Akamai Client-Side Protections & Compliance API

openapi: 3.0.0
info:
  title: 'Akamai: API Endpoint Definition Access tokens Client-Side Protections & Compliance API'
  version: '2'
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
- url: https://{hostname}/api-definitions/v2
tags:
- name: Client-Side Protections & Compliance
paths:
  /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/cpc:
    parameters:
    - description: A unique identifier for each configuration.
      in: path
      name: configId
      required: true
      schema:
        example: 77653
        format: int64
        type: integer
      x-akamai:
        file-path: parameters/config-id-path.yaml
    - description: A unique identifier for each version of a configuration.
      in: path
      name: versionNumber
      required: true
      schema:
        example: 25
        type: integer
      x-akamai:
        file-path: parameters/version-number-path.yaml
    - description: A unique identifier for a security policy.
      in: path
      name: policyId
      required: true
      schema:
        example: boBF_19288
        type: string
      x-akamai:
        file-path: parameters/policy-id-path.yaml
    x-akamai:
      file-path: paths/policy-cpc.yaml
      path-info: /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/cpc
    get:
      description: __All products__ Get Client-Side Protection & Compliance settings for a specific policy. For more information, see [Client-side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov)
      externalDocs:
        description: See documentation for this operation in Akamai's Application Security API
        url: https://techdocs.akamai.com/application-security/reference/get-policy-cpc
      operationId: get-policy-cpc
      parameters:
      - description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
        in: query
        name: accountSwitchKey
        required: false
        schema:
          example: 1-5C0YLB:1-8BYUX
          type: string
      responses:
        '200':
          content:
            application/json:
              example:
                edgeInjection:
                  autoLoadStaging: false
                  clientSideProtectionConfigId: 5965
                  loadScriptAsync: false
                edgeTestParameters:
                  disableInjectionKey: page-integrity
                  disableInjectionValue: disable-injection-1234_104690
                  forceInjectionKey: page-integrity
                  forceInjectionValue: force-injection-1234_104690
                injectionCriteria:
                  injectionPathExcludes: ''
                  injectionPathIncludes: ''
                  injectionPercent: 100
                  injectionPolicy: late_head
              schema:
                additionalProperties: false
                description: Configuration settings for Client-Side Protection & Compliance.
                properties:
                  edgeInjection:
                    additionalProperties: false
                    description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
                    properties:
                      autoLoadStaging:
                        description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
                        type: boolean
                      clientSideProtectionConfigId:
                        description: Identifies each Client-Side Protection & Compliance configuration.
                        type: integer
                      loadScriptAsync:
                        description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
                        type: boolean
                    required:
                    - clientSideProtectionConfigId
                    - loadScriptAsync
                    - autoLoadStaging
                    type: object
                  edgeTestParameters:
                    additionalProperties: false
                    description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
                    properties:
                      disableInjectionKey:
                        description: Send this query string parameter to defer injecting the agent.
                        type: string
                      disableInjectionValue:
                        description: Specifies the value to disable agent injection.
                        type: string
                      forceInjectionKey:
                        description: Send this query string parameter to force agent injection.
                        type: string
                      forceInjectionValue:
                        description: Specifies the value to force agent injection.
                        type: string
                    type: object
                  injectionCriteria:
                    additionalProperties: false
                    description: Specifies the criteria for agent injection.
                    properties:
                      injectionPathExcludes:
                        description: The path to exclude from agent injection.
                        minLength: 0
                        type: string
                      injectionPathIncludes:
                        description: The path to include for agent injection.
                        minLength: 0
                        type: string
                      injectionPercent:
                        description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
                        maximum: 100
                        minimum: 0
                        type: integer
                      injectionPolicy:
                        description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`, `<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
                        enum:
                        - late_head
                        - early_head
                        - mid_head
                        - first_script
                        - legacy
                        type: string
                    required:
                    - injectionPolicy
                    - injectionPercent
                    type: object
                required:
                - edgeInjection
                - injectionCriteria
                - edgeTestParameters
                type: object
                x-akamai:
                  file-path: schemas/cpc-protection.yaml
          description: The response provides the Client-Side Protections & Compliance settings.
