openapi: 3.0.0
info:
title: 'Akamai: API Endpoint Definition Access tokens WAF rules: General settings API'
version: '2'
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
description: Manage your Web Application Firewall (WAF) rules and rule sets.
servers:
- url: https://{hostname}/api-definitions/v2
tags:
- description: Manage your Web Application Firewall (WAF) rules and rule sets.
name: 'WAF rules: General settings'
paths:
/configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rules:
parameters:
- description: A unique identifier for each configuration.
in: path
name: configId
required: true
schema:
example: 77653
format: int64
type: integer
x-akamai:
file-path: parameters/config-id-path.yaml
- description: A unique identifier for each version of a configuration.
in: path
name: versionNumber
required: true
schema:
example: 25
type: integer
x-akamai:
file-path: parameters/version-number-path.yaml
- description: A unique identifier for a security policy.
in: path
name: policyId
required: true
schema:
example: boBF_19288
type: string
x-akamai:
file-path: parameters/policy-id-path.yaml
x-akamai:
file-path: paths/policy-rules.yaml
path-info: /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rules
get:
description: __Kona Site Defender__, __App & API Protector with the Advanced Security module__ Returns the action taken for each rule in a policy. The action occurs when the rules are triggered by a request. These are not the same rules as Custom Rules that you configure yourself. These rules are maintained by Akamai.
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/get-policy-rules
operationId: get-policy-rules
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
responses:
'200':
content:
application/json:
example:
ruleActions:
- action: alert
id: 699989
- action: alert
id: 699990
- action: alert
id: 699991
- action: alert
id: 699992
- action: alert
id: 699993
- action: alert
id: 699994
schema:
additionalProperties: false
description: Describes the fields of a rule's actions.
properties:
ruleActions:
description: The list of rule actions, either `alert`, `deny`, `deny_custom_{custom_deny_id}`, or `none`. If the action is `none`, the rule is inactive in the policy.
items:
additionalProperties: false
description: The list of rule actions, either `alert`, `deny`, `deny_custom_{custom_deny_id}`, or `none`. If the action is `none`, the rule is inactive in the policy.
properties:
action:
description: The list of rule actions, either `alert`, `deny`, or `none`. Use `deny_custom_{custom_deny_id}` to apply a custom action instead of Akamai's default. Run [Modify a custom deny action](https://techdocs.akamai.com/application-security/reference/put-custom-deny) to manage your custom deny actions. If the action is `none`, the rule is inactive in the policy.
enum:
- alert
- deny
- none
type: string
id:
description: The unique identifier for each rule.
type: integer
required:
- action
- id
type: object
x-akamai:
file-path: schemas/rule-action.yaml
type: array
required:
- ruleActions
type: object
x-akamai:
file-path: schemas/rule-actions-get-200.yaml
description: Successfully retrieved the rule actions.
'400':
content:
application/json:
example:
detail: The request could not be understood by the server due to malformed syntax.
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 400
title: Bad Request
type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Invalid](https://techdocs.akamai.com/application-security/reference/400). Client error, such as invalid or malformed input.'
x-akamai:
file-path: errors/400-client-read-errors.yaml
'404':
content:
application/problem+json:
example:
detail: The requested resource is not found
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 404
title: Not Found
type: https://problems.luna.akamaiapis.net/appsec/error-types/NOT-FOUND
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Not found](https://techdocs.akamai.com/application-security/reference/404). The security policy doesn''t exist, doesn''t carry application layer controls, or no rule with this ID is available for use in this policy.'
x-akamai:
file-path: errors/404-client-read-errors.yaml
'500':
content:
application/problem+json:
example:
detail: Internal Server Error
instance: 12ab3c45-789d-01ef-2gh3-ijk4l56m78no
status: 500
title: Internal Server Error
type: internal_server_error
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Internal server error](https://techdocs.akamai.com/application-security/reference/500). Something went wrong on our side. Try again in a few minutes or contact support if the error persists.'
x-akamai:
file-path: errors/500-server-errors.yaml
summary: List rules
tags:
- 'WAF rules: General settings'
x-akamai:
labels:
- Kona Site Defender
- App & API Protector with the Advanced Security module
put:
description: '__Kona Site Defender__, __App & API Protector with the Advanced Security module__, __Adaptive Security Engine__ Upgrade to the most recent version of the KRS rule set. Akamai periodically updates these rules to keep protections current. However, the rules you use in your security policies do not automatically upgrade to the latest version when setting `mode` to `KRS`. These rules do update automatically when you have `mode` set to `AAG`. Before you upgrade, run [Get upgrade details](https://techdocs.akamai.com/application-security/reference/get-rules-upgrade-details) to see which rules have changed. If you want to test how these rules would operate with live traffic before committing to the upgrade, run them in evaluation mode. This applies to KRS rules only and does not allow you to make any changes to the rules themselves. The response is the same as the `mode` response. If you''re already using or want to switch from KRS to Adaptive Security Engine (ASE), pass `"upgrade": true,` and `"mode": "ASE_AUTO"` or `ASE_MANUAL` in your request. If you''re using Kona Rule Sets, continue to pass only the upgrade value. Note that this operation does not grant access to Adaptive Security Engine. It updates the ASE protections if you already have ASE on your contract. Once you switch to ASE protections, you can''t go back to KRS rules. Contact your account team if you want to add ASE to your contract.'
