Add a custom web application firewall rule to a service. Custom rules run in order before the OWASP rules, while the service's WAF is on. It goes last in the list.
API key access: full.
apiKeyAuthorizationBearer <pyo_…>An API key from the dashboard's API keys page: Authorization: Bearer pyo_…. Keys can expire, and an expired one gets a 401.
application/jsonAdd a custom web application firewall rule to a service. Custom rules run in order before the OWASP rules, while the service's WAF is on. It goes last in the list.
API key access: full.
op*"addWafRule""addWafRule"id*stringA new id you choose: wfr_ then 4 to 40 lowercase letters, digits, dashes or underscores.
serviceId*stringname*stringUp to 80 characters. Findings show it.
match*string"all" (every condition must match) or "any" (one is enough).
conditions*array<>1 to 10 tests on the request.
action*string"block" (403), "log", "allow" (skips later rules and the OWASP rules) or "skipOwasp" (later custom rules still run).
enabled?booleanDone. Always ok: true, and some operations add more, such as a new API key or a join command. A warning comes with a change that went through but won't fully take effect yet, such as more replicas than the servers have room for.
application/jsoncurl -X POST 'https://your-pyo.example.com/api/v1/ops' \
-H 'Content-Type: application/json' \
-d '{
"action": "block",
"conditions": [],
"id": "wfr_8kq2x7ad",
"match": "all",
"name": "web",
"op": "addWafRule",
"serviceId": "svc_8kq2x7ad"
}'{}