Akamai API Security Client-Side Protections & Compliance API
The Client-Side Protections & Compliance API from Akamai API Security — 1 operation(s) for client-side protections & compliance.
OpenAPI Specification
openapi: 3.0.0
info:
description: 'Manage your configurations for Kona Site Defender,
Web Application Protector, and Client Reputation.
'
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
title: 'Akamai: Application Security Activation history Client-Side Protections & Compliance API'
version: v1
servers:
- url: https://{hostname}/appsec/v1
tags:
- name: Client-Side Protections & Compliance
paths:
/configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/cpc:
parameters:
- description: A unique identifier for each configuration.
example: '{{configId}}'
in: path
name: configId
required: true
schema:
example: 77653
format: int64
type: integer
x-akamai:
file-path: parameters/config-id-path.yaml
- description: A unique identifier for each version of a configuration.
example: '{{versionNumber}}'
in: path
name: versionNumber
required: true
schema:
example: 25
type: integer
x-akamai:
file-path: parameters/version-number-path.yaml
- description: A unique identifier for a security policy.
example: '{{policyId}}'
in: path
name: policyId
required: true
schema:
example: boBF_19288
type: string
x-akamai:
file-path: parameters/policy-id-path.yaml
x-akamai:
file-path: paths/policy-cpc.yaml
path-info: /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/cpc
get:
description: Get Client-Side Protection & Compliance settings for a specific policy. For more information, see [Client-side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) _Products:_ All.
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/get-policy-cpc
operationId: get-policy-cpc
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
example: '{{accountSwitchKey}}'
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
responses:
'200':
content:
application/json:
example:
edgeInjection:
autoLoadStaging: false
clientSideProtectionConfigId: 5965
cpcConfigId: 5965
loadScriptAsync: false
edgeTestParameters:
disableInjectionKey: page-integrity
disableInjectionValue: disable-injection-1234_104690
forceInjectionKey: page-integrity
forceInjectionValue: force-injection-1234_104690
injectionCriteria:
injectionPathExcludes: ''
injectionPathIncludes: ''
injectionPercent: 100
injectionPolicy: late_head
schema:
additionalProperties: false
description: Configuration settings for Client-Side Protection & Compliance.
properties:
edgeInjection:
additionalProperties: false
description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
properties:
autoLoadStaging:
description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
type: boolean
clientSideProtectionConfigId:
description: Identifies each Client-Side Protection & Compliance configuration.
type: integer
loadScriptAsync:
description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
type: boolean
required:
- clientSideProtectionConfigId
- loadScriptAsync
- autoLoadStaging
type: object
edgeTestParameters:
additionalProperties: false
description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
properties:
disableInjectionKey:
description: Send this query string parameter to defer injecting the agent.
type: string
disableInjectionValue:
description: Specifies the value to disable agent injection.
type: string
forceInjectionKey:
description: Send this query string parameter to force agent injection.
type: string
forceInjectionValue:
description: Specifies the value to force agent injection.
type: string
type: object
injectionCriteria:
additionalProperties: false
description: Specifies the criteria for agent injection.
properties:
injectionPathExcludes:
description: The path to exclude from agent injection.
minLength: 0
type: string
injectionPathIncludes:
description: The path to include for agent injection.
minLength: 0
type: string
injectionPercent:
description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
maximum: 100
minimum: 0
type: integer
injectionPolicy:
description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`,`<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
enum:
- late_head
- early_head
- mid_head
- first_script
- legacy
type: string
required:
- injectionPolicy
- injectionPercent
type: object
required:
- edgeInjection
- injectionCriteria
- edgeTestParameters
type: object
x-akamai:
file-path: schemas/cpc-protection.yaml
description: The response provides the Client-Side Protections & Compliance settings.
'400':
content:
application/problem+json:
example:
detail: The request could not be understood by the server due to malformed syntax.
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 400
title: Bad Request
type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
additionalProperties:
description: Fields that provide additional details about the problem.
type: string
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Bad request](https://techdocs.akamai.com/application-security/reference/400). Invalid request body or URL parameter input.'
x-akamai:
file-path: errors/400.yaml
'403':
content:
application/problem+json:
example:
detail: You do not have the necessary access to perform this operation or the requested resource cannot be modified
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 403
title: Forbidden
type: https://problems.luna.akamaiapis.net/appsec-resource/error-types/ACCESS-DENIED
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
additionalProperties:
description: Fields that provide additional details about the problem.
type: string
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Forbidden](https://techdocs.akamai.com/application-security/reference/403). You don''t have access to the resource.'
x-akamai:
file-path: errors/403.yaml
'404':
content:
application/problem+json:
example:
detail: The requested resource is not found
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 404
title: Not Found
type: https://problems.luna.akamaiapis.net/appsec/error-types/NOT-FOUND
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
additionalProperties:
description: Fields that provide additional details about the problem.
type: string
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Not found](https://techdocs.akamai.com/application-security/reference/404). That resource doesn''t exist, or the URL is malformed.'
x-akamai:
file-path: errors/404.yaml
summary: Akamai API Security Get Client-Side Protection & Compliance Settings
tags:
- Client-Side Protections & Compliance
put:
description: Update Client-Side Protection & Compliance settings for a specific policy. _Products:_ All.
