Updating a Protection Policy
Function
This API is used to update a policy. The request body can contain only the part to be updated.
Calling Method
For details, see Calling APIs.
URI
PATCH /v1/{project_id}/waf/policy/{policy_id}
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
project_id |
Yes |
String |
Project ID. To obtain it, go to Huawei Cloud management cons**. Then, in the Projects area, view Project ID of the corresponding project. |
policy_id |
Yes |
String |
Policy ID. It can be obtained by calling the ListPolicy API. |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
enterprise_project_id |
No |
String |
You can obtain the ID by calling the ListEnterpriseProject API of EPS. |
Request Parameters
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
X-Auth-Token |
Yes |
String |
User token. It can be obtained by calling the IAM API (value of X-Subject-Token in the response header). |
Content-Type |
Yes |
String |
Content type. |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
name |
No |
String |
Array of details of policies |
level |
No |
Integer |
Protection level of basic web protection
|
full_detection |
No |
Boolean |
The detection mode in Precise Protection.
|
robot_action |
No |
Action object |
Protective actions for each rule in anti-crawler protection. |
action |
No |
PolicyAction object |
Protective action |
options |
No |
PolicyOption object |
Whether a protection type is enabled in protection policy. |
modulex_options |
No |
Map<String,Object> |
Configurations about intelligent access control. Currently, this feature is still in the open beta test (OBT) phase and available at some sites. |
hosts |
No |
Array of strings |
Array of domain name IDs protected by the policy. This parameter cannot be edited and is reserved for extended functions. You can ignore it. |
bind_host |
No |
Array of BindHost objects |
Array of domain names protected with the protection policy. Compared with the hosts field, this field contains more details. This parameter cannot be edited and is reserved for extended functions. You can ignore it. |
extend |
No |
Map<String,String> |
Extended field, which is used to store the basic web protection settings.
|
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
category |
No |
String |
Protective action for feature-based anti-crawler rules:
|
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
category |
No |
String |
Basic web protection action. The value can be log or block. log: WAF only logs discovered attacks. block: WAF blocks discovered attacks. |
followed_action_id |
No |
String |
ID of the known attack source rule |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
webattack |
No |
Boolean |
Whether basic web protection is enabled |
common |
No |
Boolean |
Whether general check is enabled |
crawler |
No |
Boolean |
This parameter is reserved. The value of this parameter is fixed at true. You can ignore this parameter. |
crawler_engine |
No |
Boolean |
Whether the search engine is enabled |
crawler_scanner |
No |
Boolean |
Whether the anti-crawler detection is enabled |
crawler_script |
No |
Boolean |
Whether the JavaScript anti-crawler is enabled |
crawler_other |
No |
Boolean |
Whether other crawler check is enabled |
webshell |
No |
Boolean |
Whether webshell detection is enabled |
cc |
No |
Boolean |
Whether the CC attack protection rules are enabled |
custom |
No |
Boolean |
Whether precise protection is enabled |
whiteblackip |
No |
Boolean |
Whether blacklist and whitelist protection is enabled |
geoip |
No |
Boolean |
Whether geolocation access control is enabled |
ignore |
No |
Boolean |
Whether false alarm masking is enabled |
privacy |
No |
Boolean |
Whether data masking is enabled |
antitamper |
No |
Boolean |
Whether the web tamper protection is enabled |
antileakage |
No |
Boolean |
Whether the information leakage prevention is enabled |
bot_enable |
No |
Boolean |
Whether the anti-crawler protection is enabled |
modulex_enabled |
No |
Boolean |
Whether CC attack protection for moduleX is enabled. This feature is in the open beta test (OBT). During the OBT, only the log only mode is supported. |
Parameter |
Mandatory |
Type |
Description |
---|---|---|---|
id |
No |
String |
Domain name ID. |
hostname |
No |
String |
Domain name. |
waf_type |
No |
String |
Deployment mode of WAF instance that is used for the domain name. The value can be cloud for cloud WAF or premium for dedicated WAF instances. |
mode |
No |
String |
This parameter is required only by the dedicated mode. |
Response Parameters
Status code: 200
Parameter |
Type |
Description |
---|---|---|
id |
String |
Policy ID |
name |
String |
Array of details of policies |
level |
Integer |
Protection level of basic web protection
|
full_detection |
Boolean |
The detection mode in Precise Protection.
