Help Center/ Web Application Firewall/ API Reference/ APIs/ Managing Rules/ Batch Modifying CC Attack Protection Rules
Updated on 2026-05-12 GMT+08:00

Batch Modifying CC Attack Protection Rules

Function

This API is used to batch modify CC attack protection rules.

Calling Method

For details, see Calling APIs.

URI

POST /v1/{project_id}/waf/rule/cc/batch-update

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Definition

Project ID. To obtain it, log in to the Huawei Cloud console, click the username, choose My Credentials, and find the project ID in the Projects list.

Constraints

N/A

Range

The value contains 32 characters. Only letters and digits are supported.

Default Value

N/A

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

Definition

Obtain the enterprise project ID by calling the ListEnterpriseProject API of Enterprise Project Management Service (EPS). To obtain the resource details in all enterprise projects of a user, set this parameter to all_granted_eps.

Constraints

N/A

Range

  • 0: the default enterprise project.

  • all_granted_eps: all enterprise projects.

  • A specific enterprise project ID: Enter a maximum of 36 characters.

Default Value

0

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

Definition

User token. You can obtain it by calling the IAM API for obtaining a user token. The user token is the value of X-Subject-Token in the response header.

Constraints

N/A

Range

N/A

Default Value

N/A

Content-Type

Yes

String

Definition

Content type.

Constraints

N/A

Range

N/A

Default Value

application/json;charset=utf8

Table 4 Request body parameters

Parameter

Mandatory

Type

Description

name

No

String

Rule name.

mode

Yes

Integer

CC rule protection mode, which corresponds to the mode on the console. Currently, only the advanced CC rule protection mode can be created.

  • 0: Standard. Only the protection path of a domain name can be restricted.

  • 1: Advanced. The path, IP address, cookie, header, and params fields can all be restricted.

url

No

String

Domain name path to be protected. This parameter is mandatory when the CC attack protection rule is in standard mode (the value of mode is 0).

conditions

Yes

Array of CcCondition objects

Rate limit condition of the CC attack protection rule. This parameter is mandatory when the CC attack protection rule is in advanced mode (mode is set to 1).

action

Yes

CreateCcRuleRequestBodyAction object

Protective action to take if the number of requests reaches the upper limit.

tag_type

Yes

String

Definition

Rate limiting mode. It specifies the way to identify an individual web visitor.

Constraints

N/A

Range

  • ip: IP-based rate limiting. Website visitors are identified by their IP addresses.

  • cookie: Cookie-based rate limiting. Website visitors are identified by the key value of their cookies.

  • header: Header-based rate limiting. Website visitors are identified by their headers.

  • other: Referer-based rate limiting. Website visitors are identified by the Referer field (user-defined request source).

  • policy: rule-based rate limiting

  • domain: domain name-based rate limiting

  • url: URL rate limiting

Default Value

N/A

tag_index

No

String

User identifier. This parameter is required when the rate limiting mode is cookie- or header-based rate limiting.

  • If cookie is selected, you need to configure an attribute variable name in the cookie that can uniquely identify a web visitor based on your website requirements. This field does not support regular expressions. Only complete matches are supported. For example, if a website uses the name field in the cookie to uniquely identify a website visitor, select name.

  • If header is selected, you need to configure the HTTP header that can identify web visitors based on your website requirements.

tag_condition

No

tag_condition object

User ID. This parameter is mandatory if the rate limiting mode is set to other. Referer-based rate limiting. Website visitors are identified by the Referer field (user-defined request source).

limit_num

Yes

Integer

Rate limiting frequency. Range: 1 to 2,147,483,647 requests.

limit_period

Yes

Integer

Rate limiting period, in seconds. Range: 1 to 3,600.

unlock_num

No

Integer

Allowable frequency. The value ranges from 0 to 2,147,483,647 requests. This parameter is mandatory only when the protective action is set to dynamic_block.

lock_time

No

Integer

Block duration, in seconds. Range: 0 to 65,535. The period within which access is blocked. An error page is displayed during this period.

domain_aggregation

No

Boolean

Whether to enable domain name aggregation statistics.

region_aggregation

No

Boolean

Whether to enable global counting.

description

No

String

Rule description.

policy_rule_ids

Yes

Array of policy_rule_ids objects

Definition

Array of policy and rule IDs. It associates a protection policy with the corresponding rule set.

Constraints

N/A

Range

N/A

Default Value

N/A

Table 5 CcCondition

Parameter

Mandatory

Type

Description

category

Yes

String

Definition

Field type.

