Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/content/docs/api-shield/api-gateway.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ sidebar:

API Gateway is a package of features that will do everything for your APIs, including:

- **Security**: Protect your API from malicious traffic with [API Discovery](/api-shield/security/api-discovery/), [Schema Validation](/api-shield/security/schema-validation/), [mTLS validation](/api-shield/security/mtls/), and more.
- **Security**: Protect your API from malicious traffic with [API Discovery](/api-shield/security/api-discovery/), [Schema validation](/api-shield/security/schema-validation/), [mTLS validation](/api-shield/security/mtls/), and more.
- **Management and monitoring**: Streamline API management with [Endpoint Management](/api-shield/management-and-monitoring/) and [tools](https://blog.cloudflare.com/api-gateway/) like analytics, routing, and authentication.
- **Logging, quota management, and more**: All of Cloudflare's [established features](https://blog.cloudflare.com/api-gateway/), like caching, load balancing, and log integrations work natively with API Gateway.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ Not currently.

## What version of OpenAPI specification do you support?

The importing ([Schema Validation](/api-shield/security/schema-validation/)) and exporting ([Schema Learning](/api-shield/management-and-monitoring/#endpoint-schema-learning)) of OpenAPI schemas from our product to customers is done using **OpenAPI v3.0**. Any specifications using patched versions (3.0.x) are compatible as well.
The importing ([Schema validation](/api-shield/security/schema-validation/)) and exporting ([Schema Learning](/api-shield/management-and-monitoring/#endpoint-schema-learning)) of OpenAPI schemas from our product to customers is done using **OpenAPI v3.0**. Any specifications using patched versions (3.0.x) are compatible as well.

---

Expand Down
20 changes: 10 additions & 10 deletions src/content/docs/api-shield/get-started.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -26,15 +26,15 @@ Enabling API Shield features will have no impact on your traffic until you choos

<Render file="set-up-session-identifiers" />

## Upload a schema using Schema Validation (optional)
## Upload a schema using Schema validation (optional)

Schema Validation protects your APIs by ensuring only requests matching your <GlossaryTooltip term="API schema">API schema</GlossaryTooltip> are allowed to communicate with your origin.
Schema validation protects your APIs by ensuring only requests matching your <GlossaryTooltip term="API schema">API schema</GlossaryTooltip> are allowed to communicate with your origin.

While not strictly required, uploading a pre-existing schema will offer the chance to automatically add endpoints to Endpoint Management. If you already have a schema, you can upload it to [Schema Validation](/api-shield/security/schema-validation/).
While not strictly required, uploading a pre-existing schema will offer the chance to automatically add endpoints to Endpoint Management. If you already have a schema, you can upload it to [Schema validation](/api-shield/security/schema-validation/).

:::note

It is recommended to start with Schema Validation rules set to `log` to review logged requests in **Security** > **Events**. When you are confident that only the correct requests are logged, you should switch the rule to `block`.
It is recommended to start with Schema validation rules set to `log` to review logged requests in **Security** > **Events**. When you are confident that only the correct requests are logged, you should switch the rule to `block`.
:::

If you do not have a schema to upload, continue reading this guide to learn how to generate a schema with API Shield.
Expand All @@ -56,10 +56,10 @@ Cloudflare’s machine learning models have already inspected your existing traf

:::note

Schema Validation, Schema Learning, JWT Validation, Sequence Analytics, Sequence Mitigation, and rate limit recommendations only run on endpoints saved to Endpoint Management.
Schema validation, Schema Learning, JWT validation, Sequence Analytics, Sequence Mitigation, and rate limit recommendations only run on endpoints saved to Endpoint Management.
:::

You can save your endpoints directly from [API Discovery](/api-shield/management-and-monitoring/#add-endpoints-from-api-discovery), [Schema Validation](/api-shield/management-and-monitoring/#add-endpoints-from-schema-validation), or [manually](/api-shield/management-and-monitoring/#add-endpoints-manually) by method, path, and host.
You can save your endpoints directly from [API Discovery](/api-shield/management-and-monitoring/#add-endpoints-from-api-discovery), [Schema validation](/api-shield/management-and-monitoring/#add-endpoints-from-schema-validation), or [manually](/api-shield/management-and-monitoring/#add-endpoints-manually) by method, path, and host.

This will add the specified endpoints to your list of managed endpoints. You can view your list of saved endpoints in the **Endpoint Management** page.

Expand All @@ -81,7 +81,7 @@ We recommend proceeding with [additional configurations](/api-shield/get-started

You can observe Cloudflare suggested rate limits in Endpoint Management for endpoints using session identifiers. Unlike many security tools, these recommended rate limits are per-endpoint and per-session, not site-wide and not based on IP address. When creating a rule, it will be based on only traffic to that specific endpoint from unique visitors during their session. This feature allows you to be very specific and targeted with your rate limit enforcement, both lowering abusive traffic and false positives due to broadly scoped rules.

## Import a learned schema to Schema Validation
## Import a learned schema to Schema validation

Cloudflare learns schema parameters via traffic inspection for all endpoints stored in Endpoint Management. You can export OpenAPI schemas in OpenAPI v3.0.0 format by hostname.

Expand All @@ -103,15 +103,15 @@ You can observe the top sequences in your API traffic that contain endpoints sto

[Sequence Mitigation](/api-shield/security/sequence-mitigation/) allows you to enforce request patterns for authenticated clients communicating with your API. Use Sequence Analytics to better understand the request sequences used by your API clients.

You should apply all possible API Shield protections (rate limiting suggestions, Schema Validation, JWT Validation, and mTLS) to API endpoints found in high correlation score sequences that make up the critical request flows in your application. You should also check their specific endpoint order with your development team.
You should apply all possible API Shield protections (rate limiting suggestions, Schema validation, JWT validation, and mTLS) to API endpoints found in high correlation score sequences that make up the critical request flows in your application. You should also check their specific endpoint order with your development team.

For more information, refer to [Detecting API abuse automatically using sequence analysis](https://blog.cloudflare.com/api-sequence-analytics) blog post.

## Additional configuration

### Set up JSON Web Tokens (JWT) Validation
### Set up JSON Web Tokens (JWT) validation

Use the Cloudflare API to configure [JSON Web Tokens Validation](/api-shield/security/jwt-validation/), which validates the integrity and validity of JWTs sent by clients to your API or web application.
Use the Cloudflare API to configure [JSON Web Tokens validation](/api-shield/security/jwt-validation/), which validates the integrity and validity of JWTs sent by clients to your API or web application.

### Set up GraphQL Malicious Query Protection

Expand Down
2 changes: 1 addition & 1 deletion src/content/docs/api-shield/index.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ A package of features that will do everything for your APIs.

Cloudflare API Security products are available to Enterprise customers only, though anyone can set up [Mutual TLS](/api-shield/security/mtls/) with a Cloudflare-managed certificate authority.

The full API Shield security suite is available as an Enterprise-only paid add-on, but all customers can access [Endpoint Management](/api-shield/management-and-monitoring/) and [Schema Validation](/api-shield/security/schema-validation/) functionalities.
The full API Shield security suite is available as an Enterprise-only paid add-on, but all customers can access [Endpoint Management](/api-shield/management-and-monitoring/) and [Schema validation](/api-shield/security/schema-validation/) functionalities.

## Related products

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ Once <GlossaryTooltip term="API endpoint">endpoints</GlossaryTooltip> are saved

If you do not have a schema to upload or to select from a pre-existing schema, export your Endpoint Management schema. For best results, include the learned parameters.

Only <GlossaryTooltip term="API schema">API schemas</GlossaryTooltip> uploaded to Schema Validation 2.0 are available when selecting existing schemas
Only <GlossaryTooltip term="API schema">API schemas</GlossaryTooltip> uploaded to Schema validation 2.0 are available when selecting existing schemas
:::

5. Select **Download project files** to save a local copy of the files that will be uploaded to Cloudflare Pages. Downloading the project files can be helpful if you wish to modify the project in any way and then upload the new version manually to Pages.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ When an endpoint is using [Cloudflare Workers](/workers/), the metrics data will

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login) and select your account and domain.
2. Select **Security** > **API Shield**.
3. Add your endpoints [manually](#add-endpoints-manually), from [Schema Validation](#add-endpoints-from-schema-validation), or from [API Discovery](#add-endpoints-from-api-discovery).
3. Add your endpoints [manually](#add-endpoints-manually), from [Schema validation](#add-endpoints-from-schema-validation), or from [API Discovery](#add-endpoints-from-api-discovery).