|
robot_action |
Action object |
Protective actions for each rule in anti-crawler protection. |
action |
PolicyAction object |
Protective action |
options |
PolicyOption object |
Whether a protection type is enabled in protection policy. |
modulex_options |
Map<String,Object> |
Configurations about intelligent access control. Currently, this feature is still in the open beta test (OBT) phase and available at some sites. |
hosts |
Array of strings |
Array of domain name IDs protected by the policy. |
bind_host |
Array of BindHost objects |
Array of domain names protected with the protection policy. Compared with the hosts field, this field contains more details. |
extend |
Map<String,String> |
Extended field, which is used to store the rule configuration of basic web protection. |
timestamp |
Long |
Time a policy is created |
Parameter |
Type |
Description |
---|---|---|
category |
String |
Protective action for feature-based anti-crawler rules:
|
Parameter |
Type |
Description |
---|---|---|
category |
String |
Basic web protection action. The value can be log or block. log: WAF only logs discovered attacks. block: WAF blocks discovered attacks. |
followed_action_id |
String |
ID of the known attack source rule |
Parameter |
Type |
Description |
---|---|---|
webattack |
Boolean |
Whether basic web protection is enabled |
common |
Boolean |
Whether general check is enabled |
crawler |
Boolean |
This parameter is reserved. The value of this parameter is fixed at true. You can ignore this parameter. |
crawler_engine |
Boolean |
Whether the search engine is enabled |
crawler_scanner |
Boolean |
Whether the anti-crawler detection is enabled |
crawler_script |
Boolean |
Whether the JavaScript anti-crawler is enabled |
crawler_other |
Boolean |
Whether other crawler check is enabled |
webshell |
Boolean |
Whether webshell detection is enabled |
cc |
Boolean |
Whether the CC attack protection rules are enabled |
custom |
Boolean |
Whether precise protection is enabled |
whiteblackip |
Boolean |
Whether blacklist and whitelist protection is enabled |
geoip |
Boolean |
Whether geolocation access control is enabled |
ignore |
Boolean |
Whether false alarm masking is enabled |
privacy |
Boolean |
Whether data masking is enabled |
antitamper |
Boolean |
Whether the web tamper protection is enabled |
antileakage |
Boolean |
Whether the information leakage prevention is enabled |
bot_enable |
Boolean |
Whether the anti-crawler protection is enabled |
modulex_enabled |
Boolean |
Whether CC attack protection for moduleX is enabled. This feature is in the open beta test (OBT). During the OBT, only the log only mode is supported. |
Parameter |
Type |
Description |
---|---|---|
id |
String |
Domain name ID. |
hostname |
String |
Domain name. |
waf_type |
String |
Deployment mode of WAF instance that is used for the domain name. The value can be cloud for cloud WAF or premium for dedicated WAF instances. |
mode |
String |
This parameter is required only by the dedicated mode. |
Status code: 400
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error code. |
error_msg |
String |
Error message. |
Status code: 401
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error code. |
error_msg |
String |
Error message. |
Status code: 500
Parameter |
Type |
Description |
---|---|---|
error_code |
String |
Error code. |
error_msg |
String |
Error message. |
Example Requests
-
The following example shows how to modify basic web protection settings, including enabling deep inspection, header inspection, and Shiro decryption check, for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
PATCH https://{Endpoint}/v1/{project_id}/waf/policy/{policy_id}?enterprise_project_id=0 { "extend" : { "extend" : "{\"deep_decode\":true,\"check_all_headers\":true,\"shiro_rememberMe_enable\":true}" } }
-
The following example shows how to disable whitelist and blacklist protection for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
PATCH https://{Endpoint}/v1/{project_id}/waf/policy/{policy_id}?enterprise_project_id=0 { "options" : { "whiteblackip" : false } }
Example Responses
Status code: 200
OK
{ "id" : "38ff0cb9a10e4d5293c642bc0350fa6d", "name" : "demo", "level" : 2, "action" : { "category" : "log" }, "options" : { "webattack" : true, "common" : true, "crawler" : true, "crawler_engine" : false, "crawler_scanner" : true, "crawler_script" : false, "crawler_other" : false, "webshell" : false, "cc" : true, "custom" : true, "whiteblackip" : false, "geoip" : true, "ignore" : true, "privacy" : true, "antitamper" : true, "antileakage" : false, "bot_enable" : true }, "hosts" : [ "c0268b883a854adc8a2cd352193b0e13" ], "timestamp" : 1650529538732, "full_detection" : false, "bind_host" : [ { "id" : "c0268b883a854adc8a2cd352193b0e13", "hostname" : "www.demo.com", "waf_type" : "cloud" } ] }
SDK Sample Code
The SDK sample code is as follows.