Constraints

N/A

Range

  • url

  • ip

  • ipv6

  • asn

  • params

  • cookie

  • referer

  • user-agent

  • header

  • response_code

  • response_header

  • response_body

  • request_body

  • method

  • tls_fingerprint

  • tls_ja3_fingerprint

Default Value

N/A

logic_operation

Yes

String

Condition matching logic.

  • If the field type category is url, the matching logic can be contain, not_contain, equal, not_equal, prefix, not_prefix, suffix, not_suffix, contain_any, not_contain_all, equal_any, not_equal_all, equal_any, not_equal_all, prefix_any, not_prefix_all, suffix_any, not_suffix_all, len_greater, len_less, len_equal, or len_not_equal.

  • If the field type category is ip or ipv6, the matching logic can be equal, not_equal, equal_any, or not_equal_all.

  • If the field type category is params, cookie, or header, the matching logic can be contain, not_contain, equal, not_equal, prefix, not_prefix, suffix, not_suffix, contain_any, not_contain_all, equal_any, not_equal_all, equal_any, not_equal_all, prefix_any, not_prefix_all, suffix_any, not_suffix_all, len_greater, len_less, len_equal, len_not_equal, num_greater, num_less, num_equal, num_not_equal, exist, or not_exist.

contents

No

Array of strings

Content for the matching logic in the condition list. This parameter is mandatory when the value of logic_operation does not end with any or all.

value_list_id

No

String

ID of the reference table. This parameter is mandatory when the value of logic_operation ends with any or all. Note that the reference table type must be consistent with the category type.

index

No

String

Subfield. If category is set to params, cookie, or header, this parameter is mandatory. Set this parameter based on the site requirements.

Table 6 CreateCcRuleRequestBodyAction

Parameter

Mandatory

Type

Description

category

Yes

String

Action type:

  • captcha: Verification code. WAF requires visitors to enter a correct verification code to continue their access to the requested page on your website.

  • block: WAF blocks detected attacks.

  • log: WAF only logs detected attacks.

  • dynamic_block: Requests that trigger the rule are blocked based on the allowable frequency you configure after the first rate limit period is over. Note: dynamic_block can be set only when the advanced mode is used in CC attack protection rules.

detail

No

detail object

Block page information. This parameter is mandatory when category is set to block or dynamic_block.

  • If you want to use the default block page, skip this parameter.

  • If you want to configure a custom block page, set this parameter.

Table 7 detail

Parameter

Mandatory

Type

Description

response

No

response object

Redirected page.

Table 8 response

Parameter

Mandatory

Type

Description

content_type

No

String

Definition

Content type.

Constraints

N/A

Range

  • text/html

  • text/xml

  • application/json

Default Value

N/A

content

No

String

Content of the protected page.

Table 9 tag_condition

Parameter

Mandatory

Type

Description

category

No

String

User identifier field. The value is fixed at referer.

contents

No

Array of strings

User identifier field content.

Table 10 policy_rule_ids

Parameter

Mandatory

Type

Description

policy_id

Yes

String

Definition

Policy ID, which uniquely identifies a protection policy. You can obtain the policy ID by calling the ListPolicy API for querying the list of protection policies.

Constraints

N/A

Range

N/A

Default Value

N/A

rule_ids

Yes

Array of strings

Definition

Rule ID array, including the ID of a single CC rule in the current protection policy. You can obtain the CC rule ID by calling the API for querying the list of CC protection rules (ListCcRules).

Constraints

ID of a single rule.

Range

N/A

Default Value

N/A

Response Parameters

Status code: 200

Table 11 Response body parameters

Parameter

Type

Description

policy_rule_ids

Array of policy_rule_ids objects

Definition

Policy and rule ID array. It shows the association between the protection policy and the corresponding rule IDs.

Constraints

N/A

Range

N/A

Default Value

N/A

Table 12 policy_rule_ids

Parameter

Type

Description

policy_id

String

Definition

Policy ID, which uniquely identifies a protection policy.

Constraints

N/A

Range

N/A

Default Value

N/A

rule_ids

Array of strings

Definition

Rule ID array. IDs of rules in the current protection policy are returned.

