Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar:
order: 3
---

import { Details } from "~/components";
import { Details, APIRequest } from "~/components";

A [phase entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) contains an ordered list of rules that run in that phase. A rule in an entry point ruleset can execute a different ruleset. You can have entry point rulesets for each phase at the account level and at the zone level.

Expand All @@ -22,30 +22,31 @@ Instead of relying on the automatic creation of an entry point ruleset, you can

The following example sets the rules of a phase entry point ruleset at the zone level for the `http_request_firewall_managed` phase using the [Update a zone entry point ruleset](/api/resources/rulesets/subresources/phases/methods/update/) operation.

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"rules": [
{
"action": "execute",
"action_parameters": {
"id": "<MANAGED_RULESET_ID_1>"
},
"expression": "true"
},
{
"action": "execute",
"action_parameters": {
"id": "<MANAGED_RULESET_ID_2>"
},
"expression": "true"
}
]
}'
```
<APIRequest
path="/zones/{zone_id}/rulesets/phases/{ruleset_phase}/entrypoint"
method="PUT"
parameters={{
ruleset_phase: "http_request_firewall_managed",
}}
json={{
rules: [
{
action: "execute",
action_parameters: {
id: "<MANAGED_RULESET_ID_1>",
},
expression: "true",
},
{
action: "execute",
action_parameters: {
id: "<MANAGED_RULESET_ID_2>",
},
expression: "true",
},
],
}}
/>

```json output
{
Expand Down Expand Up @@ -90,20 +91,19 @@ https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_reques

<Details header="Example: Add a single rule to a phase entry point ruleset at the zone level">

The following example adds a single rule to a phase entry point ruleset (with ID `{ruleset_id}`) at the zone level using the [Create a zone ruleset rule](/api/resources/rulesets/subresources/rules/methods/create/) operation.
The following example adds a single rule to a phase entry point ruleset (with ID `$RULESET_ID`) at the zone level using the [Create a zone ruleset rule](/api/resources/rulesets/subresources/rules/methods/create/) operation.

```bash
curl https://api.cloudflare.com/client/v4/zone/{zone_id}/rulesets/{ruleset_id}/rules \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"action": "execute",
"action_parameters": {
"id": "<MANAGED_RULESET_ID>"
},
"expression": "true"
}'
```
<APIRequest
path="/zones/{zone_id}/rulesets/{ruleset_id}/rules"
method="POST"
json={{
action: "execute",
action_parameters: {
id: "<MANAGED_RULESET_ID>",
},
expression: "true",
}}
/>

```json output
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@ sidebar:
order: 4
---

Use the [Rulesets API](/ruleset-engine/rulesets-api/) to deploy a ruleset. To deploy a ruleset, add a rule with `"action": "execute"` to a phase entry point ruleset, specifying the ruleset ID to execute as an action parameter. Use a separate rule for each ruleset you want to deploy.
import { APIRequest } from "~/components";

Use the [Rulesets API](/ruleset-engine/rulesets-api/) to deploy a ruleset. To deploy a ruleset, add a rule with `"action": "execute"` to a [phase entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset), specifying the ruleset ID to execute as an action parameter. Use a separate rule for each ruleset you want to deploy.

A rule that executes a ruleset consists of:

Expand All @@ -22,26 +24,27 @@ To apply a rule to every request in a phase at the **zone** level, set the rule

## Example

The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone_id}`) by adding a rule that executes the managed ruleset.
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of a given zone (`$ZONE_ID`) by adding a rule that executes the managed ruleset.

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"rules": [
{
"action": "execute",
"action_parameters": {
"id": "<CLOUDFLARE_MANAGED_RULESET_ID>"
},
"expression": "true",
"description": "Execute Cloudflare Managed Ruleset on my zone ruleset"
}
]
}'
```
<APIRequest
path="/zones/{zone_id}/rulesets/phases/{ruleset_phase}/entrypoint"
method="PUT"
parameters={{
ruleset_phase: "http_request_firewall_managed",
}}
json={{
rules: [
{
action: "execute",
action_parameters: {
id: "<CLOUDFLARE_MANAGED_RULESET_ID>",
},
expression: "true",
description: "Execute Cloudflare Managed Ruleset on my zone ruleset",
},
],
}}
/>

```json output
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ sidebar:
order: 2
---

import { Details } from "~/components";
import { Details, APIRequest } from "~/components";

## View available rulesets

Expand All @@ -20,10 +20,7 @@ The response to the `GET` request will include the following rulesets:
- Zone-level phase entry points, if configured, indicated by `"kind": "zone"`.
- Custom rulesets, if configured, indicated by `"kind": "custom"`.

```bash title="Request"
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets \
--header "Authorization: Bearer <API_TOKEN>"
```
<APIRequest path="/zones/{zone_id}/rulesets" method="GET" />

```json output
{
Expand Down Expand Up @@ -72,10 +69,7 @@ The response will include the following rulesets:
- Account-level phase entry points, if configured, indicated by `"kind": "root"`.
- Custom rulesets, if configured, indicated by `"kind": "custom"`.

```bash
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets \
--header "Authorization: Bearer <API_TOKEN>"
```
<APIRequest path="/accounts/{account_id}/rulesets" method="GET" />

```json output
{
Expand Down Expand Up @@ -133,10 +127,14 @@ You can view all versions of phase entry points (at the account and zone levels)

The following example lists the rules in version `2` of the `http_request_firewall_managed` phase entry point ruleset at the zone level.