-
The following example shows how to modify basic web protection settings, including enabling deep inspection, header inspection, and Shiro decryption check, for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.waf.v1.region.WafRegion; import com.huaweicloud.sdk.waf.v1.*; import com.huaweicloud.sdk.waf.v1.model.*; import java.util.Map; import java.util.HashMap; public class UpdatePolicySolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); String projectId = "{project_id}"; ICredential auth = new BasicCredentials() .withProjectId(projectId) .withAk(ak) .withSk(sk); WafClient client = WafClient.newBuilder() .withCredential(auth) .withRegion(WafRegion.valueOf("<YOUR REGION>")) .build(); UpdatePolicyRequest request = new UpdatePolicyRequest(); request.withPolicyId("{policy_id}"); UpdatePolicyRequestBody body = new UpdatePolicyRequestBody(); Map<String, String> listbodyExtend = new HashMap<>(); listbodyExtend.put("extend", "{"deep_decode":true,"check_all_headers":true,"shiro_rememberMe_enable":true}"); body.withExtend(listbodyExtend); request.withBody(body); try { UpdatePolicyResponse response = client.updatePolicy(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } }
-
The following example shows how to disable whitelist and blacklist protection for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.waf.v1.region.WafRegion; import com.huaweicloud.sdk.waf.v1.*; import com.huaweicloud.sdk.waf.v1.model.*; public class UpdatePolicySolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); String projectId = "{project_id}"; ICredential auth = new BasicCredentials() .withProjectId(projectId) .withAk(ak) .withSk(sk); WafClient client = WafClient.newBuilder() .withCredential(auth) .withRegion(WafRegion.valueOf("<YOUR REGION>")) .build(); UpdatePolicyRequest request = new UpdatePolicyRequest(); request.withPolicyId("{policy_id}"); UpdatePolicyRequestBody body = new UpdatePolicyRequestBody(); PolicyOption optionsbody = new PolicyOption(); optionsbody.withWhiteblackip(false); body.withOptions(optionsbody); request.withBody(body); try { UpdatePolicyResponse response = client.updatePolicy(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } }
-
The following example shows how to modify basic web protection settings, including enabling deep inspection, header inspection, and Shiro decryption check, for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkwaf.v1.region.waf_region import WafRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkwaf.v1 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] projectId = "{project_id}" credentials = BasicCredentials(ak, sk, projectId) client = WafClient.new_builder() \ .with_credentials(credentials) \ .with_region(WafRegion.value_of("<YOUR REGION>")) \ .build() try: request = UpdatePolicyRequest() request.policy_id = "{policy_id}" listExtendbody = { "extend": "{"deep_decode":true,"check_all_headers":true,"shiro_rememberMe_enable":true}" } request.body = UpdatePolicyRequestBody( extend=listExtendbody ) response = client.update_policy(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg)
-
The following example shows how to disable whitelist and blacklist protection for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkwaf.v1.region.waf_region import WafRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkwaf.v1 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] projectId = "{project_id}" credentials = BasicCredentials(ak, sk, projectId) client = WafClient.new_builder() \ .with_credentials(credentials) \ .with_region(WafRegion.value_of("<YOUR REGION>")) \ .build() try: request = UpdatePolicyRequest() request.policy_id = "{policy_id}" optionsbody = PolicyOption( whiteblackip=False ) request.body = UpdatePolicyRequestBody( options=optionsbody ) response = client.update_policy(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg)
-
The following example shows how to modify basic web protection settings, including enabling deep inspection, header inspection, and Shiro decryption check, for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") projectId := "{project_id}" auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). WithProjectId(projectId). Build() client := waf.NewWafClient( waf.WafClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.UpdatePolicyRequest{} request.PolicyId = "{policy_id}" var listExtendbody = map[string]string{ "extend": "{"deep_decode":true,"check_all_headers":true,"shiro_rememberMe_enable":true}", } request.Body = &model.UpdatePolicyRequestBody{ Extend: listExtendbody, } response, err := client.UpdatePolicy(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } }
-
The following example shows how to disable whitelist and blacklist protection for a specific policy in a project. The project is specified by project_id, and the policy is specified by policy_id.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") projectId := "{project_id}" auth := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). WithProjectId(projectId). Build() client := waf.NewWafClient( waf.WafClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.UpdatePolicyRequest{} request.PolicyId = "{policy_id}" whiteblackipOptions:= false optionsbody := &model.PolicyOption{ Whiteblackip: &whiteblackipOptions, } request.Body = &model.UpdatePolicyRequestBody{ Options: optionsbody, } response, err := client.UpdatePolicy(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } }
For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.
Status Codes
Status Code |
Description |
---|---|
200 |
OK |
400 |
Request failed. |
401 |
The token does not have required permissions. |
500 |
Internal server error. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot