Skip to content

Commit 9af54e1

Browse files
pedrosousapedrosousa
committed
Update API examples to use the same workflow (check entry point, add rule)
1 parent 7e8f447 commit 9af54e1

File tree

2 files changed

+87
-91
lines changed

2 files changed

+87
-91
lines changed

‎src/content/docs/waf/managed-rules/reference/exposed-credentials-check.mdx‎

Lines changed: 43 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -52,64 +52,38 @@ To enable the Cloudflare Exposed Credentials Check Managed Ruleset for a given z
5252

5353
This example deploys the Cloudflare Exposed Credentials Check Managed Ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed for all incoming requests.
5454

55-
1. Search for an existing [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_request_firewall_managed` phase using the [List zone rulesets](/api/operations/listZoneRulesets) operation and take note of the ruleset ID. This ruleset, if it exists, has the following properties: `"kind": "zone"` and `"phase": "http_request_firewall_managed"`.
55+
1. Invoke the [Get a zone entry point ruleset](/api/operations/getZoneEntrypointRuleset) operation to obtain the definition of the entry point ruleset for the `http_request_firewall_managed` phase. You will need the [zone ID](/fundamentals/setup/find-account-and-zone-ids/) for this task.
5656

5757
```bash
58-
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
58+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint" \
5959
--header "Authorization: Bearer <API_TOKEN>"
6060
```
6161