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/put-policy-rules
operationId: put-policy-rules
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
requestBody:
content:
application/json:
example:
upgrade: true
schema:
additionalProperties: false
description: Represents the upgrade configuration for a firewall policy rule.
properties:
upgrade:
description: Whether the upgrade is enabled.
type: boolean
required:
- upgrade
type: object
x-akamai:
file-path: schemas/rules-put.yaml
required: true
responses:
'200':
content:
application/json:
example:
current: KRS 1.0 (Apr 20, 2020)
mode: KRS
schema:
additionalProperties: false
description: The GET Response JSON for the security policy mode.
properties:
current:
description: The current rule set version and the ISO 8601 date the rule set version was introduced. This date acts like a version number.
type: string
eval:
description: Whether the evaluation mode is `enabled` or `disabled`.
enum:
- enabled
- disabled
type: string
evaluating:
description: The evaluation rule set version and the ISO 8601 date the evaluation starts.
type: string
expires:
description: The ISO 8601 time stamp when the evaluation is expiring. This value only appears when `eval` is set to `enabled`.
format: date-time
type: string
mode:
description: The security policy mode. Use `KRS` to update manually, or `AAG` to update automatically. For Adaptive Security Engine rule sets, use `ASE_AUTO` for automatic updates to the ASE evaluation rules, or `ASE_MANUAL` to manually retrieve current evaluation rules. When not specified, the mode uses default settings. For a KRS 1.0 policy, that means using the KRS 1.0 rule set.
enum:
- KRS
- AAG
- ASE_AUTO
- ASE_MANUAL
type: string
required:
- mode
type: object
x-akamai:
file-path: schemas/mode-get-200.yaml
description: Successfully updated to latest KRS rule set version.
'400':
content:
application/json:
example:
detail: The request could not be understood by the server due to malformed syntax.
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 400
title: Bad Request
type: https://problems.luna.akamaiapis.net/appsec/error-types/BAD-REQUEST
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Invalid](https://techdocs.akamai.com/application-security/reference/400). Client error, such as invalid or malformed input.'
x-akamai:
file-path: errors/400-client-read-errors.yaml
'403':
content:
application/problem+json:
example:
detail: You do not have the necessary access to perform this operation or the requested resource cannot be modified
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 403
title: Forbidden
type: https://problems.luna.akamaiapis.net/appsec-resource/error-types/ACCESS-DENIED
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Forbidden](https://techdocs.akamai.com/application-security/reference/403). You don''t have permission to write to this resource.'
x-akamai:
file-path: errors/403-client-write-errors.yaml
'404':
content:
application/problem+json:
example:
detail: The requested resource is not found
instance: https://problems.luna.akamaiapis.net/appsec/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
status: 404
title: Not Found
type: https://problems.luna.akamaiapis.net/appsec/error-types/NOT-FOUND
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Not found](https://techdocs.akamai.com/application-security/reference/404). The security policy doesn''t exist, doesn''t carry application layer controls, or no rule with this ID is available for use in this policy.'
x-akamai:
file-path: errors/404-client-read-errors.yaml
'500':
content:
application/problem+json:
example:
detail: Internal Server Error
instance: 12ab3c45-789d-01ef-2gh3-ijk4l56m78no
status: 500
title: Internal Server Error
type: internal_server_error
schema:
additionalProperties: true
description: Details the errors you can receive.
properties:
detail:
description: The detailed error message.
type: string
fieldErrors:
description: Pointers to fields for which invalid input was provided, whose values are messages detailing the reason this input was invalid for this field.
type: object
instance:
description: The non-referenceable URI that indicates the error instance.
example: https://problems.luna.akamaiapis.net/api-definitions/error-instances/d54686b5-21cb-4ab7-a8d6-a92282cf1749
type: string
status:
description: The HTTP status code.
example: 404
type: integer
title:
description: The error title.
example: Not Found
type: string
type:
description: The URL for the error type.
example: https://problems.luna.akamaiapis.net/api-definitions/error-types/NOT-FOUND
type: string
required:
- title
- type
- detail
- instance
- status
type: object
x-akamai:
file-path: schemas/problem-details.yaml
description: '[Internal server error](https://techdocs.akamai.com/application-security/reference/500). Something went wrong on our side. Try again in a few minutes or contact support if the error persists.'
