Help Center/ Web Application Firewall/ API Reference/ APIs/ Policy Management/ Querying the Protection Policy List
Updated on 2025-08-19 GMT+08:00

Querying the Protection Policy List

Function

This API is used to query the protection policy list.

Calling Method

For details, see Calling APIs.

URI

GET /v1/{project_id}/waf/policy

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Definition

Project ID. To obtain it, log in to the Huawei Cloud console, click the username, choose My Credentials, and find the project ID in the Projects list.

Constraints

N/A

Range

Enter 32 characters. Only letters and digits are allowed.

Default Value

N/A

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

Definition

Obtain the enterprise project ID by calling the ListEnterpriseProject API of Enterprise Project Management Service (EPS). To obtain the resource details in all enterprise projects of a user, set this parameter to all_granted_eps.

Constraints

N/A

Range

  • 0: the default enterprise project.

  • all_granted_eps: all enterprise projects.

  • A specific enterprise project ID: Enter a maximum of 36 characters.

Default Value

0

page

No

Integer

Definition

Start position of the pagination query. This parameter specifies from which record you want to retrieve (counting starts from 1).

Constraints

N/A

Range

N/A

Default Value

1

pagesize

No

Integer

Definition

Number of results on each page in a pagination query.

Constraints

N/A

Range

The value range is 1 to 100. The default value is 10, indicating that each page contains 10 results.

Default Value

10

name

No

String

Definition

Policy name.

Constraints

N/A

Range

Enter a maximum of 64 characters. Only letters, digits, underscores (_), hyphens (-), colons (:), and periods (.) are allowed.

Default Value

10

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

Definition

User token. It can be obtained by calling the IAM API (value of X-Subject-Token in the response header).

Constraints

N/A

Range

N/A

Default Value

N/A

Content-Type

Yes

String

Definition

Content type.

Constraints

N/A

Range

N/A

Default Value

application/json;charset=utf8

Response Parameters

Status code: 200

Table 4 Response body parameters

Parameter

Type

Description

total

Integer

Total number of policies.

items

Array of PolicyResponse objects

Array of protection policy information.

Table 5 PolicyResponse

Parameter

Type

Description

id

String

Definition

Protection policy ID.

Range

N/A

name

String

Definition

Protection policy name.

Range

Enter a maximum of 64 characters. Only letters, digits, underscores (_), hyphens (-), colons (:), and periods (.) are allowed.

level

Integer

Definition

Basic web protection level.

Range

  • 1: Low. At this level, only requests with obvious attack characteristics are blocked. If a large number of false alarms are reported, this level is recommended.

  • 2: Medium. This is the default level, which meets web protection requirements in most scenarios.

  • 3: Strict. At this level, WAF provides the finest granular protection and can intercept attacks with complex bypass features, such as Jolokia cyber attacks, common gateway interface (CGI) vulnerability detection, and Druid SQL injection attacks.

full_detection

Boolean

Definition

Detection mode in the precise protection rule.

Range

  • false: Instant detection. If a request matches a configured precise protection rule, WAF immediately ends threat detection and blocks the request.

  • true: Full detection. If a request matches a configured precise protection rule, WAF does not block the request immediately. Instead, WAF continues to detect other threats and then blocks the request.

robot_action

Action object

Protective actions for each rule in anti-crawler protection.

action

PolicyAction object

Protective action

options

PolicyOption object

Whether a protection type is enabled in protection policy.

modulex_options

Map<String,Object>

Definition

Configurations of intelligent access control protection items. Currently, this feature is still in the open beta test (OBT) phase and available only in certain sites.

Range

N/A

hosts

Array of strings

Definition

ID array of protected domain names bound to a protection policy.

Range

N/A

bind_host

Array of BindHost objects

Array of domain names protected with the protection policy. Compared with the hosts field, this field contains more details.

extend

Map<String,String>

Definition

Extended field, which is used to store the switch configuration of basic web protection.

Range

N/A

timestamp

Long

Definition

Time the policy was created.

Range

N/A

Table 6 Action

Parameter

Type

Description

category

String

Definition

Protective action information in feature anti-crawler

Range

  • log: Only logs are recorded.

  • block: WAF blocks attacks.

Table 7 PolicyAction

Parameter

Type

Description

category

String

Definition

Basic web protection action (log: record only; block: block)

Range

  • block

  • log

followed_action_id

String

Definition

Attack penalty rule ID.

Range

N/A

Table 8 PolicyOption

Parameter

Type

Description

webattack

Boolean

Definition

Whether basic web protection is enabled.

Range

  • true

  • false

common

Boolean

Definition

Whether general check is enabled.

Range

  • true

  • false

crawler

Boolean

Definition

Reserved parameter. The value is always true and can be ignored.

Range

  • true

  • false

crawler_engine

Boolean

Definition

Whether the search engine is enabled.

Range

  • true

  • false

crawler_scanner

Boolean

Definition

Whether the anti-crawler detection is enabled.

Range

  • true

  • false

crawler_script

Boolean

Definition

Whether the JavaScript anti-crawler is enabled.

Range

  • true

  • false

crawler_other

Boolean

Definition

Whether other crawler check is enabled.

Range

  • true

  • false

webshell

Boolean

Definition

Whether web shell detection is enabled

Range

  • true

  • false

cc

Boolean

Definition

Whether the CC attack protection rule is enabled.

Range

  • true

  • false

custom

Boolean

Definition

Whether precise protection is enabled.

Range

  • true

  • false

whiteblackip

Boolean

Definition

Whether blacklist and whitelist protection is enabled.

Range

  • true

  • false

geoip

Boolean

Definition

Whether geolocation access control is enabled.

Range

  • true

  • false

ignore

Boolean

Definition

Whether false alarm masking is enabled.

Range

  • true

  • false

privacy

Boolean

Definition

Whether data masking is enabled.

Range

  • true

  • false

antitamper

Boolean

Definition

Whether the web tamper protection is enabled.

Range

  • true

  • false

antileakage

Boolean

Definition

Whether the information leakage prevention is enabled.

Range

  • true

  • false

bot_enable

Boolean

Definition

Whether the website anti-crawler function is enabled.

Range

  • true

  • false

modulex_enabled

Boolean

Definition

Whether CC attack protection for moduleX is enabled. This feature is in the open beta test (OBT). During the OBT, only the log only mode is supported.

Range

  • true

  • false

Table 9 BindHost

Parameter

Type

Description

id

String

Definition

Domain name ID.

Constraints

N/A

Range

N/A

Default Value

N/A

hostname

String

Definition

Domain name.

Constraints

N/A

Range

N/A

Default Value

N/A

waf_type

String

Definition

Domain name mode. The value can be cloud for cloud mode or premium for dedicated mode.

Constraints

N/A

Range

  • cloud

  • premium

Default Value

N/A

mode

String

Definition

This parameter is required only by the dedicated mode.

Constraints

N/A

Range

N/A

Default Value

N/A

Status code: 400

Table 10 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 11 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Status code: 401

Table 12 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 13 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Status code: 500

Table 14 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error message.

encoded_authorization_message

String

You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs.

details

Array of IAM5ErrorDetails objects

The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs.

Table 15 IAM5ErrorDetails

Parameter

Type

Description

error_code

String

Error codes of the downstream service.

error_msg

String

Error messages of the downstream service.

Example Requests

The following example shows how to obtain the policy list in a project. The project ID is specified by project_id.

GET https://{Endpoint}/v1/{project_id}/waf/policy?enterprise_project_id=0

Example Responses

Status code: 200

Request succeeded.

{
  "total" : 1,
  "items" : [ {
    "id" : "41cba8aee2e94bcdbf57460874205494",
    "name" : "policy_2FHwFOKz",
    "level" : 2,
    "action" : {
      "category" : "log"
    },
    "options" : {
      "webattack" : true,
      "common" : true,
      "crawler" : true,
      "crawler_engine" : false,
      "crawler_scanner" : true,
      "crawler_script" : false,
      "crawler_other" : false,
      "webshell" : false,
      "cc" : true,
      "custom" : true,
      "whiteblackip" : true,
      "geoip" : true,
      "ignore" : true,
      "privacy" : true,
      "antitamper" : true,
      "antileakage" : false,
      "bot_enable" : true,
      "modulex_enabled" : false
    },
    "hosts" : [ ],
    "extend" : { },
    "timestamp" : 1650527546218,
    "full_detection" : false,
    "bind_host" : [ ]
  } ]
}

SDK Sample Code

The SDK sample code is as follows.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.waf.v1.region.WafRegion;
import com.huaweicloud.sdk.waf.v1.*;
import com.huaweicloud.sdk.waf.v1.model.*;


public class ListPolicySolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        WafClient client = WafClient.newBuilder()
                .withCredential(auth)
                .withRegion(WafRegion.valueOf("<YOUR REGION>"))
                .build();
        ListPolicyRequest request = new ListPolicyRequest();
        try {
            ListPolicyResponse response = client.listPolicy(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkwaf.v1.region.waf_region import WafRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkwaf.v1 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = WafClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(WafRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = ListPolicyRequest()
        response = client.list_policy(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        Build()

    client := waf.NewWafClient(
        waf.WafClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.ListPolicyRequest{}
	response, err := client.ListPolicy(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

200

Request succeeded.

400

Request failed.

401

The token does not have required permissions.

500

Internal server error.

Error Codes

See Error Codes.