--- title: WAF --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Firewall](https://developers.cloudflare.com/api/typescript/resources/firewall) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # WAF #### WAFOverrides ##### [List WAF overrides](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/overrides/methods/list) Deprecated client.firewall.waf.overrides.list(OverrideListParams {zone\_id, page, per\_page } params, RequestOptionsoptions?): void GET/zones/{zone\_id}/firewall/waf/overrides ##### [Get a WAF override](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/overrides/methods/get) Deprecated client.firewall.waf.overrides.get(stringoverridesID, OverrideGetParams {zone\_id } params, RequestOptionsoptions?): void GET/zones/{zone\_id}/firewall/waf/overrides/{overrides\_id} ##### [Create a WAF override](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/overrides/methods/create) Deprecated client.firewall.waf.overrides.create(OverrideCreateParams {zone\_id, urls } params, RequestOptionsoptions?): void POST/zones/{zone\_id}/firewall/waf/overrides ##### [Update WAF override](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/overrides/methods/update) Deprecated client.firewall.waf.overrides.update(stringoverridesID, OverrideUpdateParams {zone\_id, id, rewrite\_action, 2 more } params, RequestOptionsoptions?): void PUT/zones/{zone\_id}/firewall/waf/overrides/{overrides\_id} ##### [Delete a WAF override](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/overrides/methods/delete) Deprecated client.firewall.waf.overrides.delete(stringoverridesID, OverrideDeleteParams {zone\_id } params, RequestOptionsoptions?): void DELETE/zones/{zone\_id}/firewall/waf/overrides/{overrides\_id} ##### ModelsExpand Collapse OverrideURL = string [Link to this property](<#(resource)%20firewall.waf.overrides%20%3E%20(model)%20override_url%20%3E%20(schema)>)

RewriteAction {block, challenge, default, 2 more } Specifies that, when a WAF rule matches, its configured action will be replaced by the action configured in this object.

block?: "challenge"| "block"| "simulate"| 2 more The WAF rule action to apply.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

Link to this property

challenge?: "challenge"| "block"| "simulate"| 2 more The WAF rule action to apply.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

Link to this property

default?: "challenge"| "block"| "simulate"| 2 more The WAF rule action to apply.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

Link to this property

disable?: "challenge"| "block"| "simulate"| 2 more The WAF rule action to apply.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

Link to this property

simulate?: "challenge"| "block"| "simulate"| 2 more The WAF rule action to apply.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

Link to this property

[Link to this property](<#(resource)%20firewall.waf.overrides%20%3E%20(model)%20rewrite_action%20%3E%20(schema)>)

WAFRule = Record<string, "challenge"| "block"| "simulate"| 2 more> An object that allows you to override the action of specific WAF rules. Each key of this object must be the ID of a WAF rule, and each value must be a valid WAF action. Unless you are disabling a rule, ensure that you also enable the rule group that this WAF rule belongs to. When creating a new URI-based WAF override, you must provide a groups object or a rules object.

One of the following: "challenge" Link to this property "block" Link to this property "simulate" Link to this property "disable" Link to this property "default" Link to this property

[Link to this property](<#(resource)%20firewall.waf.overrides%20%3E%20(model)%20waf_rule%20%3E%20(schema)>) #### WAFPackages ##### [List WAF packages](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/methods/list) Deprecated client.firewall.waf.packages.list(PackageListParams {zone\_id, direction, match, 4 more } params, RequestOptionsoptions?): V4PagePaginationArray< [PackageListResponse]()> GET/zones/{zone\_id}/firewall/waf/packages ##### [Get a WAF package](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/methods/get) Deprecated client.firewall.waf.packages.get(stringpackageID, PackageGetParams {zone\_id } params, RequestOptionsoptions?): [PackageGetResponse]() GET/zones/{zone\_id}/firewall/waf/packages/{package\_id} ##### ModelsExpand Collapse PackageListResponse = unknown [Link to this property](<#(resource)%20firewall.waf.packages%20%3E%20(model)%20package_list_response%20%3E%20(schema)>)