x-akamai:
file-path: errors/500-server-errors.yaml
summary: Upgrade KRS ruleset
tags:
- 'WAF rules: General settings'
x-akamai:
labels:
- Kona Site Defender
- App & API Protector with the Advanced Security module
- Adaptive Security Engine
/configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rules/upgrade-details:
parameters:
- description: A unique identifier for each configuration.
in: path
name: configId
required: true
schema:
example: 77653
format: int64
type: integer
x-akamai:
file-path: parameters/config-id-path.yaml
- description: A unique identifier for each version of a configuration.
in: path
name: versionNumber
required: true
schema:
example: 25
type: integer
x-akamai:
file-path: parameters/version-number-path.yaml
- description: A unique identifier for a security policy.
in: path
name: policyId
required: true
schema:
example: boBF_19288
type: string
x-akamai:
file-path: parameters/policy-id-path.yaml
x-akamai:
file-path: paths/policy-rules-upgrade-details.yaml
path-info: /configs/{configId}/versions/{versionNumber}/security-policies/{policyId}/rules/upgrade-details
get:
description: __Kona Site Defender__, __App & API Protector with the Advanced Security module__ Only applies to Kona rule sets. The KRS rule sets are maintained by Akamai's security research team. Run this operation before you upgrade to verify changes in the rule sets. If you want to test how the updates affect your site, you can run the updated rules in evaluation mode.
externalDocs:
description: See documentation for this operation in Akamai's Application Security API
url: https://techdocs.akamai.com/application-security/reference/get-rules-upgrade-details
operationId: get-rules-upgrade-details
parameters:
- description: For customers who manage more than one account, this [runs the operation from another account](https://techdocs.akamai.com/developer/docs/manage-many-accounts-with-one-api-client). The Identity and Access Management API provides a [list of available account switch keys](https://techdocs.akamai.com/iam-api/reference/get-client-account-switch-keys).
in: query
name: accountSwitchKey
required: false
schema:
example: 1-5C0YLB:1-8BYUX
type: string
responses:
'200':
content:
application/json:
example:
current: KRS 1.0 (Apr 20, 2020)
evalToEvalUpdates:
deletedAttackGroups:
- group: SQL
groupName: SQL Injection
deletedRules: []
newAttackGroups:
- group: CMD
groupName: Command Injection
- group: XSS
groupName: Cross Site Scripting (XSS)
newRules:
- id: 3000090
title: 'Cross-site Scripting (XSS) Attack: Attribute Injection'
updatedAttackGroups: []
updatedRules: []
evaluating: KRS 1.0 (Mar 15, 2020)
krsToEvalUpdates:
deletedAttackGroups:
- group: SQL
groupName: SQL Injection
deletedRules: []
newAttackGroups:
- group: CMD
groupName: Command Injection
- group: XSS
groupName: Cross Site Scripting (XSS)
newRules:
- id: 3000082
title: 'Cross-site Scripting (XSS) Attack: Attribute Injection'
- id: 3000083
title: IE XSS Filters - Attack Detected
updatedAttackGroups: []
updatedRules:
- id: 3000080
title: Cross-site Scripting (XSS) Attack
- id: 3000081
title: PHP Injection Attack (Opening Tag)
krsToLatestUpdates:
deletedAttackGroups:
- group: SQL
groupName: SQL Injection
deletedRules:
- id: 3000048
title: MSSQL Code Execution and Information Gathering Attempts
newAttackGroups: []
newRules:
- id: 3000090
title: Remote File Inclusion Attack
- id: 3000091
title: IE XSS Filters
updatedAttackGroups:
- group: CMD
groupName: Command Injection
- group: XSS
groupName: Cross Site Scripting (XSS)
updatedRules: []
latest: KRS 1.0 (June 15, 2020)
schema:
additionalProperties: false
description: Specifies KRS rule set upgrade details.
properties:
current:
description: The version of the KRS rule set you currently have.
type: string
evalToEvalUpdates:
additionalProperties: false
description: Lists available updates to rules you're currently evaluating but you haven't yet upgraded to.
properties:
deletedAttackGroups:
description: The deleted risk score groups.
items:
additionalProperties: false
description: Describes the fields of a risk score group array.
properties:
group:
description: Uniquely identifies the risk score group.
type: string
groupName:
description: The risk score group name.
type: string
required:
- group
- groupName
type: object
x-akamai:
file-path: schemas/risk-score-group.yaml
type: array
deletedRules:
description: The deleted rules.
items:
additionalProperties: false
des
# --- truncated at 32 KB (501 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/akamai/refs/heads/main/openapi/akamai-waf-rules-general-settings-api-openapi.yml