62-
```json output {5,9,12}
62+
```json output {4}
6363
{
64-
"result": [
65-
// ...
66-
{
67-
"id": "<RULESET_ID>",
68-
"name": "default",
69-
"description": "",
70-
"source": "firewall_managed",
71-
"kind": "zone",
72-
"version": "5",
73-
"last_updated": "2024-07-22T16:04:19.788697Z",
74-
"phase": "http_request_firewall_managed"
75-
}
76-
// ...
77-
],
64+
"result": {
65+
"description": "Zone-level phase entry point",
66+
"id": "<RULESET_ID>",
67+
"kind": "zone",
68+
"last_updated": "2024-03-16T15:40:08.202335Z",
69+
"name": "zone",
70+
"phase": "http_request_firewall_managed",
71+
"rules": [
72+
// ...
73+
],
74+
"source": "firewall_managed",
75+
"version": "10"
76+
},
7877
"success": true,
7978
"errors": [],
8079
"messages": []
8180
}
8281
```
8382

84-
2. If the entry point ruleset does not exist, create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the [Cloudflare Exposed Credentials Check Managed Ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />) for all incoming requests in the zone.
85-
86-
```bash
87-
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
88-
--header "Authorization: Bearer <API_TOKEN>" \
89-
--header "Content-Type: application/json" \
90-
--data '{
91-
"name": "My ruleset",
92-
"description": "Entry point ruleset for WAF managed rulesets",
93-
"kind": "zone",
94-
"phase": "http_request_firewall_managed",
95-
"rules": [
96-
{
97-
"action": "execute",
98-
"action_parameters": {
99-
"id": "c2e184081120413c86c3ab7e14069605"
100-
},
101-
"expression": "true",
102-
"description": "Execute the Cloudflare Exposed Credentials Check Managed Ruleset"
103-
}
104-
]
105-
}'
106-
```
107-
108-
If the entry point ruleset already exists, add a rule to this ruleset (with ID `{ruleset_id}`) using the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation. This rule executes the Cloudflare Exposed Credentials Check Managed Ruleset (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />) for all incoming requests in the zone.
83+
2. If the entry point ruleset already exists (that is, if you received a `200 OK` status code and the ruleset definition), take note of the ruleset ID in the response. Then, invoke the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation to add an `execute` rule to the existing ruleset deploying the [Cloudflare Exposed Credentials Check Managed Ruleset](/waf/managed-rules/reference/exposed-credentials-check/) (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />). By default, the rule will be added at the end of the list of rules already in the ruleset.
10984

11085
```bash
111-
curl --request PUT \
112-
"https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
86+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
11387
--header "Authorization: Bearer <API_TOKEN>" \
11488
--header "Content-Type: application/json" \
11589
--data '{
@@ -129,7 +103,7 @@ This example deploys the Cloudflare Exposed Credentials Check Managed Ruleset to
129103
"name": "Zone-level phase entry point",
130104
"description": "",
131105
"kind": "zone",
132-
"version": "3",
106+
"version": "11",
133107
"rules": [
134108
// ... any existing rules
135109
{
@@ -156,6 +130,30 @@ This example deploys the Cloudflare Exposed Credentials Check Managed Ruleset to
156130
}
157131
```
158132

133+
3. If the entry point ruleset does not exist (that is, if you received a `404 Not Found` status code in step 1), create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the [Cloudflare Exposed Credentials Check Managed Ruleset](/waf/managed-rules/reference/exposed-credentials-check/) (with ID <RuleID id="c2e184081120413c86c3ab7e14069605" />) for all incoming requests in the zone.
134+
135+
```bash
136+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
137+
--header "Authorization: Bearer <API_TOKEN>" \
138+
--header "Content-Type: application/json" \
139+
--data '{
140+
"name": "My ruleset",
141+
"description": "Entry point ruleset for WAF managed rulesets",
142+
"kind": "zone",
143+
"phase": "http_request_firewall_managed",
144+
"rules": [
145+
{
146+
"action": "execute",
147+
"action_parameters": {
148+
"id": "c2e184081120413c86c3ab7e14069605"
149+
},
150+
"expression": "true",
151+
"description": "Execute the Cloudflare Exposed Credentials Check Managed Ruleset"
152+
}
153+
]
154+
}'
155+
```
156+
159157
### Next steps
160158

161159
To configure the Exposed Credentials Check Managed Ruleset via API, create [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) using the Rulesets API. You can perform the following configurations:

‎src/content/docs/waf/managed-rules/reference/sensitive-data-detection.mdx‎

Lines changed: 44 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -48,64 +48,38 @@ To enable Cloudflare Sensitive Data Detection for a given zone using the API, cr
4848

4949
This example deploys the Cloudflare Sensitive Data Detection managed ruleset to the `http_response_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed for all incoming requests.
5050

51-
1. Search for an existing [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) for the `http_response_firewall_managed` phase using the [List zone rulesets](/api/operations/listZoneRulesets) operation and take note of the ruleset ID. This ruleset, if it exists, has the following properties: `"kind": "zone"` and `"phase": "http_response_firewall_managed"`.
51+
1. Invoke the [Get a zone entry point ruleset](/api/operations/getZoneEntrypointRuleset) operation to obtain the definition of the entry point ruleset for the `http_response_firewall_managed` phase. You will need the [zone ID](/fundamentals/setup/find-account-and-zone-ids/) for this task.
5252

5353
```bash
54-
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
54+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_response_firewall_managed/entrypoint" \
5555
--header "Authorization: Bearer <API_TOKEN>"
5656
```
5757

58-
```json output {5,9,12}
58+
```json output {4}
5959
{
60-
"result": [
61-
// ...
62-
{
63-
"id": "<RULESET_ID>",
64-
"name": "default",
65-
"description": "",
66-
"source": "firewall_managed",
67-
"kind": "zone",
68-
"version": "5",
69-
"last_updated": "2024-07-22T16:04:19.788697Z",
70-
"phase": "http_response_firewall_managed"
71-
}
72-
// ...
73-
],
60+
"result": {
61+
"description": "Zone-level phase entry point (response)",
62+
"id": "<RULESET_ID>",
63+
"kind": "zone",
64+
"last_updated": "2024-03-16T15:40:08.202335Z",
65+
"name": "zone",
66+
"phase": "http_response_firewall_managed",
67+
"rules": [
68+
// ...
69+
],
70+
"source": "firewall_managed",
71+
"version": "10"
72+
},
7473
"success": true,
7574
"errors": [],
7675
"messages": []
7776
}
7877
```
7978

