Quickly manage and mitigate risks resulting from the most recent high-profile, critical vulnerabilities. __Note__. Rapid rules are rules you can apply while we are still testing and perfecting them. Once we finish that process, a rapid rule becomes a WAF rule.
openapi: 3.0.0
info:
description: 'Manage your configurations for Kona Site Defender,
Web Application Protector, and Client Reputation.
'
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
title: 'Akamai: Application Security Activation history WAF rules: Rapid rules API'
version: v1
servers:
- url: https://{hostname}/appsec/v1
tags:
- description: 'Quickly manage and mitigate risks resulting from the most recent high-profile, critical vulnerabilities.
__Note__. Rapid rules are rules you can apply while we are still testing and perfecting them. Once we finish that process, a rapid rule becomes a WAF rule.'
name: 'WAF rules: Rapid rules'
paths:
/configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rapid-rules:
parameters:
- description: A unique identifier for each configuration.
example: '{{configId}}'
in: path
name: configId
required: true
schema:
example: 77653
format: int64
type: integer
x-akamai:
file-path: parameters/config-id-path.yaml
- description: A unique identifier for each version of a configuration.
example: '{{versionNumber}}'
in: path
name: versionNumber
required: true
schema:
example: 25
type: integer
x-akamai:
file-path: parameters/version-number-path.yaml
- description: A unique identifier for a security policy.
example: '{{policyId}}'
in: path
name: policyId
required: true
schema:
example: boBF_19288
type: string
x-akamai:
file-path: parameters/policy-id-path.yaml
x-akamai:
file-path: paths/rapid-rules.yaml
path-info: /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rapid-rules
get:
description: 'Returns rapid rules. [Rapid rules are WAF rules we are actively testing and refining.](https://techdocs.akamai.com/application-security/docs/rapid-rules) You can start using them while we revise them. Once we complete fine-tuning a rule, it becomes a WAF rule you can access through [List rules](https://techdocs.akamai.com/application-security/docs/get-policy-rules). '
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/get-policy-rapid-rules
operationId: get-policy-rapid-rules
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
example: '{{accountSwitchKey}}'
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
responses:
'200':
content:
application/json:
example:
policyRules:
- action: deny
conditionException: {}
id: 950002
lock: true
riskScoreGroups: []
title: Rapid rule title
version: 1
- action: alert
conditionException: {}
id: 950006
lock: false
riskScoreGroups:
- LFI
title: Local File Inclusion (LFI) Attack on Linux files
version: 2
- action: alert
conditionException:
exception:
specificHeaderCookieParamXmlOrJsonNames:
- names:
- test
selector: REQUEST_COOKIES_NAMES
wildcard: true
id: 950007
lock: false
riskScoreGroups:
- XSS
title: Cross-site Scripting (XSS) Attack
version: 2
schema:
additionalProperties: false
description: Describes the members of a rapid rule's actions.
properties:
policyRules:
description: The list of rapid rules.
items:
additionalProperties: false
description: Describes the members of a rapid rules array.
properties:
action:
description: The list of rapid rule actions, either `alert`, `deny`, or `none`. Use `deny_custom_{custom_deny_id}` to apply a custom action instead of Akamai's default. Run [Modify a custom deny action](https://techdocs.akamai.com/application-security/reference/put-custom-deny) to manage your custom deny actions. If the action is `none`, the rule is inactive in the policy.
oneOf:
- enum:
- alert
- deny
- none
- akamai_managed
title: Predefined action
type: string
- pattern: ^(challenge|deny_custom|serve_alt|cond_action_)_[0-9]+$
title: Configurable action
type: string
type: object
x-akamai:
file-path: schemas/rapid-rule-action.yaml
conditionException:
additionalProperties: false
description: The GET Response JSON for conditions and exceptions.
properties:
advancedExceptions:
additionalProperties: false
description: Describes the advanced exception members that allow you to conditionally exclude requests from inspection. This is only available for attack groups and when the advanced exception feature is enabled.
properties:
conditionOperator:
description: Use `OR` to match any condition, or `AND` to match on all conditions.
enum:
- OR
- AND
type: string
conditions:
description: The list of match conditions.
items:
additionalProperties: false
description: Describes what conditions can be set for an action to occur.
properties:
caseSensitive:
description: Whether to consider the case-sensitivity of the provided query parameter `value`. This only applies to the `uriQueryMatch` condition `type`.
type: boolean
clientLists:
description: The clientLists that trigger the condition. This only applies to the `clientListMatch` condition `type`.
items:
type: string
minItems: 0
type: array
extensions:
description: The file extensions that trigger the condition. This only applies to the `extensionMatch` condition `type`.
