Updated on 2023-09-08 GMT+08:00

Updating a Protection Policy

Function

This API is used to update a policy. The request body can contain only the part to be updated.

URI

PATCH /v1/{project_id}/waf/policy/{policy_id}

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Project ID. To obtain it, go to Cloud management console and hover the cursor over your username. On the displayed window, choose My Credentials.Then, in the Projects area, view Project ID of the corresponding project.

policy_id

Yes

String

Policy ID. It can be obtained by calling the ListPolicy API.

Table 2 Query Parameters

Parameter

Mandatory

Type

Description

enterprise_project_id

No

String

You can obtain the ID by calling the ListEnterpriseProject API of EPS.

Request Parameters

Table 3 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

User token. It can be obtained by calling the IAM API (value of X-Subject-Token in the response header).

Content-Type

Yes

String

Content type.

Default: application/json;charset=utf8

Table 4 Request body parameters

Parameter

Mandatory

Type

Description

name

No

String

Array of details of policies

level

No

Integer

Protection level of basic web protection

  • 1: Low. At this protection level, WAF blocks only requests with obvious attack features. If a large number of false alarms have been reported, Low is recommended.

  • 2: Medium. This protection level meets web protection requirements in most scenarios.

  • 3: High. At this protection level, WAF provides the finest granular protection and can intercept attacks with complex bypass features, such as Jolokia cyber attacks, common gateway interface (CGI) vulnerability detection, and Druid SQL injection attacks.

Default: 2

Enumeration values:

  • 1

  • 2

  • 3

full_detection

No

Boolean

The detection mode in Precise Protection.

  • false: Instant detection. When a request hits the blocking conditions in Precise Protection, WAF terminates checks and blocks the request immediately.

  • true: Full detection. If a request hits the blocking conditions in Precise Protection, WAF does not block the request immediately. Instead, it blocks the requests until other checks are finished.

action

No

PolicyAction object

Protective action

options

No

PolicyOption object

Whether a protection type is enabled in protection policy.

hosts

No

Array of strings

Array of domain name IDs protected by the policy.

bind_host

No

Array of BindHost objects

Array of domain names protected with the protection policy. Compared with the hosts field, this field contains more details.

extend

No

Map<String,String>

Extended field, which is used to store the rule configuration of basic web protection.

Table 5 PolicyAction

Parameter

Mandatory

Type

Description

category

No

String

Basic web protection action. The value can be log or block. log: WAF only logs discovered attacks. block: WAF blocks discovered attacks.

Enumeration values:

  • block

  • log

Table 6 PolicyOption

Parameter

Mandatory

Type

Description

webattack

No

Boolean

Whether basic web protection is enabled

Enumeration values:

  • true

  • false

common

No

Boolean

Whether general check is enabled

Enumeration values:

  • true

  • false

crawler

No

Boolean

This parameter is reserved. The value of this parameter is fixed at true. You can ignore this parameter.

Enumeration values:

  • true

  • false

crawler_engine

No

Boolean

Whether the search engine is enabled

Enumeration values:

  • true

  • false

crawler_scanner

No

Boolean

Whether the anti-crawler detection is enabled

Enumeration values:

  • true

  • false

crawler_script

No

Boolean

Whether the JavaScript anti-crawler is enabled

Enumeration values:

  • true

  • false

crawler_other

No

Boolean

Whether other crawler check is enabled

Enumeration values:

  • true

  • false

webshell

No

Boolean

Whether webshell detection is enabled

Enumeration values:

  • true

  • false

cc

No

Boolean

Whether the CC attack protection rules are enabled

Enumeration values:

  • true

  • false

custom

No

Boolean

Whether precise protection is enabled

Enumeration values:

  • true

  • false

whiteblackip

No

Boolean

Whether blacklist and whitelist protection is enabled

Enumeration values:

  • true

  • false

geoip

No

Boolean

Whether geolocation access control is enabled

Enumeration values:

  • true

  • false

ignore

No

Boolean

Whether false alarm masking is enabled

Enumeration values:

  • true

  • false

privacy

No

Boolean

Whether data masking is enabled

Enumeration values:

  • true

  • false

antitamper

No

Boolean

Whether the web tamper protection is enabled

Enumeration values:

  • true

  • false

antileakage

No

Boolean

Whether the information leakage prevention is enabled

Enumeration values:

  • true

  • false

bot_enable

No

Boolean

Whether the anti-crawler protection is enabled

Enumeration values:

  • true

  • false

followed_action

No

Boolean

Whether the Known Attack Source protection is enabled.

Enumeration values:

  • true

  • false

Table 7 BindHost

Parameter

Mandatory

Type

Description

id

No

String

Domain name ID

hostname

No

String

Domain name

waf_type

No

String

Deployment mode of WAF instance that is used for the domain name. The value can be cloud for cloud WAF or premium for dedicated WAF instances.

mode

No

String

This parameter is required only by the dedicated mode.

Response Parameters

Status code: 200

Table 8 Response body parameters

Parameter

Type

Description

id

String

Policy ID

name

String

Array of details of policies

level

Integer

Protection level of basic web protection

  • 1: Low. At this protection level, WAF blocks only requests with obvious attack features. If a large number of false alarms have been reported, Low is recommended.

  • 2: Medium. This protection level meets web protection requirements in most scenarios.