Constraints

N/A

Range

N/A

Default Value

N/A

Status code: 400

Table 13 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 14 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Status code: 401

Table 15 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 16 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Status code: 500

Table 17 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 18 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Example Requests

Batch Modifying CC Attack Protection Rules

POST https://{endpoint}/v1/{project_id}/waf/rule/cc/batch-update?enterprise_project_id=0

{
  "description" : "",
  "tag_type" : "cookie",
  "limit_num" : 10,
  "limit_period" : 60,
  "action" : {
    "category" : "dynamic_block",
    "detail" : {
      "response" : {
        "content_type" : "application/json",
        "content" : "481"
      }
    }
  },
  "mode" : 1,
  "name" : "test",
  "conditions" : [ {
    "category" : "url",
    "logic_operation" : "contain",
    "contents" : [ "/test" ],
    "index" : null
  } ],
  "unlock_num" : 1,
  "tag_index" : "test",
  "policy_rule_ids" : [ {
    "rule_ids" : [ "ed37d85a925d469bb01986d06291d15f" ],
    "policy_id" : "4a34899ab17a4811a6da57742f69135a"
  } ]
}

Example Responses

Status code: 200

Definition

OK

Constraints

N/A

Range

N/A

Default Value

N/A

{
  "policy_rule_ids" : [ {
    "rule_ids" : [ "ed37d85a925d469bb01986d06291d15f" ],
    "policy_id" : "4a34899ab17a4811a6da57742f69135a"
  } ]
}

SDK Sample Code

The SDK sample code is as follows.

Batch Modifying CC Attack Protection Rules

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.waf.v1.region.WafRegion;
import com.huaweicloud.sdk.waf.v1.*;
import com.huaweicloud.sdk.waf.v1.model.*;

import java.util.List;
import java.util.ArrayList;

public class BatchUpdateCcRulesSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        WafClient client = WafClient.newBuilder()
                .withCredential(auth)
                .withRegion(WafRegion.valueOf("<YOUR REGION>"))
                .build();
        BatchUpdateCcRulesRequest request = new BatchUpdateCcRulesRequest();
        BatchUpdateCcRulesRequestBody body = new BatchUpdateCcRulesRequestBody();
        List<String> listPolicyRuleIdsRuleIds = new ArrayList<>();
        listPolicyRuleIdsRuleIds.add("ed37d85a925d469bb01986d06291d15f");
        List<BatchUpdateCcRulesRequestBodyPolicyRuleIds> listbodyPolicyRuleIds = new ArrayList<>();
        listbodyPolicyRuleIds.add(
            new BatchUpdateCcRulesRequestBodyPolicyRuleIds()
                .withPolicyId("4a34899ab17a4811a6da57742f69135a")
                .withRuleIds(listPolicyRuleIdsRuleIds)
        );
        CreateCcRuleRequestBodyActionDetailResponse responseDetail = new CreateCcRuleRequestBodyActionDetailResponse();
        responseDetail.withContentType(CreateCcRuleRequestBodyActionDetailResponse.ContentTypeEnum.fromValue("application/json"))
            .withContent("481");
        CreateCcRuleRequestBodyActionDetail detailAction = new CreateCcRuleRequestBodyActionDetail();
        detailAction.withResponse(responseDetail);
        CreateCcRuleRequestBodyAction actionbody = new CreateCcRuleRequestBodyAction();
        actionbody.withCategory(CreateCcRuleRequestBodyAction.CategoryEnum.fromValue("dynamic_block"))
            .withDetail(detailAction);
        List<String> listConditionsContents = new ArrayList<>();
        listConditionsContents.add("/test");
        List<CcCondition> listbodyConditions = new ArrayList<>();
        listbodyConditions.add(
            new CcCondition()
                .withCategory(CcCondition.CategoryEnum.fromValue("url"))
                .withLogicOperation("contain")
                .withContents(listConditionsContents)
        );
        body.withPolicyRuleIds(listbodyPolicyRuleIds);
        body.withDescription("");
        body.withUnlockNum(1);
        body.withLimitPeriod(60);
        body.withLimitNum(10);
        body.withTagIndex("test");
        body.withTagType(BatchUpdateCcRulesRequestBody.TagTypeEnum.fromValue("cookie"));
        body.withAction(actionbody);
        body.withConditions(listbodyConditions);
        body.withMode(1);
        body.withName("test");
        request.withBody(body);
        try {
            BatchUpdateCcRulesResponse response = client.batchUpdateCcRules(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