## Add endpoints from API Discovery

Expand All @@ -47,9 +47,9 @@ There are two ways to add API endpoints from Discovery.
2. Select the discovered endpoints you would like to add.
3. Select **Save selected endpoints**.

## Add endpoints from Schema Validation
## Add endpoints from Schema validation

1. Add a schema by [configuring Schema Validation](/api-shield/security/schema-validation/).
1. Add a schema by [configuring Schema validation](/api-shield/security/schema-validation/).
2. On **Review schema endpoints**, save new endpoints to endpoint management by checking the box.
3. Select **Save as draft** or **Save and Deploy**. Endpoints will be saved regardless of whether the Schema is saved as a draft or published.

Expand Down Expand Up @@ -106,7 +106,7 @@ You can delete endpoints one at a time or in bulk.

Cloudflare learns schema parameters via traffic inspection. For all endpoints saved to Endpoint Management, you can export OpenAPI schemas in `v3.0.0` format by hostname. You can also include learned schema parameters.

To protect your API with a learned schema, refer to [Schema Validation](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-an-entire-hostname).
To protect your API with a learned schema, refer to [Schema validation](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-an-entire-hostname).

### Export a schema

Expand Down
4 changes: 2 additions & 2 deletions src/content/docs/api-shield/plans.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ sidebar:

---

Free, Pro, Business, and Enterprise customers without an API Gateway subcription can access [Endpoint Management](/api-shield/management-and-monitoring/) and [Schema Validation](/api-shield/security/schema-validation/), but no other [API Gateway](/api-shield/api-gateway/) features.
Free, Pro, Business, and Enterprise customers without an API Gateway subscription can access [Endpoint Management](/api-shield/management-and-monitoring/) and [Schema validation](/api-shield/security/schema-validation/), but no other [API Gateway](/api-shield/api-gateway/) features.

To subscribe to API Gateway, upgrade to an Enterprise plan and contact your account team.

Limits to endpoints apply to Endpoint Management and Schema Validation. Refer to the table below for limits based on your zone plan.
Limits to endpoints apply to Endpoint Management and Schema validation. Refer to the table below for limits based on your zone plan.

| Plan type | Saved endpoints | Uploaded schemas | Total uploaded schema size | Rule action |
| --- | --- | --- | --- | --- |
Expand Down
Original file line number Diff line number Diff line change
@@ -1,56 +1,56 @@
---
title: Classic Schema Validation (deprecated)
title: Classic Schema validation (deprecated)
pcx_content_type: how-to
type: overview
head:
- tag: title
content: Configure Classic Schema Validation (deprecated)
content: Configure Classic Schema validation (deprecated)
sidebar:
badge:
text: Deprecated
order: 1
label: Classic Schema Validation
label: Classic Schema validation

---

import { GlossaryTooltip } from "~/components"

:::caution[Deprecation notice]
Classic Schema Validation has been deprecated.
Classic Schema validation has been deprecated.

Upload all new schemas to [Schema Validation 2.0](/api-shield/security/schema-validation/).
Upload all new schemas to [Schema validation 2.0](/api-shield/security/schema-validation/).
:::

Use the **API Shield** interface to configure [API Schema Validation](/api-shield/security/schema-validation/), which validates requests according to the <GlossaryTooltip term="API schema">API schema</GlossaryTooltip> you provide.
Use the **API Shield** interface to configure [API Schema validation](/api-shield/security/schema-validation/), which validates requests according to the <GlossaryTooltip term="API schema">API schema</GlossaryTooltip> you provide.

Before you can configure Schema Validation for an API, you must obtain an API Schema file matching our [specifications](/api-shield/security/schema-validation/#specifications).
Before you can configure Schema validation for an API, you must obtain an API Schema file matching our [specifications](/api-shield/security/schema-validation/#specifications).

If you are in the Schema Validation 2.0, you can make changes to your settings but you cannot add any new Classic Schema Validation schemas.
If you are in the Schema validation 2.0, you can make changes to your settings but you cannot add any new Classic Schema validation schemas.