        '400':
          content:
            application/problem+json:
              example:
                detail: The request could not be understood by the server due to malformed syntax.
                instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                status: 400
                title: Bad Request
                type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
              schema:
                additionalProperties: true
                description: Details the errors you can receive.
                properties:
                  detail:
                    description: The detailed error message.
                    type: string
                  fieldErrors:
                    description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
                    type: object
                  instance:
                    description: The non-referenceable URI that indicates the error instance.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                    type: string
                  status:
                    description: The HTTP status code.
                    example: 404
                    type: integer
                  title:
                    description: The error title.
                    example: Not Found
                    type: string
                  type:
                    description: The URL for the error type.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
                    type: string
                required:
                - title
                - type
                - detail
                - instance
                - status
                type: object
                x-akamai:
                  file-path: schemas/problem-details.yaml
          description: '[Bad request](https://techdocs.akamai.com/application-security/reference/400). Invalid request body or URL parameter input.'
          x-akamai:
            file-path: errors/400.yaml
        '403':
          content:
            application/problem+json:
              example:
                detail: You do not have the necessary access to perform this operation or the requested resource cannot be modified
                instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                status: 403
                title: Forbidden
                type: https://problems.luna.akamaiapis.net/appsec-resource/error-types/ACCESS-DENIED
              schema:
                additionalProperties: true
                description: Details the errors you can receive.
                properties:
                  detail:
                    description: The detailed error message.
                    type: string
                  fieldErrors:
                    description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
                    type: object
                  instance:
                    description: The non-referenceable URI that indicates the error instance.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                    type: string
                  status:
                    description: The HTTP status code.
                    example: 404
                    type: integer
                  title:
                    description: The error title.
                    example: Not Found
                    type: string
                  type:
                    description: The URL for the error type.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
                    type: string
                required:
                - title
                - type
                - detail
                - instance
                - status
                type: object
                x-akamai:
                  file-path: schemas/problem-details.yaml
          description: '[Forbidden](https://techdocs.akamai.com/application-security/reference/403). You don''t have access to the resource.'
          x-akamai:
            file-path: errors/403.yaml
        '404':
          content:
            application/problem+json:
              example:
                detail: The requested resource is not found
                instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                status: 404
                title: Not Found
                type: https://problems.luna.akamaiapis.net/appsec/error-types/NOT-FOUND
              schema:
                additionalProperties: true
                description: Details the errors you can receive.
                properties:
                  detail:
                    description: The detailed error message.
                    type: string
                  fieldErrors:
                    description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
                    type: object
                  instance:
                    description: The non-referenceable URI that indicates the error instance.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                    type: string
                  status:
                    description: The HTTP status code.
                    example: 404
                    type: integer
                  title:
                    description: The error title.
                    example: Not Found
                    type: string
                  type:
                    description: The URL for the error type.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
                    type: string
                required:
                - title
                - type
                - detail
                - instance
                - status
                type: object
                x-akamai:
                  file-path: schemas/problem-details.yaml
          description: '[Not found](https://techdocs.akamai.com/application-security/reference/404). That resource doesn''t exist, or the URL is malformed.'
          x-akamai:
            file-path: errors/404.yaml
      summary: Get Client-Side Protection & Compliance settings
      tags:
      - Client-Side Protections & Compliance
      x-akamai:
        labels:
        - All products
    put:
      description: __All products__ Update Client-Side Protection & Compliance settings for a specific policy.
      externalDocs:
        description: See documentation for this operation in Akamai's Application Security API
        url: https://techdocs.akamai.com/application-security/reference/put-policy-cpc
      operationId: put-policy-cpc
      parameters:
      - description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
        in: query
        name: accountSwitchKey
        required: false
        schema:
          example: 1-5C0YLB:1-8BYUX
          type: string
      requestBody:
        content:
          application/json:
            example:
              edgeInjection:
                autoLoadStaging: false
                clientSideProtectionConfigId: 5965
                loadScriptAsync: false
              edgeTestParameters:
                disableInjectionKey: page-integrity
                disableInjectionValue: disable-injection-1234_104690
                forceInjectionKey: page-integrity
                forceInjectionValue: force-injection-1234_104690
              injectionCriteria:
                injectionPathExcludes: ''
                injectionPathIncludes: ''
                injectionPercent: 100
                injectionPolicy: late_head
            schema:
              additionalProperties: false
              description: Configuration settings for Client-Side Protection & Compliance.