Batch Modifying CC Attack Protection Rules

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkwaf.v1.region.waf_region import WafRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkwaf.v1 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = WafClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(WafRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = BatchUpdateCcRulesRequest()
        listRuleIdsPolicyRuleIds = [
            "ed37d85a925d469bb01986d06291d15f"
        ]
        listPolicyRuleIdsbody = [
            BatchUpdateCcRulesRequestBodyPolicyRuleIds(
                policy_id="4a34899ab17a4811a6da57742f69135a",
                rule_ids=listRuleIdsPolicyRuleIds
            )
        ]
        responseDetail = CreateCcRuleRequestBodyActionDetailResponse(
            content_type="application/json",
            content="481"
        )
        detailAction = CreateCcRuleRequestBodyActionDetail(
            response=responseDetail
        )
        actionbody = CreateCcRuleRequestBodyAction(
            category="dynamic_block",
            detail=detailAction
        )
        listContentsConditions = [
            "/test"
        ]
        listConditionsbody = [
            CcCondition(
                category="url",
                logic_operation="contain",
                contents=listContentsConditions
            )
        ]
        request.body = BatchUpdateCcRulesRequestBody(
            policy_rule_ids=listPolicyRuleIdsbody,
            description="",
            unlock_num=1,
            limit_period=60,
            limit_num=10,
            tag_index="test",
            tag_type="cookie",
            action=actionbody,
            conditions=listConditionsbody,
            mode=1,
            name="test"
        )
        response = client.batch_update_cc_rules(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

Batch Modifying CC Attack Protection Rules

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth, err := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        SafeBuild()

    if err != nil {
        fmt.Println(err)
        return
    }

    hcClient, err := waf.WafClientBuilder().
         WithRegion(region.ValueOf("<YOUR REGION>")).
         WithCredential(auth).
         SafeBuild()


    if err != nil {
        fmt.Println(err)
        return
    }

    client := waf.NewWafClient(hcClient)

    request := &model.BatchUpdateCcRulesRequest{}
	var listRuleIdsPolicyRuleIds = []string{
        "ed37d85a925d469bb01986d06291d15f",
    }
	var listPolicyRuleIdsbody = []model.BatchUpdateCcRulesRequestBodyPolicyRuleIds{
        {
            PolicyId: "4a34899ab17a4811a6da57742f69135a",
            RuleIds: listRuleIdsPolicyRuleIds,
        },
    }
	contentTypeResponse:= model.GetCreateCcRuleRequestBodyActionDetailResponseContentTypeEnum().APPLICATION_JSON
	contentResponse:= "481"
	responseDetail := &model.CreateCcRuleRequestBodyActionDetailResponse{
		ContentType: &contentTypeResponse,
		Content: &contentResponse,
	}
	detailAction := &model.CreateCcRuleRequestBodyActionDetail{
		Response: responseDetail,
	}
	actionbody := &model.CreateCcRuleRequestBodyAction{
		Category: model.GetCreateCcRuleRequestBodyActionCategoryEnum().DYNAMIC_BLOCK,
		Detail: detailAction,
	}
	var listContentsConditions = []string{
        "/test",
    }
	var listConditionsbody = []model.CcCondition{
        {
            Category: model.GetCcConditionCategoryEnum().URL,
            LogicOperation: "contain",
            Contents: &listContentsConditions,
        },
    }
	descriptionBatchUpdateCcRulesRequestBody:= ""
	unlockNumBatchUpdateCcRulesRequestBody:= int32(1)
	tagIndexBatchUpdateCcRulesRequestBody:= "test"
	nameBatchUpdateCcRulesRequestBody:= "test"
	request.Body = &model.BatchUpdateCcRulesRequestBody{
		PolicyRuleIds: listPolicyRuleIdsbody,
		Description: &descriptionBatchUpdateCcRulesRequestBody,
		UnlockNum: &unlockNumBatchUpdateCcRulesRequestBody,
		LimitPeriod: int32(60),
		LimitNum: int32(10),
		TagIndex: &tagIndexBatchUpdateCcRulesRequestBody,
		TagType: model.GetBatchUpdateCcRulesRequestBodyTagTypeEnum().COOKIE,
		Action: actionbody,
		Conditions: listConditionsbody,
		Mode: int32(1),
		Name: &nameBatchUpdateCcRulesRequestBody,
	}
	response, err := client.BatchUpdateCcRules(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

200

Definition

OK

Constraints

N/A

Range

N/A

Default Value

N/A

400

Definition

Request failed.

Constraints

N/A

Range

N/A

Default Value

N/A

401

Definition

The token does not have required permissions.

Constraints

N/A

Range

N/A

Default Value

N/A

500

Definition

Internal server error.

Constraints

N/A

Range

N/A

Default Value

N/A

Error Codes

See Error Codes.