Fastly WAF Exclusions API

openapi: 3.2.0
info:
  title: Fastly Next-Gen WAF WAF Exclusions API
  description: The Fastly Next-Gen WAF API provides programmatic access to configure and manage web application firewall rules that protect applications delivered through Fastly's edge network. It enables developers to manage WAF firewall configurations, rule sets, and exclusions to defend against common web attacks including SQL injection, cross-site scripting, and other OWASP Top 10 vulnerabilities. The API supports managing active rules, reviewing firewall events, and configuring response behaviors for detected threats.
  version: '1.0'
  contact:
    name: Fastly Support
    url: https://support.fastly.com
  termsOfService: https://www.fastly.com/terms
servers:
- url: https://api.fastly.com
  description: Fastly API Production Server
security:
- apiKeyAuth: []
tags:
- name: WAF Exclusions
  description: Operations for managing WAF exclusions that prevent specific requests from being flagged by the firewall.
paths:
  /waf/firewalls/{firewall_id}/versions/{firewall_version_number}/exclusions:
    get:
      operationId: listWafExclusions
      summary: List WAF exclusions
      description: Retrieves a list of all WAF exclusions for a specific firewall version. Exclusions prevent requests matching a particular pattern from being flagged by the firewall.
      tags:
      - WAF Exclusions
      parameters:
      - $ref: '#/components/parameters/firewallId'
      - $ref: '#/components/parameters/firewallVersionNumber'
      - name: page[number]
        in: query
        description: The page number to retrieve.
        schema:
          type: integer
      - name: page[size]
        in: query
        description: The number of items per page.
        schema:
          type: integer
      responses:
        '200':
          description: Successfully retrieved the list of WAF exclusions.
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/WafExclusion'
        '401':
          description: Unauthorized. The API token is missing or invalid.
    post:
      operationId: createWafExclusion
      summary: Create a WAF exclusion
      description: Creates a new WAF exclusion for a specific firewall version.
      tags:
      - WAF Exclusions
      parameters:
      - $ref: '#/components/parameters/firewallId'
      - $ref: '#/components/parameters/firewallVersionNumber'
      requestBody:
        required: true
        content:
          application/vnd.api+json:
            schema:
              type: object
              properties:
                data:
                  type: object
                  properties:
                    type:
                      type: string
                      enum:
                      - waf_exclusion
                    attributes:
                      type: object
                      properties:
                        name:
                          type: string
                          description: The name of the exclusion.
                        exclusion_type:
                          type: string
                          description: The type of exclusion.
                          enum:
                          - rule
                          - variable
                          - waf
                        condition:
                          type: string
                          description: The VCL condition expression for the exclusion.
      responses:
        '201':
          description: Successfully created the WAF exclusion.
          content:
            application/vnd.api+json:
              schema:
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/WafExclusion'
        '400':
          description: Bad request. Missing or invalid parameters.
        '401':
          description: Unauthorized. The API token is missing or invalid.
components:
  schemas:
    WafExclusion:
      type: object
      description: A WAF exclusion that prevents specific requests from being flagged by the firewall.
      properties:
        id:
          type: string
          description: The alphanumeric string identifying the exclusion.
        type:
          type: string
          description: The resource type.
          enum:
          - waf_exclusion
        attributes:
          type: object
          properties:
            name:
              type: string
              description: The name of the exclusion.
            exclusion_type:
              type: string
              description: The type of exclusion.
              enum:
              - rule
              - variable
              - waf
            condition:
              type: string
              description: The VCL condition expression for the exclusion.
            number:
              type: integer
              description: The exclusion number.
            created_at:
              type: string
              format: date-time
              description: The date and time the exclusion was created.
            updated_at:
              type: string
              format: date-time
              description: The date and time the exclusion was last updated.
  parameters:
    firewallId:
      name: firewall_id
      in: path
      required: true
      description: The alphanumeric string identifying the WAF firewall.
      schema:
        type: string
    firewallVersionNumber:
      name: firewall_version_number
      in: path
      required: true
      description: The version number of the WAF firewall.
      schema:
        type: integer
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Fastly-Key
      description: API token used to authenticate requests to the Fastly API.
externalDocs:
  description: Fastly Next-Gen WAF API Documentation
  url: https://www.fastly.com/documentation/reference/api/waf/