  • 3: High. At this protection level, WAF provides the finest granular protection and can intercept attacks with complex bypass features, such as Jolokia cyber attacks, common gateway interface (CGI) vulnerability detection, and Druid SQL injection attacks.

Default: 2

Enumeration values:

  • 1

  • 2

  • 3

full_detection

Boolean

The detection mode in Precise Protection.

  • false: Instant detection. When a request hits the blocking conditions in Precise Protection, WAF terminates checks and blocks the request immediately.

  • true: Full detection. If a request hits the blocking conditions in Precise Protection, WAF does not block the request immediately. Instead, it blocks the requests until other checks are finished.

action

PolicyAction object

Protective action

options

PolicyOption object

Whether a protection type is enabled in protection policy.

hosts

Array of strings

Array of domain name IDs protected by the policy.

bind_host

Array of BindHost objects

Array of domain names protected with the protection policy. Compared with the hosts field, this field contains more details.

extend

Map<String,String>

Extended field, which is used to store the rule configuration of basic web protection.

timestamp

Long

Time a policy is created

Table 9 PolicyAction

Parameter

Type

Description

category

String

Basic web protection action. The value can be log or block. log: WAF only logs discovered attacks. block: WAF blocks discovered attacks.

Enumeration values:

  • block

  • log

Table 10 PolicyOption

Parameter

Type

Description

webattack

Boolean

Whether basic web protection is enabled

Enumeration values:

  • true

  • false

common

Boolean

Whether general check is enabled

Enumeration values:

  • true

  • false

crawler

Boolean

This parameter is reserved. The value of this parameter is fixed at true. You can ignore this parameter.

Enumeration values:

  • true

  • false

crawler_engine

Boolean

Whether the search engine is enabled

Enumeration values:

  • true

  • false

crawler_scanner

Boolean

Whether the anti-crawler detection is enabled

Enumeration values:

  • true

  • false

crawler_script

Boolean

Whether the JavaScript anti-crawler is enabled

Enumeration values:

  • true

  • false

crawler_other

Boolean

Whether other crawler check is enabled

Enumeration values:

  • true

  • false

webshell

Boolean

Whether webshell detection is enabled

Enumeration values:

  • true

  • false

cc

Boolean

Whether the CC attack protection rules are enabled

Enumeration values:

  • true

  • false

custom

Boolean

Whether precise protection is enabled

Enumeration values:

  • true

  • false

whiteblackip

Boolean

Whether blacklist and whitelist protection is enabled

Enumeration values:

  • true

  • false

geoip

Boolean

Whether geolocation access control is enabled

Enumeration values:

  • true

  • false

ignore

Boolean

Whether false alarm masking is enabled

Enumeration values:

  • true

  • false

privacy

Boolean

Whether data masking is enabled

Enumeration values:

  • true

  • false

antitamper

Boolean

Whether the web tamper protection is enabled

Enumeration values:

  • true

  • false

antileakage

Boolean

Whether the information leakage prevention is enabled

Enumeration values:

  • true

  • false

bot_enable

Boolean

Whether the anti-crawler protection is enabled

Enumeration values:

  • true

  • false

followed_action

Boolean

Whether the Known Attack Source protection is enabled.

Enumeration values:

  • true

  • false

Table 11 BindHost

Parameter

Type

Description

id

String

Domain name ID

hostname

String

Domain name

waf_type

String

Deployment mode of WAF instance that is used for the domain name. The value can be cloud for cloud WAF or premium for dedicated WAF instances.

mode

String

This parameter is required only by the dedicated mode.

Status code: 400

Table 12 Response body parameters

Parameter

Type

Description

error_code

String

Error code

error_msg

String

Error message

Status code: 401

Table 13 Response body parameters

Parameter

Type

Description

error_code

String

Error code

error_msg

String

Error message

Status code: 500

Table 14 Response body parameters

Parameter

Type

Description

error_code

String

Error code

error_msg

String

Error message

Example Requests

PATCH https://{Endpoint}/v1/{project_id}/waf/policy/{policy_id}?enterprise_project_id=0

{
  "options" : {
    "whiteblackip" : false
  }
}

Example Responses

Status code: 200

OK

{
  "id" : "38ff0cb9a10e4d5293c642bc0350fa6d",
  "name" : "demo",
  "level" : 2,
  "action" : {
    "category" : "log"
  },
  "options" : {
    "webattack" : true,
    "common" : true,
    "crawler" : true,
    "crawler_engine" : false,
    "crawler_scanner" : true,
    "crawler_script" : false,
    "crawler_other" : false,
    "webshell" : false,
    "cc" : true,
    "custom" : true,
    "precise" : false,
    "whiteblackip" : false,
    "geoip" : true,
    "ignore" : true,
    "privacy" : true,
    "antitamper" : true,
    "anticrawler" : false,
    "antileakage" : false,
    "followed_action" : false,
    "bot_enable" : true
  },
  "hosts" : [ "c0268b883a854adc8a2cd352193b0e13" ],
  "timestamp" : 1650529538732,
  "full_detection" : false,
  "bind_host" : [ {
    "id" : "c0268b883a854adc8a2cd352193b0e13",
    "hostname" : "www.demo.com",
    "waf_type" : "cloud"
  } ]
}

Status Codes

Status Code

Description

200

OK

400

Request failed.

401

The token does not have required permissions.

500

Internal server error.

Error Codes

See Error Codes.