items:
type: string
type: array
filenames:
description: The filenames that trigger the condition. This only applies to the `filenameMatch` condition `type`.
items:
type: string
type: array
header:
description: The HTTP header that triggers the condition. This only applies to the `requestHeaderMatch` condition `type`.
type: string
hosts:
description: The hostnames that trigger the condition. This only applies to the `hostMatch` condition `type`.
items:
type: string
type: array
ips:
description: The IPs that trigger the condition. This only applies to the `ipMatch` condition `type`.
items:
type: string
type: array
methods:
description: The HTTP request methods that trigger the condition. The possible values are `GET`, `POST`, `HEAD`, `PUT`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT` and `PATCH`. This only applies to the `requestMethodMatch` condition `type`.
items:
enum:
- GET
- POST
- HEAD
- PUT
- DELETE
- OPTIONS
- TRACE
- CONNECT
- PATCH
type: string
type: array
name:
description: The query parameter name that triggers the condition. This only applies to the `uriQueryMatch` condition `type`.
type: string
nameCase:
description: Whether to consider the case-sensitivity of the provided query parameter `name`. This only applies to the `uriQueryMatch` condition `type`.
type: boolean
paths:
description: The paths that trigger the condition. This only applies to the `pathMatch` condition `type`.
items:
type: string
type: array
positiveMatch:
description: Whether the condition should trigger on a match (`true`) or a lack of match (`false`).
type: boolean
type:
description: The condition type to match on. See [Export condition type values](https://techdocs.akamai.com/application-security/reference/etval).
enum:
- hostMatch
- pathMatch
- filenameMatch
- extensionMatch
- uriQueryMatch
- ipMatch
- requestMethodMatch
- requestHeaderMatch
- clientListMatch
type: string
useHeaders:
description: Whether the condition should include `X-Forwarded-For` (XFF) header. This applies to the `ipMatch` and `clientListMatch` condition `type`.
type: boolean
value:
description: The query parameter value if the condition `type` is `uriQueryMatch` and header value if the condition `type` is `requestHeaderMatch`. This only applies when the condition `type` is `uriQueryMatch` or `requestHeaderMatch`.
type: string
valueCase:
description: Whether to consider the case-sensitivity of the provided header `value`. This only applies to the `requestHeaderMatch` condition `type`.
type: boolean
valueWildcard:
description: Whether the provided header `value` is a wildcard. This only applies to the `requestHeaderMatch` condition `type`.
type: boolean
wildcard:
description: Whether the provided query parameter `value` is a wildcard. This only applies to the `uriQueryMatch` condition `type`.
type: boolean
required:
- type
- positiveMatch
type: object
x-akamai:
file-path: schemas/condition.yaml
type: array
headerCookieOrParamValues:
description: The list of excepted values in headers, cookies, or query parameters.
items:
additionalProperties: false
properties:
criteria:
description: A list of criteria to limit the scope of this exception.
items:
additionalProperties: false
description: The hostname and path criteria to limit the scope of exception.
properties:
hostnames:
description: The list of excepted hostnames.
items:
type: string
type: array
names:
description: The list of excepted names.
items:
type: string
type: array
paths:
description: The list of excepted paths.
items:
type: string
type: array
values:
description: The list of excepted values.
items:
type: string
type: array
required:
- paths
- names
- values
type: object
x-akamai:
file-path: schemas/criteria.yaml
type: array
valueWildcard:
default: false
description: Whether the provided header `name` is a wildcard.
type: boolean
values:
description: The list of request attribute names.
items:
type: string
type: array
required:
- values
type: object
type: array
specificHeaderCookieOrParamNameValue:
description: Contains details about the excepted name-value pairs in a request.
items:
additionalProperties: false
properties:
criteria:
description: A list of criteria to limit the scope of this exception.
items:
additionalProperties: false
description: The hostname and path criteria to limit the scope of exception.
properties:
hostnames:
description: The list of excepted hostnames.
items:
type: string
type: array
names:
description: The list of excepted names.
items:
type: string
type: array
paths:
description: The list of excepted paths.
items:
type: string
type: array
values:
description: The list of excepted values.
items:
type: string
type: array
required:
- paths
- names
- values
type: object
x-akamai:
file-path: schemas/criteria.yaml
type: array
namesValues:
description: A list of name-value pairs to except.
items:
additionalProperties: false
properties:
names:
description: The list of request attribute names.
items:
type: string
type: array
values:
description: The list of request attribute values.
items:
type: string
type: array
required:
- names
type: object
type: array
selector:
description: The request attribute to exclude from inspection. See [Exception selector values](https://techdocs.akamai.com/application-security/reference/exception-selector-values).
