example"]},"ip_access_control":{"enabled":true,"path_rules":[{"path":"example","allowed_ips":["example"],"allowed_cidrs":["example"],"description":"example"}]}}'
};
try {
const response = await fetch(url, options);
const data = await response.json();
console.log(data);
} catch (error) {
console.error(error);
}curl --request PATCH \
--url http://localhost:8000/clusters/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/security \
--header 'API-Key: <API-Key>' \
--header 'API-Version: 2026-06-01.beta' \
--header 'Content-Type: application/json' \
--data '{ "waf": { "enabled": true, "mode": "detect", "paranoia_level": 1, "preset": "full_crs", "enabled_categories": { "protocol_enforcement": true, "protocol_attacks": true, "local_file_inclusion": true, "remote_file_inclusion": true, "remote_code_execution": true, "php_injection": true, "cross_site_scripting": true, "sql_injection": true, "session_fixation": true, "java_attacks": true, "data_leakage": true, "webshell_detection": true }, "exclusions": { "paths": [ "example" ], "rules": [ { "rule_ids": [ "example" ], "paths": [ "example" ] } ] } }, "bot_management": { "enabled": true, "mode": "detect", "challenge_mode": "none", "whitelisted_agents": [ "example" ], "blacklisted_agents": [ "example" ] }, "geo_blocking": { "enabled": true, "mode": "allowlist", "countries": [ "example" ] }, "rate_limiting": { "enabled": true, "global_rpm": 1, "per_ip_rpm": 1, "endpoint_limits": [ { "path": "example", "rpm": 1 } ] }, "captcha": { "enabled": true, "enabled_realms": [ "example" ] }, "ip_access_control": { "enabled": true, "path_rules": [ { "path": "example", "allowed_ips": [ "example" ], "allowed_cidrs": [ "example" ], "description": "example" } ] } }'Partially updates the cluster security configuration. Any omitted top-level
section (e.g. waf) retains its existing value. Provided top-level sections
replace the existing configuration for that section.
Requires a Business or Enterprise plan. Returns 402 when the workspace plan does
not include security features.
Required scope: clusters:security:write
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Header Parameters
Section titled “Header Parameters”Request Bodyrequired
Section titled “Request Bodyrequired”Security policy configuration for this cluster.
object
object
Action taken when a security rule matches.
Detection sensitivity. Higher levels add more rules but increase false-positive rates.
Active rule categories. Required when preset is custom.
object
Protocol Enforcement (rules 920xxx, ~30–40 rules) — HTTP protocol violations and malformed requests.
Protocol Attacks (rules 921xxx, ~25–30 rules) — CRLF injection, HTTP request smuggling, and header attacks.
Local File Inclusion (rules 930xxx, ~15–20 rules) — Path traversal attacks and directory access attempts.
Remote File Inclusion (rules 931xxx, ~10–15 rules) — Remote URL inclusion and SSRF attacks.
Remote Code Execution (rules 932xxx, 60+ rules) — Command injection, shell attacks, and code execution.
PHP Injection (rules 933xxx, ~30–40 rules) — PHP function exploitation and serialization attacks.
Cross-Site Scripting (rules 941xxx, ~50–60 rules) — Script injection, event handlers, and DOM-based XSS.
SQL Injection (rules 942xxx, ~55–65 rules) — Database query manipulation and blind SQLi attacks.
Session Fixation (rules 943xxx, ~15–20 rules) — Session manipulation, JWT attacks, and cookie poisoning.
Java/JVM Attacks (rules 944xxx, ~20–30 rules) — Log4Shell, Spring4Shell, and Java deserialization.
Data Leakage Prevention (rules 950–954xxx, 50+ rules) — Credit cards, SSNs, stack traces, and error messages.
Webshell Detection (rules 955xxx, ~20–30 rules) — Backdoor scripts and malicious shell detection.
object
URL paths exempt from WAF inspection.
object
OWASP CRS rule identifiers to disable.
Restrict this exclusion to specific URL paths. Applies globally when omitted.
object
Action taken when a security rule matches.
User-agent regex patterns to always allow through.
User-agent regex patterns to always block.
object
ISO 3166-1 alpha-2 country codes. Overseas territories have their own codes, distinct from their mainland: for example GP (Guadeloupe), MQ (Martinique) and RE (Réunion) are not covered by FR, so an allowlist for France and its overseas territories must list them explicitly.
object
Global requests-per-minute ceiling across all clients.