              properties:
                edgeInjection:
                  additionalProperties: false
                  description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
                  properties:
                    autoLoadStaging:
                      description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
                      type: boolean
                    clientSideProtectionConfigId:
                      description: Identifies each Client-Side Protection & Compliance configuration.
                      type: integer
                    loadScriptAsync:
                      description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
                      type: boolean
                  required:
                  - clientSideProtectionConfigId
                  - loadScriptAsync
                  - autoLoadStaging
                  type: object
                edgeTestParameters:
                  additionalProperties: false
                  description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
                  properties:
                    disableInjectionKey:
                      description: Send this query string parameter to defer injecting the agent.
                      type: string
                    disableInjectionValue:
                      description: Specifies the value to disable agent injection.
                      type: string
                    forceInjectionKey:
                      description: Send this query string parameter to force agent injection.
                      type: string
                    forceInjectionValue:
                      description: Specifies the value to force agent injection.
                      type: string
                  type: object
                injectionCriteria:
                  additionalProperties: false
                  description: Specifies the criteria for agent injection.
                  properties:
                    injectionPathExcludes:
                      description: The path to exclude from agent injection.
                      minLength: 0
                      type: string
                    injectionPathIncludes:
                      description: The path to include for agent injection.
                      minLength: 0
                      type: string
                    injectionPercent:
                      description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
                      maximum: 100
                      minimum: 0
                      type: integer
                    injectionPolicy:
                      description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`, `<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
                      enum:
                      - late_head
                      - early_head
                      - mid_head
                      - first_script
                      - legacy
                      type: string
                  required:
                  - injectionPolicy
                  - injectionPercent
                  type: object
              required:
              - edgeInjection
              - injectionCriteria
              - edgeTestParameters
              type: object
              x-akamai:
                file-path: schemas/cpc-protection.yaml
        required: true
      responses:
        '200':
          content:
            application/json:
              example:
                edgeInjection:
                  autoLoadStaging: false
                  clientSideProtectionConfigId: 5965
                  loadScriptAsync: false
                edgeTestParameters:
                  disableInjectionKey: page-integrity
                  disableInjectionValue: disable-injection-1234_104690
                  forceInjectionKey: page-integrity
                  forceInjectionValue: force-injection-1234_104690
                injectionCriteria:
                  injectionPathExcludes: ''
                  injectionPathIncludes: ''
                  injectionPercent: 100
                  injectionPolicy: late_head
              schema:
                additionalProperties: false
                description: Configuration settings for Client-Side Protection & Compliance.
                properties:
                  edgeInjection:
                    additionalProperties: false
                    description: Specifies the Client-Side Protection & Compliance (CPC) configuration you want to apply, and which pages get monitored by CPC's JavaScript injection to flag suspicious activity. See [Client-Side Protection & Compliance](https://techdocs.akamai.com/client-side-protect-compliance/docs/client-side-protect-compliance-ov) for more information.
                    properties:
                      autoLoadStaging:
                        description: Whether the agent should load from staging. Enabling this can speed up your testing on the staging network.
                        type: boolean
                      clientSideProtectionConfigId:
                        description: Identifies each Client-Side Protection & Compliance configuration.
                        type: integer
                      loadScriptAsync:
                        description: Whether the agent script should load asynchronously. Note that this can help improve performance, but may make malicious scripts detection less accurate. See [Load script asynchronously ](https://techdocs.akamai.com/client-side-protect-compliance/docs/tune-configurations-for-security-and-performance#load-script-asynchronously) to learn more.
                        type: boolean
                    required:
                    - clientSideProtectionConfigId
                    - loadScriptAsync
                    - autoLoadStaging
                    type: object
                  edgeTestParameters:
                    additionalProperties: false
                    description: Use these query string parameters to unit test an edge server's behavior. Entries here override the sampling percentage, ensuring or disabling JavaScript injection.
                    properties:
                      disableInjectionKey:
                        description: Send this query string parameter to defer injecting the agent.
