Wallarm Rules API

openapi: 3.0.3
info:
  title: Wallarm Applications Rules API
  description: The Wallarm API provides programmatic access to the Wallarm API Security Platform. It enables management of attacks, incidents, vulnerabilities, security rules, IP lists, filter nodes, users, integrations, and triggers. The API is available on both US Cloud and EU Cloud endpoints and uses API token authentication.
  version: 4.0.0
  termsOfService: https://www.wallarm.com/terms-of-service
  contact:
    name: Wallarm Support
    url: https://docs.wallarm.com/
    email: support@wallarm.com
  license:
    name: Proprietary
    url: https://www.wallarm.com/terms-of-service
servers:
- url: https://us1.api.wallarm.com
  description: Wallarm US Cloud API
- url: https://api.wallarm.com
  description: Wallarm EU Cloud API
security:
- ApiTokenAuth: []
tags:
- name: Rules
  description: Security rules and virtual patch management
paths:
  /v1/objects/hint:
    post:
      operationId: listRules
      summary: List Security Rules
      description: Retrieve all security rules (hints) configured for the client. Rules include virtual patches, rate limits, and custom detection rules.
      tags:
      - Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObjectQueryRequest'
      responses:
        '200':
          description: List of rules returned successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleListResponse'
        '401':
          description: Unauthorized
  /v1/objects/hint/create:
    post:
      operationId: createRule
      summary: Create Security Rule
      description: Create a new security rule such as a virtual patch to block specific attack vectors on defined path patterns.
      tags:
      - Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRuleRequest'
      responses:
        '200':
          description: Rule created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RuleResponse'
        '400':
          description: Invalid request
        '401':
          description: Unauthorized
  /v1/objects/hint/delete:
    post:
      operationId: deleteRule
      summary: Delete Security Rule
      description: Delete an existing security rule by its ID.
      tags:
      - Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteRuleRequest'
      responses:
        '200':
          description: Rule deleted successfully
        '401':
          description: Unauthorized
        '404':
          description: Rule not found
  /v1/objects/action:
    post:
      operationId: listRuleConditions
      summary: List Rule Conditions
      description: Retrieve the conditions associated with configured security rules.
      tags:
      - Rules
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ObjectQueryRequest'
      responses:
        '200':
          description: Rule conditions returned successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActionListResponse'
        '401':
          description: Unauthorized
components:
  schemas:
    RuleListResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          type: array
          items:
            $ref: '#/components/schemas/Rule'
    CreateRuleRequest:
      type: object
      required:
      - type
      - action
      properties:
        clientid:
          type: integer
          description: Client ID
        type:
          type: string
          description: Rule type (vpatch, regex, etc.)
        action:
          type: array
          description: Rule conditions (domain, path, application)
          items:
            type: object
        point:
          type: array
          description: Attack vector specification
        enabled:
          type: boolean
          default: true
    Rule:
      type: object
      properties:
        id:
          type: integer
          description: Rule identifier
        type:
          type: string
          description: Rule type (vpatch, regex, etc.)
        action:
          type: object
          description: Rule conditions and scope
        point:
          type: array
          description: Attack point specification
        enabled:
          type: boolean
          description: Whether the rule is currently active
        created:
          type: integer
          description: Unix timestamp of rule creation
    DeleteRuleRequest:
      type: object
      required:
      - id
      - clientid
      properties:
        id:
          type: integer
          description: Rule ID to delete
        clientid:
          type: integer
          description: Client ID
    ObjectQueryRequest:
      type: object
      properties:
        clientid:
          type: integer
          description: Client ID
        filter:
          type: object
          description: Filter criteria
        limit:
          type: integer
          default: 50
          description: Maximum number of results to return
        offset:
          type: integer
          default: 0
          description: Pagination offset
        order_by:
          type: string
          description: Field to sort results by
        order_desc:
          type: boolean
          default: true
          description: Sort in descending order
    RuleResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          $ref: '#/components/schemas/Rule'
    ActionListResponse:
      type: object
      properties:
        status:
          type: integer
        body:
          type: array
          items:
            type: object
  securitySchemes:
    ApiTokenAuth:
      type: apiKey
      in: header
      name: X-WallarmApi-Token
      description: API token obtained from Wallarm Console under Settings → API Tokens.