Per-source-IP requests-per-minute ceiling.
object
URL path to apply the limit to.
Maximum requests per minute for this path.
object
Realm IDs where CAPTCHA challenges are presented during the login flow.
object
Whether IP access control is enabled. When false, no path rules are enforced.
object
URL path prefix to restrict.
Individual IP addresses (IPv4 or IPv6) to allow.
CIDR ranges to allow.
Responses
Section titled “Responses”The request has succeeded.
Security policy configuration for this cluster.
object
object
Action taken when a security rule matches.
Detection sensitivity. Higher levels add more rules but increase false-positive rates.
Active rule categories. Required when preset is custom.
object
Protocol Enforcement (rules 920xxx, ~30–40 rules) — HTTP protocol violations and malformed requests.
Protocol Attacks (rules 921xxx, ~25–30 rules) — CRLF injection, HTTP request smuggling, and header attacks.
Local File Inclusion (rules 930xxx, ~15–20 rules) — Path traversal attacks and directory access attempts.
Remote File Inclusion (rules 931xxx, ~10–15 rules) — Remote URL inclusion and SSRF attacks.
Remote Code Execution (rules 932xxx, 60+ rules) — Command injection, shell attacks, and code execution.
PHP Injection (rules 933xxx, ~30–40 rules) — PHP function exploitation and serialization attacks.
Cross-Site Scripting (rules 941xxx, ~50–60 rules) — Script injection, event handlers, and DOM-based XSS.
SQL Injection (rules 942xxx, ~55–65 rules) — Database query manipulation and blind SQLi attacks.
Session Fixation (rules 943xxx, ~15–20 rules) — Session manipulation, JWT attacks, and cookie poisoning.
Java/JVM Attacks (rules 944xxx, ~20–30 rules) — Log4Shell, Spring4Shell, and Java deserialization.
Data Leakage Prevention (rules 950–954xxx, 50+ rules) — Credit cards, SSNs, stack traces, and error messages.
Webshell Detection (rules 955xxx, ~20–30 rules) — Backdoor scripts and malicious shell detection.
object
URL paths exempt from WAF inspection.
object
OWASP CRS rule identifiers to disable.
Restrict this exclusion to specific URL paths. Applies globally when omitted.
object
Action taken when a security rule matches.
User-agent regex patterns to always allow through.
User-agent regex patterns to always block.
object
ISO 3166-1 alpha-2 country codes. Overseas territories have their own codes, distinct from their mainland: for example GP (Guadeloupe), MQ (Martinique) and RE (Réunion) are not covered by FR, so an allowlist for France and its overseas territories must list them explicitly.
object
Global requests-per-minute ceiling across all clients.
Per-source-IP requests-per-minute ceiling.
object
URL path to apply the limit to.
Maximum requests per minute for this path.
object
Realm IDs where CAPTCHA challenges are presented during the login flow.
object
Whether IP access control is enabled. When false, no path rules are enforced.
object
URL path prefix to restrict.
Individual IP addresses (IPv4 or IPv6) to allow.
CIDR ranges to allow.
Example
{
"waf": {
"mode": "detect",
"preset": "full_crs"
},
"bot_management": {
"mode": "detect",
"challenge_mode": "none"
},
"geo_blocking": {
"mode": "allowlist"
}
}Access is unauthorized.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
Returned when a workspace plan quota would be exceeded. required_plan indicates the minimum plan needed to complete the request.
object
Machine-readable identifier of the quota that was hit, so a client can tell
quotas apart without parsing detail. Known values include cluster_limit
(the workspace’s total cluster allowance), cluster_size_quota (the
allowance for the requested cluster size) and cluster_size (the requested
size is not offered on the plan at all). New values may be added.
How many of the resource the workspace currently has.
Maximum allowed by the current plan. 0 means the plan does not include the resource at all.
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"current_plan": "example",
"required_plan": "example",
"code": "example",
"current_usage": 1,
"current_limit": 1
}Access is forbidden.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}The server cannot find the requested resource.
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Client error
object
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com",
"errors": [
{
"field": "example",
"detail": "example",
"code": "example",
"value": "example"
}
]
}Client error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Headers
Section titled “Headers”Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}Server error
RFC 9457 Problem Details object.
object
Example generated
{
"type": "https://example.com",
"title": "example",
"status": 1,
"detail": "example",
"instance": "https://example.com"
}