enum:
- REQUEST_COOKIES
- JSON_PAIRS
- XML_PAIRS
- ARGS
- REQUEST_HEADERS
type: string
wildcard:
default: false
description: Whether the provided header `name` is a wildcard.
type: boolean
required:
- namesValues
- selector
type: object
type: array
specificHeaderCookieParamXmlOrJsonNames:
description: Describes the advanced exception members that allow you to conditionally exclude requests from inspection. This is only available for attack groups and when the advanced exception feature is enabled.
items:
additionalProperties: false
properties:
criteria:
description: A list of criteria to limit the scope of this exception.
items:
additionalProperties: false
description: The hostname and path criteria to limit the scope of exception.
properties:
hostnames:
description: The list of excepted hostnames.
items:
type: string
type: array
names:
description: The list of excepted names.
items:
type: string
type: array
paths:
description: The list of excepted paths.
items:
type: string
type: array
values:
description: The list of excepted values.
items:
type: string
type: array
required:
- paths
- names
- values
type: object
x-akamai:
file-path: schemas/criteria.yaml
type: array
names:
description: The list of request attribute names.
items:
type: string
type: array
selector:
description: The request attribute to exclude from inspection. See [Exception selector values](https://techdocs.akamai.com/application-security/reference/exception-selector-values).
enum:
- ARGS_NAMES
- ARGS
- REQUEST_HEADERS_NAMES
- REQUEST_HEADERS
- REQUEST_COOKIES_NAMES
- REQUEST_COOKIES
- JSON_NAMES
- JSON_PAIRS
- XML_PAIRS
- REQUEST_PROTOCOL
- REQUEST_METHOD
- REQUEST_URI
- QUERY_STRING
- REQUEST_FILENAME
- REQUEST_PATH_SEGMENT
- REQUEST_BODY
- REQBODY_PROCESSOR_ERROR
- FILES_NAMES
type: string
wildcard:
default: false
description: Whether the provided header `name` is a wildcard.
type: boolean
required:
- selector
type: object
type: array
type: object
x-akamai:
file-path: schemas/advanced-exception.yaml
conditions:
description: The conditions list for a rule.
items:
additionalProperties: false
description: Describes what conditions can be set for an action to occur.
properties:
caseSensitive:
description: Whether to consider the case-sensitivity of the provided query parameter `value`. This only applies to the `uriQueryMatch` condition `type`.
type: boolean
clientLists:
description: The clientLists that trigger the condition. This only applies to the `clientListMatch` condition `type`.
items:
type: string
minItems: 0
type: array
extensions:
description: The file extensions that trigger the condition. This only applies to the `extensionMatch` condition `type`.
items:
type: string
type: array
filenames:
description: The filenames that trigger the condition. This only applies to the `filenameMatch` condition `type`.
items:
type: string
type: array
header:
description: The HTTP header that triggers the condition. This only applies to the `requestHeaderMatch` condition `type`.
type: string
hosts:
description: The hostnames that trigger the condition. This only applies to the `hostMatch` condition `type`.
items:
type: string
type: array
ips:
description: The IPs that trigger the condition. This only applies to the `ipMatch` condition `type`.
items:
type: string
type: array
methods:
description: The HTTP request methods that trigger the condition. The possible values are `GET`, `POST`, `HEAD`, `PUT`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT` and `PATCH`. This only applies to the `requestMethodMatch` condition `type`.
items:
enum:
- GET
- POST
- HEAD
- PUT
- DELETE
- OPTIONS
- TRACE
- CONNECT
- PATCH
type: string
type: array
name:
description: The query parameter name that triggers the condition. This only applies to the `uriQueryMatch` condition `type`.
type: string
nameCase:
description: Whether to consider the case-sensitivity of the provided query parameter `name`. This only applies to the `uriQueryMatch` condition `type`.
type: boolean
paths:
description: The paths that trigger the condition. This only applies to the `pathMatch` condition `type`.
items:
type: string
type: array
positiveMatch:
description: Whether the condition should trigger on a match (`true`) or a lack of match (`false`).
type: boolean
type:
description: The condition type to match on. See [Export condition type values](https://techdocs.akamai.com/application-security/reference/etval).
enum:
- hostMatch
- pathMatch
- filenameMatch
- extensionMatch
- uriQueryMatch
- ipMatch
- requestMethodMatch
- requestHeaderMatch
- clientListMatch
type: string
useHeaders:
description: Whether the condition should i
# --- truncated at 32 KB (264 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai-api-security/refs/heads/main/openapi/akamai-api-security-waf-rules-rapid-rules-api-openapi.yml