80-
2. If the entry point ruleset does not exist, create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the [Cloudflare Sensitive Data Detection managed ruleset](/waf/managed-rules/reference/cloudflare-managed-ruleset/) (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
81-
82-
```bash
83-
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
84-
--header "Authorization: Bearer <API_TOKEN>" \
85-
--header "Content-Type: application/json" \
86-
--data '{
87-
"name": "My ruleset",
88-
"description": "Entry point ruleset for WAF managed rulesets (response)",
89-
"kind": "zone",
90-
"phase": "http_response_firewall_managed",
91-
"rules": [
92-
{
93-
"action": "execute",
94-
"action_parameters": {
95-
"id": "e22d83c647c64a3eae91b71b499d988e"
96-
},
97-
"expression": "true",
98-
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
99-
}
100-
]
101-
}'
102-
```
103-
104-
If the entry point ruleset already exists, add a rule to this ruleset (with ID `{ruleset_id}`) using the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation. This rule executes the Cloudflare Sensitive Data Detection managed ruleset (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
79+
2. If the entry point ruleset already exists (that is, if you received a `200 OK` status code and the ruleset definition), take note of the ruleset ID in the response. Then, invoke the [Create a zone ruleset rule](/api/operations/createZoneRulesetRule) operation to add an `execute` rule to the existing ruleset deploying the [Cloudflare Sensitive Data Detection managed ruleset](/waf/managed-rules/reference/sensitive-data-detection/) (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />). By default, the rule will be added at the end of the list of rules already in the ruleset.
10580

10681
```bash
107-
curl --request PUT \
108-
"https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
82+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/{ruleset_id}/rules" \
10983
--header "Authorization: Bearer <API_TOKEN>" \
11084
--header "Content-Type: application/json" \
11185
--data '{
@@ -122,10 +96,10 @@ This example deploys the Cloudflare Sensitive Data Detection managed ruleset to
12296
{
12397
"result": {
12498
"id": "<RULESET_ID>",
125-
"name": "Zone-level phase entry point",
99+
"name": "Zone-level phase entry point (response)",
126100
"description": "",
127101
"kind": "zone",
128-
"version": "3",
102+
"version": "11",
129103
"rules": [
130104
// ... any existing rules
131105
{
@@ -152,6 +126,30 @@ This example deploys the Cloudflare Sensitive Data Detection managed ruleset to
152126
}
153127
```
154128

129+
3. If the entry point ruleset does not exist (that is, if you received a `404 Not Found` status code in step 1), create it using the [Create a zone ruleset](/api/operations/createZoneRuleset) operation. Include a single rule in the `rules` array that executes the [Cloudflare Sensitive Data Detection managed ruleset](/waf/managed-rules/reference/sensitive-data-detection/) (with ID <RuleID id="e22d83c647c64a3eae91b71b499d988e" />) for all incoming requests in the zone.
130+
131+
```bash
132+
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets" \
133+
--header "Authorization: Bearer <API_TOKEN>" \
134+
--header "Content-Type: application/json" \
135+
--data '{
136+
"name": "My ruleset",
137+
"description": "Entry point ruleset for WAF managed rulesets (response)",
138+
"kind": "zone",
139+
"phase": "http_response_firewall_managed",
140+
"rules": [
141+
{
142+
"action": "execute",
143+
"action_parameters": {
144+
"id": "e22d83c647c64a3eae91b71b499d988e"
145+
},
146+
"expression": "true",
147+
"description": "Execute the Cloudflare Sensitive Data Detection managed ruleset"
148+
}
149+
]
150+
}'
151+
```
152+
155153
### Next steps
156154

157155
To configure Cloudflare Sensitive Data Detection using the API, create [overrides](/ruleset-engine/managed-rulesets/override-managed-ruleset/) using the Rulesets API. You can perform the following configurations:

0 commit comments

Comments
 (0)