PackageGetResponse = unknown| string| null

One of the following: unknown Link to this property string| null Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages%20%3E%20(model)%20package_get_response%20%3E%20(schema)>) #### WAFPackagesGroups ##### [List WAF rule groups](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/groups/methods/list) Deprecated client.firewall.waf.packages.groups.list(stringpackageID, GroupListParams {zone\_id, direction, match, 6 more } params, RequestOptionsoptions?): V4PagePaginationArray< [Group]() {id, description, mode, 5 more } > GET/zones/{zone\_id}/firewall/waf/packages/{package\_id}/groups ##### [Get a WAF rule group](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/groups/methods/get) Deprecated client.firewall.waf.packages.groups.get(stringgroupID, GroupGetParams {zone\_id, package\_id } params, RequestOptionsoptions?): [GroupGetResponse]() GET/zones/{zone\_id}/firewall/waf/packages/{package\_id}/groups/{group\_id} ##### [Update a WAF rule group](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/groups/methods/edit) Deprecated client.firewall.waf.packages.groups.edit(stringgroupID, GroupEditParams {zone\_id, package\_id, mode } params, RequestOptionsoptions?): [GroupEditResponse]() PATCH/zones/{zone\_id}/firewall/waf/packages/{package\_id}/groups/{group\_id} ##### ModelsExpand Collapse

Group {id, description, mode, 5 more }

id: string Defines the unique identifier of the rule group. maxLength32 Link to this property description: string| null Defines an informative summary of what the rule group does. Link to this property

mode: "on"| "off" Defines the state of the rules contained in the rule group. When on, the rules in the group are configurable/usable.

One of the following: "on" Link to this property "off" Link to this property

Link to this property name: string Defines the name of the rule group. Link to this property rules\_count: number Defines the number of rules in the current rule group. Link to this property

allowed\_modes?: Array<"on"| "off"> Defines the available states for the rule group.

One of the following: "on" Link to this property "off" Link to this property

Link to this property modified\_rules\_count?: number Defines the number of rules within the group that have been modified from their default configuration. Link to this property package\_id?: string Defines the unique identifier of a WAF package. maxLength32 Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.groups%20%3E%20(model)%20group%20%3E%20(schema)>)

GroupGetResponse = unknown| string| null

One of the following: unknown Link to this property string| null Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.groups%20%3E%20(model)%20group_get_response%20%3E%20(schema)>)

GroupEditResponse = unknown| string| null

One of the following: unknown Link to this property string| null Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.groups%20%3E%20(model)%20group_edit_response%20%3E%20(schema)>) #### WAFPackagesRules ##### [List WAF rules](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/rules/methods/list) Deprecated client.firewall.waf.packages.rules.list(stringpackageID, RuleListParams {zone\_id, description, direction, 7 more } params, RequestOptionsoptions?): V4PagePaginationArray< [RuleListResponse]()> GET/zones/{zone\_id}/firewall/waf/packages/{package\_id}/rules ##### [Get a WAF rule](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/rules/methods/get) Deprecated client.firewall.waf.packages.rules.get(stringruleID, RuleGetParams {zone\_id, package\_id } params, RequestOptionsoptions?): [RuleGetResponse]() GET/zones/{zone\_id}/firewall/waf/packages/{package\_id}/rules/{rule\_id} ##### [Update a WAF rule](https://developers.cloudflare.com/api/typescript/resources/firewall/subresources/waf/subresources/packages/subresources/rules/methods/edit) Deprecated client.firewall.waf.packages.rules.edit(stringruleID, RuleEditParams {zone\_id, package\_id, mode } params, RequestOptionsoptions?): [RuleEditResponse]() PATCH/zones/{zone\_id}/firewall/waf/packages/{package\_id}/rules/{rule\_id} ##### ModelsExpand Collapse

AllowedModesAnomaly = "on"| "off" Defines the mode anomaly. When set to on, the current WAF rule will be used when evaluating the request. Applies to anomaly detection WAF rules.

One of the following: "on" Link to this property "off" Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.rules%20%3E%20(model)%20allowed_modes_anomaly%20%3E%20(schema)>)

WAFRuleGroup {id, name } Defines the rule group to which the current WAF rule belongs.

id?: string Defines the unique identifier of the rule group. maxLength32 Link to this property name?: string Defines the name of the rule group. Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.rules%20%3E%20(model)%20waf_rule_group%20%3E%20(schema)>)

RuleListResponse = WAFManagedRulesAnomalyRule {id, allowed\_modes, description, 4 more } | WAFManagedRulesTraditionalDenyRule {id, allowed\_modes, default\_mode, 5 more } | WAFManagedRulesTraditionalAllowRule {id, allowed\_modes, description, 4 more } When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

One of the following:

WAFManagedRulesAnomalyRule {id, allowed\_modes, description, 4 more } When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<AllowedModesAnomaly> Defines the available modes for the current WAF rule. Applies to anomaly detection WAF rules.