:::note

This feature is only available for customers on an Enterprise plan. Contact your Cloudflare Customer Success Manager to get access.
:::

## Create an API Shield with Schema Validation
## Create an API Shield with Schema validation

To configure Schema Validation in the Cloudflare dashboard:
To configure Schema validation in the Cloudflare dashboard:

1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and domain.
2. Select **Security** > **API Shield**.
3. Go to **Schema Validation** and select **Add schema**.
4. Enter a descriptive name for your policy and optionally edit the expression to trigger Schema Validation. For example, if your API is available at `http://api.example.com/v1`, include a check for the *Hostname* field — equal to `api.example.com` — and a check for the *URI Path* field using a regular expression — matching the regex `^/v1`.
3. Go to **Schema validation** and select **Add schema**.
4. Enter a descriptive name for your policy and optionally edit the expression to trigger Schema validation. For example, if your API is available at `http://api.example.com/v1`, include a check for the *Hostname* field — equal to `api.example.com` — and a check for the *URI Path* field using a regular expression — matching the regex `^/v1`.
:::caution[Important]

To validate the hostname, you must include the *Hostname* field explicitly in the rule, even if the hostname value is in the schema file. Any hostname value present in the schema file will be ignored.
:::
5. Select **Next**.
6. Upload your schema file.
7. Select **Save** to validate the content of the schema file and deploy the Schema Validation rule. If you get a validation error, ensure that you are using one of the [supported file formats](/api-shield/security/schema-validation/#specifications) and that each endpoint and method pair has a unique operation ID.
7. Select **Save** to validate the content of the schema file and deploy the Schema validation rule. If you get a validation error, ensure that you are using one of the [supported file formats](/api-shield/security/schema-validation/#specifications) and that each endpoint and method pair has a unique operation ID.

After deploying your API Shield rule, Cloudflare displays a summary of all <GlossaryTooltip term="API endpoint">API endpoints</GlossaryTooltip> organized by their protection level and actions that will occur for non-compliant and unprotected requests.

1. In the **Endpoint action** dropdown, select an action for every request that targets a protected endpoint and fails Schema Validation.
1. In the **Endpoint action** dropdown, select an action for every request that targets a protected endpoint and fails Schema validation.
2. In the **Fallthrough action** dropdown, select an action for every request that targets an unprotected endpoint.
3. Optionally, you can save the endpoints to Endpoint Management at the same time the Schema is saved by selecting **Save new endpoints to [endpoint management](/api-shield/management-and-monitoring/)**. Endpoints will be saved regardless of whether the Schema is saved as a draft or published live.
4. Select **Done**.
14 changes: 7 additions & 7 deletions src/content/docs/api-shield/reference/terraform.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ The following resources are available to configure through Terraform:

- [`api_shield_operation`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_operation) for configuring <GlossaryTooltip term="API endpoint">endpoints</GlossaryTooltip> in Endpoint Management.

**Schema Validation 2.0**
**Schema validation 2.0**

- [`api_shield_schema`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_schema) for configuring a schema in [Schema Validation 2.0](/api-shield/security/schema-validation/).
- [`api_shield_schema_validation_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_schema_validation_settings) for configuring zone-level Schema Validation 2.0 settings.
- [`api_shield_operation_schema_validation_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_operation_schema_validation_settings) for configuring operation-level Schema Validation 2.0 settings.
- [`api_shield_schema`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_schema) for configuring a schema in [Schema validation 2.0](/api-shield/security/schema-validation/).
- [`api_shield_schema_validation_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_schema_validation_settings) for configuring zone-level Schema validation 2.0 settings.
- [`api_shield_operation_schema_validation_settings`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_shield_operation_schema_validation_settings) for configuring operation-level Schema validation 2.0 settings.

## Manage API Shield session identifiers

Expand Down Expand Up @@ -58,14 +58,14 @@ resource "cloudflare_api_shield_operation" "post_image" {
}
```

## Manage Schema Validation 2.0
## Manage Schema validation 2.0

:::note

It is required to configure Endpoint Management if you want to set up Schema Validation 2.0 using Terraform.
It is required to configure Endpoint Management if you want to set up Schema validation 2.0 using Terraform.
:::

Refer to the example configuration below to manage [Schema Validation 2.0](/api-shield/security/schema-validation/configure/) on your zone.
Refer to the example configuration below to manage [Schema validation 2.0](/api-shield/security/schema-validation/configure/) on your zone.

```tf title="Example configuration"
# Schema that should be used for schema validation 2.0
Expand Down
Loading