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/put-policy-cpc
operationId: put-policy-cpc
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
example: '{{accountSwitchKey}}'
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
requestBody:
content:
application/json:
example:
edgeInjection:
autoLoadStaging: false
clientSideProtectionConfigId: 5965
cpcConfigId: 5965
loadScriptAsync: false
edgeTestParameters:
disableInjectionKey: page-integrity
disableInjectionValue: disable-injection-1234_104690
forceInjectionKey: page-integrity
forceInjectionValue: force-injection-1234_104690
injectionCriteria:
injectionPathExcludes: ''
injectionPathIncludes: ''
injectionPercent: 100
injectionPolicy: late_head
schema:
additionalProperties: false
description: Configuration settings for Client-Side Protection & Compliance.
properties:
edgeInjection:
additionalProperties: false
description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
properties:
autoLoadStaging:
description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
type: boolean
clientSideProtectionConfigId:
description: Identifies each Client-Side Protection & Compliance configuration.
type: integer
loadScriptAsync:
description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
type: boolean
required:
- clientSideProtectionConfigId
- loadScriptAsync
- autoLoadStaging
type: object
edgeTestParameters:
additionalProperties: false
description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
properties:
disableInjectionKey:
description: Send this query string parameter to defer injecting the agent.
type: string
disableInjectionValue:
description: Specifies the value to disable agent injection.
type: string
forceInjectionKey:
description: Send this query string parameter to force agent injection.
type: string
forceInjectionValue:
description: Specifies the value to force agent injection.
type: string
type: object
injectionCriteria:
additionalProperties: false
description: Specifies the criteria for agent injection.
properties:
injectionPathExcludes:
description: The path to exclude from agent injection.
minLength: 0
type: string
injectionPathIncludes:
description: The path to include for agent injection.
minLength: 0
type: string
injectionPercent:
description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
maximum: 100
minimum: 0
type: integer
injectionPolicy:
description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`,`<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
enum:
- late_head
- early_head
- mid_head
- first_script
- legacy
type: string
required:
- injectionPolicy
- injectionPercent
type: object
required:
- edgeInjection
- injectionCriteria
- edgeTestParameters
type: object
x-akamai:
file-path: schemas/cpc-protection.yaml
required: true
responses:
'200':
content:
application/json:
example:
edgeInjection:
autoLoadStaging: false
clientSideProtectionConfigId: 5965
cpcConfigId: 5965
loadScriptAsync: false
edgeTestParameters:
disableInjectionKey: page-integrity
disableInjectionValue: disable-injection-1234_104690
forceInjectionKey: page-integrity
forceInjectionValue: force-injection-1234_104690
injectionCriteria:
injectionPathExcludes: ''
injectionPathIncludes: ''
injectionPercent: 100
injectionPolicy: late_head
schema:
additionalProperties: false
description: Configuration settings for Client-Side Protection & Compliance.
properties:
edgeInjection:
additionalProperties: false
description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
properties:
autoLoadStaging:
description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
type: boolean
clientSideProtectionConfigId:
description: Identifies each Client-Side Protection & Compliance configuration.
type: integer
loadScriptAsync:
description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
type: boolean
required:
- clientSideProtectionConfigId
- loadScriptAsync
- autoLoadStaging
type: object
edgeTestParameters:
additionalProperties: false
description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
properties:
disableInjectionKey:
description: Send this query string parameter to defer injecting the agent.
type: string
disableInjectionValue:
description: Specifies the value to disable agent injection.
type: string
forceInjectionKey:
description: Send this query string parameter to force agent injection.
type: string
forceInjectionValue:
description: Specifies the value to force agent injection.
type: string
type: object
injectionCriteria:
additionalProperties: false
description: Specifies the criteria for agent injection.
properties:
injectionPathExcludes:
description: The path to exclude from agent injection.
minLength: 0
type: string
injectionPathIncludes:
description: The path to include for agent injection.
minLength: 0
type: string
injectionPercent:
description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
maximum: 100
minimum: 0
type: integer
injectionPolicy:
description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`,`<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
enum:
- late_head
- early_head
- mid_head
- first_script
- legacy
type: string
required:
- injectionPolicy
- injectionPercent
type: object
required:
- edgeInjection
- injectionCriteria
- edgeTestParameters
type: object
x-akamai:
file-path: schemas/cpc-protection.yaml
description: The response reflects the updated CPC configuration.
'400':
content:
application/problem+json:
example:
detail: The request could not be understood by the server due to malformed syntax.
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 400
title: Bad Request
type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
additionalProperties:
description: Fields that provide additional details about the problem.
type: string
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Bad request](https://techdocs.akamai.com/application-security/reference/400). Invalid request body or URL parameter input.'
x-akamai:
file-path: errors/400.yaml
'403':
content:
application/problem+json:
example:
detail: You do not have the necessary access to perform this operation or the requested resource cannot be modified
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 403
title: Forbidden
# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai-api-security/refs/heads/main/openapi/akamai-api-security-client-side-protections-compliance-api-openapi.yml