                        type: string
                      disableInjectionValue:
                        description: Specifies the value to disable agent injection.
                        type: string
                      forceInjectionKey:
                        description: Send this query string parameter to force agent injection.
                        type: string
                      forceInjectionValue:
                        description: Specifies the value to force agent injection.
                        type: string
                    type: object
                  injectionCriteria:
                    additionalProperties: false
                    description: Specifies the criteria for agent injection.
                    properties:
                      injectionPathExcludes:
                        description: The path to exclude from agent injection.
                        minLength: 0
                        type: string
                      injectionPathIncludes:
                        description: The path to include for agent injection.
                        minLength: 0
                        type: string
                      injectionPercent:
                        description: The proportion of all pages into which the Client-Side Protection & Compliance JavaScript is inserted. For example, if you set it to `5` percent, the JavaScript file is embedded in just that fraction of your pages, leaving the remaining `95` percent to run without the script.
                        maximum: 100
                        minimum: 0
                        type: integer
                      injectionPolicy:
                        description: Specifies the position where agent injection should be applied. The JavaScript injection runs on a page, but you can inject it in a more specific location to fit the characteristics of your pages. Use `early_head` to insert the JavaScript after the `<head>` tag at the beginning of the page. Use `mid_head` to add the JavaScript further down in the `<head>` tags, after tags like `<base>`, `<link>`, `<meta>`, and similarly located tags. Use `late_head` to insert the JavaScript before a title and after all heading tags, or `first_script` to insert the user agent before the first `<script>` tag. Note that the injection always occurs before the first `<script>` tag in your site. If you choose another insertion point and a `<script>` tag appears before it, the insertion point will be the `<script>` tag and not the tag you chose. Use `legacy` to inject the JavaScript as the first script on the page. Note that `early_script` is an updated version of `legacy`.
                        enum:
                        - late_head
                        - early_head
                        - mid_head
                        - first_script
                        - legacy
                        type: string
                    required:
                    - injectionPolicy
                    - injectionPercent
                    type: object
                required:
                - edgeInjection
                - injectionCriteria
                - edgeTestParameters
                type: object
                x-akamai:
                  file-path: schemas/cpc-protection.yaml
          description: The response reflects the updated CPC configuration.
        '400':
          content:
            application/problem+json:
              example:
                detail: The request could not be understood by the server due to malformed syntax.
                instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                status: 400
                title: Bad Request
                type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
              schema:
                additionalProperties: true
                description: Details the errors you can receive.
                properties:
                  detail:
                    description: The detailed error message.
                    type: string
                  fieldErrors:
                    description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
                    type: object
                  instance:
                    description: The non-referenceable URI that indicates the error instance.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                    type: string
                  status:
                    description: The HTTP status code.
                    example: 404
                    type: integer
                  title:
                    description: The error title.
                    example: Not Found
                    type: string
                  type:
                    description: The URL for the error type.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
                    type: string
                required:
                - title
                - type
                - detail
                - instance
                - status
                type: object
                x-akamai:
                  file-path: schemas/problem-details.yaml
          description: '[Bad request](https://techdocs.akamai.com/application-security/reference/400). Invalid request body or URL parameter input.'
          x-akamai:
            file-path: errors/400.yaml
        '403':
          content:
            application/problem+json:
              example:
                detail: You do not have the necessary access to perform this operation or the requested resource cannot be modified
                instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                status: 403
                title: Forbidden
                type: https://problems.luna.akamaiapis.net/appsec-resource/error-types/ACCESS-DENIED
              schema:
                additionalProperties: true
                description: Details the errors you can receive.
                properties:
                  detail:
                    description: The detailed error message.
                    type: string
                  fieldErrors:
                    description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
                    type: object
                  instance:
                    description: The non-referenceable URI that indicates the error instance.
                    example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
                    type: string
                  status:
                    description: The HTTP status code.
                    example: 404
                    type: intege

# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai/refs/heads/main/openapi/akamai-client-side-protections-compliance-api-openapi.yml