One of the following: "on" Link to this property "off" Link to this property

Link to this property description: string Defines the public description of the WAF rule. Link to this property group: WAFRuleGroup {id, name } Defines the rule group to which the current WAF rule belongs. Link to this property mode: AllowedModesAnomaly Defines the mode anomaly. When set to on, the current WAF rule will be used when evaluating the request. Applies to anomaly detection WAF rules. Link to this property package\_id: string Defines the unique identifier of a WAF package. maxLength32 Link to this property priority: string Defines the order in which the individual WAF rule is executed within its rule group. Link to this property

Link to this property

WAFManagedRulesTraditionalDenyRule {id, allowed\_modes, default\_mode, 5 more } When triggered, traditional WAF rules cause the firewall to immediately act upon the request based on the configuration of the rule. A ‘deny’ rule will immediately respond to the request based on the configured rule action/mode (for example, ‘block’) and no other rules will be processed.

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<"default"| "disable"| "simulate"| 2 more> Defines the list of possible actions of the WAF rule when it is triggered.

One of the following: "default" Link to this property "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

Link to this property

default\_mode: "disable"| "simulate"| "block"| "challenge" Defines the default action/mode of a rule.

One of the following: "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

mode: "default"| "disable"| "simulate"| 2 more Defines the action that the current WAF rule will perform when triggered. Applies to traditional (deny) WAF rules.

One of the following: "default" Link to this property "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

Link to this property package\_id: string Defines the unique identifier of a WAF package. maxLength32 Link to this property priority: string Defines the order in which the individual WAF rule is executed within its rule group. Link to this property

Link to this property

WAFManagedRulesTraditionalAllowRule {id, allowed\_modes, description, 4 more } When triggered, traditional WAF rules cause the firewall to immediately act on the request based on the rule configuration. An ‘allow’ rule will immediately allow the request and no other rules will be processed.

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<"on"| "off"> Defines the available modes for the current WAF rule.

One of the following: "on" Link to this property "off" Link to this property

mode: "on"| "off" When set to on, the current rule will be used when evaluating the request. Applies to traditional (allow) WAF rules.

One of the following: "on" Link to this property "off" Link to this property

Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.rules%20%3E%20(model)%20rule_list_response%20%3E%20(schema)>)

RuleGetResponse = unknown| string| null

One of the following: unknown Link to this property string| null Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.rules%20%3E%20(model)%20rule_get_response%20%3E%20(schema)>)

RuleEditResponse = WAFManagedRulesAnomalyRule {id, allowed\_modes, description, 4 more } | WAFManagedRulesTraditionalDenyRule {id, allowed\_modes, default\_mode, 5 more } | WAFManagedRulesTraditionalAllowRule {id, allowed\_modes, description, 4 more } When triggered, anomaly detection WAF rules contribute to an overall threat score that will determine if a request is considered malicious. You can configure the total scoring threshold through the ‘sensitivity’ property of the WAF package.

One of the following:

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<AllowedModesAnomaly> Defines the available modes for the current WAF rule. Applies to anomaly detection WAF rules.

One of the following: "on" Link to this property "off" Link to this property

Link to this property

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<"default"| "disable"| "simulate"| 2 more> Defines the list of possible actions of the WAF rule when it is triggered.

One of the following: "default" Link to this property "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

Link to this property

default\_mode: "disable"| "simulate"| "block"| "challenge" Defines the default action/mode of a rule.

One of the following: "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

mode: "default"| "disable"| "simulate"| 2 more Defines the action that the current WAF rule will perform when triggered. Applies to traditional (deny) WAF rules.

One of the following: "default" Link to this property "disable" Link to this property "simulate" Link to this property "block" Link to this property "challenge" Link to this property

Link to this property

id: string Defines the unique identifier of the WAF rule. maxLength32 Link to this property

allowed\_modes: Array<"on"| "off"> Defines the available modes for the current WAF rule.

One of the following: "on" Link to this property "off" Link to this property

mode: "on"| "off" When set to on, the current rule will be used when evaluating the request. Applies to traditional (allow) WAF rules.

One of the following: "on" Link to this property "off" Link to this property

Link to this property

[Link to this property](<#(resource)%20firewall.waf.packages.rules%20%3E%20(model)%20rule_edit_response%20%3E%20(schema)>)