```bash
curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint/versions/2 \
--header "Authorization: Bearer <API_TOKEN>"
```
<APIRequest
path="/zones/{zone_id}/rulesets/phases/{ruleset_phase}/entrypoint/versions/{ruleset_version}"
method="GET"
parameters={{
ruleset_phase: "http_request_firewall_managed",
ruleset_version: "2",
}}
/>

```json output
{
Expand Down Expand Up @@ -175,10 +173,14 @@ The following example lists the rules in version `2` of a managed ruleset (the m

Each rule in a managed ruleset can have associated tags or categories, listed in the `categories` field.

```bash
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{managed_ruleset_id}/versions/2 \
--header "Authorization: Bearer <API_TOKEN>"
```
<APIRequest
path="/accounts/{account_id}/rulesets/{ruleset_id}/versions/{ruleset_version}"
method="GET"
parameters={{
ruleset_id: "$MANAGED_RULESET_ID",
ruleset_version: "2",
}}
/>

```json output
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ sidebar:
order: 3
---

import { APIRequest } from "~/components";

To add rules to an existing custom ruleset, use the [Update an account ruleset](/api/resources/rulesets/methods/update/) operation and pass the rules in an array. Each rule has an expression and an action.

:::note[Choosing the appropriate API method]
Expand All @@ -20,32 +22,31 @@ You can use other API operations depending on the type of operation:

## Add rules

The following request adds two rules to a custom ruleset. These will be the only two rules in the ruleset.
The following request adds two rules to a custom ruleset with ID `$RULESET_ID`. These will be the only two rules in the ruleset.

The response will include the rule ID of the new rules in the `id` field.

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{custom_ruleset_id} \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"rules": [
{
"expression": "(ip.src.country eq \"GB\" or ip.src.country eq \"FR\") or cf.threat_score > 0",
"action": "challenge",
"description": "challenge GB and FR or based on IP Reputation"
},
{
"expression": "not http.request.uri.path matches \"^/api/.*$\"",
"action": "challenge",
"description": "challenge not /api"
}
]
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets/{ruleset_id}"
method="PUT"
json={{
rules: [
{
expression:
'(ip.src.country eq "GB" or ip.src.country eq "FR") or cf.threat_score > 0',
action: "challenge",
description: "challenge GB and FR or based on IP Reputation",
},
{
expression: 'not http.request.uri.path matches "^/api/.*$"',
action: "challenge",
description: "challenge not /api",
},
],
}}
/>

```json output
```json output {9,19}
{
"result": {
"id": "<CUSTOM_RULESET_ID>",
Expand Down Expand Up @@ -87,29 +88,27 @@ https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{custom_rule

To update one or more rules in a custom ruleset, use the [Update an account ruleset](/api/resources/rulesets/methods/update/) operation. Include the ID of the rules you want to modify in the rules array and add the fields you wish to update. The request replaces the entire ruleset with a new version. Therefore, you must include the ID of all the rules you wish to keep.

The following request edits one rule in a custom ruleset and updates the execution order of the rules.
The following `PUT` request edits one rule in a custom ruleset and updates the execution order of the rules.

The response will include the modified custom ruleset. Note that the updated rule and ruleset version number increment.

```bash
curl --request PUT \
https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id} \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"rules": [
{
"id": "<CUSTOM_RULE_ID_2>",
"expression": "not http.request.uri.path matches \"^/api/.*$\"",
"action": "js_challenge",
"description": "js_challenge when not /api"
},
{
"id": "<CUSTOM_RULE_ID_1>"
}
]
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets/{ruleset_id}"
method="PUT"
json={{
rules: [
{
id: "<CUSTOM_RULE_ID_2>",
expression: 'not http.request.uri.path matches "^/api/.*$"',
action: "js_challenge",
description: "js_challenge when not /api",
},
{
id: "<CUSTOM_RULE_ID_1>",
},
],
}}
/>

```json output
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ sidebar:
order: 2
---

import { APIRequest } from "~/components";

Use the [Create an account ruleset](/api/resources/rulesets/methods/create/) operation to create a custom ruleset, making sure that you:

- Set the `kind` field to `custom`.
Expand All @@ -14,19 +16,18 @@ Use the [Create an account ruleset](/api/resources/rulesets/methods/create/) ope

The following request creates a new custom ruleset. The response will include the ID of the new custom ruleset in the `id` field.

```bash
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"name": "Custom Ruleset 1",
"description": "My First Custom Ruleset",
"kind": "custom",
"phase": "http_request_firewall_custom"
}'
```
<APIRequest
path="/accounts/{account_id}/rulesets"
method="POST"
json={{
name: "Custom Ruleset 1",
description: "My First Custom Ruleset",
kind: "custom",
phase: "http_request_firewall_custom",
}}
/>

```json output
```json output {3}
{
"result": {
"id": "f82ccda3d21f4a02825d3fe45b5e1c10",
Expand Down
Loading
Loading