--- title: Create firewall rules --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Firewall](https://developers.cloudflare.com/api/python/resources/firewall) [Rules](https://developers.cloudflare.com/api/python/resources/firewall/subresources/rules) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Create firewall rules Deprecated: The Firewall Rules API is deprecated in favour of using the Ruleset Engine. See https://developers.cloudflare.com/fundamentals/api/reference/deprecations/#firewall-rules-api-and-filters-api for full details. firewall.rules.create(RuleCreateParams\*\*kwargs) -> SyncSinglePage\[[FirewallRule]()] POST/zones/{zone\_id}/firewall/rules **This endpoint has been deprecated and returns 410 Gone. Please use the [Rulesets API](https://developers.cloudflare.com/ruleset-engine/) instead.** Create one or more firewall rules. ##### Security
API Token The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
##### Accepted Permissions (at least one required) `Firewall Services Write` ##### ParametersExpand Collapse zone\_id: str Defines an identifier. maxLength32 [Link to this property](<#(resource)%20firewall.rules%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20zone_id%20%3E%20(schema)>)
action: Action The action to perform when the threshold of matched traffic within the configured period is exceeded.
mode: Optional\[Literal\["simulate", "ban", "challenge", 2 more]] The action to perform. One of the following: "simulate" Link to this property "ban" Link to this property "challenge" Link to this property "js\_challenge" Link to this property "managed\_challenge" Link to this property
Link to this property
response: Optional\[ActionResponse] A custom content type and reponse to return when the threshold is exceeded. The custom response configured in this object will override the custom error for the zone. This object is optional. Notes: If you omit this object, Cloudflare will use the default HTML error page. If “mode” is “challenge”, “managed\_challenge”, or “js\_challenge”, Cloudflare will use the zone challenge pages and you should not provide the “response” object. body: Optional\[str] The response body to return. The value must conform to the configured content type. maxLength10240 Link to this property content\_type: Optional\[str] The content type of the body. Must be one of the following: text/plain, text/xml, or application/json. maxLength50 Link to this property
Link to this property timeout: Optional\[float] The time in seconds during which Cloudflare will perform the mitigation action. Must be an integer value greater than or equal to the period. Notes: If “mode” is “challenge”, “managed\_challenge”, or “js\_challenge”, Cloudflare will use the zone’s Challenge Passage time and you should not provide this value. maximum86400 minimum1 Link to this property
[Link to this property](<#(resource)%20firewall.rules%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20action%20%3E%20(schema)>)
filter: FirewallFilterParam id: Optional\[str] The unique identifier of the filter. maxLength32 minLength32 Link to this property description: Optional\[str] An informative summary of the filter. maxLength500 Link to this property expression: Optional\[str] The filter expression. For more information, refer to Expressions. Link to this property paused: Optional\[bool] When true, indicates that the filter is currently paused. Link to this property ref: Optional\[str] A short reference tag. Allows you to select related filters. maxLength50 Link to this property
[Link to this property](<#(resource)%20firewall.rules%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20filter%20%3E%20(schema)>) ##### ReturnsExpand Collapse
class FirewallRule: … id: Optional\[str] The unique identifier of the firewall rule. maxLength32 Link to this property
action: Optional\[Action] The action to apply to a matched request. The log action is only available on an Enterprise plan. One of the following: "block" Link to this property "challenge" Link to this property "js\_challenge" Link to this property "managed\_challenge" Link to this property "allow" Link to this property "log" Link to this property "bypass" Link to this property
Link to this property description: Optional\[str] An informative summary of the firewall rule. maxLength500 Link to this property
filter: Optional\[Filter] One of the following:
class FirewallFilter: … id: Optional\[str] The unique identifier of the filter. maxLength32 minLength32 Link to this property description: Optional\[str] An informative summary of the filter. maxLength500 Link to this property expression: Optional\[str] The filter expression. For more information, refer to Expressions. Link to this property paused: Optional\[bool] When true, indicates that the filter is currently paused. Link to this property ref: Optional\[str] A short reference tag. Allows you to select related filters. maxLength50 Link to this property
Link to this property
class DeletedFilter: … id: str The unique identifier of the filter. maxLength32 minLength32 Link to this property deleted: bool When true, indicates that the firewall rule was deleted. Link to this property
Link to this property
Link to this property paused: Optional\[bool] When true, indicates that the firewall rule is currently paused. Link to this property priority: Optional\[float] The priority of the rule. Optional value used to define the processing order. A lower number indicates a higher priority. If not provided, rules with a defined priority will be processed before rules without a priority. maximum2147483647 minimum0 Link to this property
products: Optional\[List\[Product]] One of the following: "zoneLockdown" Link to this property "uaBlock" Link to this property "bic" Link to this property "hot" Link to this property "securityLevel" Link to this property "rateLimit" Link to this property "waf" Link to this property
Link to this property ref: Optional\[str] A short reference tag. Allows you to select related firewall rules. maxLength50 Link to this property
[Link to this property](<#(resource)%20firewall.rules%20%3E%20(model)%20firewall_rule%20%3E%20(schema)>) ### Create firewall rules Python HTTPTypeScriptPythonGoTerraform ``` import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.firewall.rules.create( zone_id="023e105f4ecef8ad9ca31a8372d0c353", action={}, filter={}, ) page = page.result[0] print(page.id) ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "372e67954025e0ba6aaa6d586b9e0b60", "action": "block", "description": "Blocks traffic identified during investigation for MIR-31", "filter": { "id": "372e67954025e0ba6aaa6d586b9e0b61", "description": "Restrict access from these browsers on this address range.", "expression": "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.addr ne 172.16.22.155", "paused": false, "ref": "FIL-100" }, "paused": false, "priority": 50, "products": [ "waf" ], "ref": "MIR-31" } ], "success": true, "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "372e67954025e0ba6aaa6d586b9e0b60", "action": "block", "description": "Blocks traffic identified during investigation for MIR-31", "filter": { "id": "372e67954025e0ba6aaa6d586b9e0b61", "description": "Restrict access from these browsers on this address range.", "expression": "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.addr ne 172.16.22.155", "paused": false, "ref": "FIL-100" }, "paused": false, "priority": 50, "products": [ "waf" ], "ref": "MIR-31" } ], "success": true, "result_info": { "count": 1, "page": 1, "per_page": 20, "total_count": 2000 } } ```