swagger: '2.0' info: version: 2020-08-01-preview title: Microsoft Azure AccessControlClient AccessConnector WebApplicationFirewallPolicies API schemes: - https tags: - name: WebApplicationFirewallPolicies paths: ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/cdnWebApplicationFirewallPolicies : get: tags: - WebApplicationFirewallPolicies description: Lists all of the protection policies within a resource group. operationId: microsoftAzurePoliciesList parameters: - $ref: '#/parameters/ResourceGroupNameParameter' - $ref: '#/parameters/subscriptionIdParameter' - $ref: '#/parameters/apiVersionParameter' responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicyList' default: description: Error response describing why the operation failed. schema: $ref: ./cdn.json#/definitions/ErrorResponse x-ms-pageable: nextLinkName: nextLink x-ms-examples: List Policies in a Resource Group: $ref: ./examples/WafListPolicies.json summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Cdn Cdnwebapplicationfirewallpolicies ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/cdnWebApplicationFirewallPolicies/{policyName} : get: tags: - WebApplicationFirewallPolicies description: Retrieve protection policy with specified name within a resource group. operationId: microsoftAzurePoliciesGet parameters: - $ref: '#/parameters/ResourceGroupNameParameter' - $ref: '#/parameters/PolicyNameParameter' - $ref: '#/parameters/subscriptionIdParameter' - $ref: '#/parameters/apiVersionParameter' responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' default: description: Error response describing why the operation failed. schema: $ref: ./cdn.json#/definitions/ErrorResponse x-ms-examples: Get Policy: $ref: ./examples/WafPolicyGet.json summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Cdn Cdnwebapplicationfirewallpolicies Policyname put: tags: - WebApplicationFirewallPolicies description: Create or update policy with specified rule set name within a resource group. operationId: microsoftAzurePoliciesCreateorupdate parameters: - $ref: '#/parameters/ResourceGroupNameParameter' - $ref: '#/parameters/PolicyNameParameter' - $ref: '#/parameters/subscriptionIdParameter' - $ref: '#/parameters/apiVersionParameter' - description: Policy to be created. in: body name: cdnWebApplicationFirewallPolicy required: true schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' '201': description: Created. The request has been fulfilled and a new protection policy has been created. schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' '202': description: Accepted. The request has been accepted for processing and the operation will complete asynchronously. headers: location: type: string schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' default: description: Error response describing why the operation failed. schema: $ref: ./cdn.json#/definitions/ErrorResponse x-ms-examples: Creates specific policy: $ref: ./examples/WafPolicyCreateOrUpdate.json x-ms-long-running-operation: true summary: Microsoft Azure Put Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Cdn Cdnwebapplicationfirewallpolicies Policyname patch: tags: - WebApplicationFirewallPolicies description: Update an existing CdnWebApplicationFirewallPolicy with the specified policy name under the specified subscription and resource group operationId: microsoftAzurePoliciesUpdate parameters: - $ref: '#/parameters/ResourceGroupNameParameter' - $ref: '#/parameters/PolicyNameParameter' - $ref: '#/parameters/subscriptionIdParameter' - $ref: '#/parameters/apiVersionParameter' - description: CdnWebApplicationFirewallPolicy parameters to be patched. in: body name: cdnWebApplicationFirewallPolicyPatchParameters required: true schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicyPatchParameters' responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' '202': description: Accepted. The request has been accepted for processing and the operation will complete asynchronously. headers: location: type: string schema: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' default: description: Error response describing why the operation failed. schema: $ref: ./cdn.json#/definitions/ErrorResponse x-ms-examples: Creates specific policy: $ref: ./examples/WafPatchPolicy.json x-ms-long-running-operation: true summary: Microsoft Azure Patch Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Cdn Cdnwebapplicationfirewallpolicies Policyname delete: tags: - WebApplicationFirewallPolicies description: Deletes Policy operationId: microsoftAzurePoliciesDelete parameters: - $ref: '#/parameters/ResourceGroupNameParameter' - $ref: '#/parameters/PolicyNameParameter' - $ref: '#/parameters/subscriptionIdParameter' - $ref: '#/parameters/apiVersionParameter' responses: '200': description: Delete successful. '204': description: No Content. The request has been accepted but the policy was not found. default: description: Error response describing why the operation failed. schema: $ref: ./cdn.json#/definitions/ErrorResponse x-ms-examples: Delete protection policy: $ref: ./examples/WafPolicyDelete.json x-ms-long-running-operation: false summary: Microsoft Azure Delete Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Cdn Cdnwebapplicationfirewallpolicies Policyname ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies : get: tags: - WebApplicationFirewallPolicies description: Lists all of the protection policies within a resource group. operationId: microsoftAzureWebapplicationfirewallpoliciesList x-ms-examples: Lists all WAF policies in a resource group: $ref: ./examples/WafListPolicies.json parameters: - name: resourceGroupName in: path required: true type: string description: The name of the resource group. - $ref: ./network.json#/parameters/SubscriptionIdParameter - $ref: ./network.json#/parameters/ApiVersionParameter responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/WebApplicationFirewallPolicyListResult' default: description: Error response describing why the operation failed. schema: $ref: ./network.json#/definitions/CloudError x-ms-pageable: nextLinkName: nextLink summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Network Applicationgatewaywebapplicationfirewallpolicies /subscriptions/{subscriptionId}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies: get: tags: - WebApplicationFirewallPolicies description: Gets all the WAF policies in a subscription. operationId: microsoftAzureWebapplicationfirewallpoliciesListall x-ms-examples: Lists all WAF policies in a subscription: $ref: ./examples/WafListAllPolicies.json parameters: - $ref: ./network.json#/parameters/SubscriptionIdParameter - $ref: ./network.json#/parameters/ApiVersionParameter responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/WebApplicationFirewallPolicyListResult' default: description: Error response describing why the operation failed. schema: $ref: ./network.json#/definitions/CloudError x-ms-pageable: nextLinkName: nextLink summary: Microsoft Azure Get Subscriptions Subscriptionid Providers Microsoft Network Applicationgatewaywebapplicationfirewallpolicies ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/{policyName} : get: tags: - WebApplicationFirewallPolicies description: Retrieve protection policy with specified name within a resource group. operationId: microsoftAzureWebapplicationfirewallpoliciesGet x-ms-examples: Gets a WAF policy within a resource group: $ref: ./examples/WafPolicyGet.json parameters: - name: resourceGroupName in: path required: true type: string description: The name of the resource group. - name: policyName in: path required: true type: string maxLength: 128 description: The name of the policy. - $ref: ./network.json#/parameters/SubscriptionIdParameter - $ref: ./network.json#/parameters/ApiVersionParameter responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/WebApplicationFirewallPolicy' default: description: Error response describing why the operation failed. schema: $ref: ./network.json#/definitions/CloudError summary: Microsoft Azure Get Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Network Applicationgatewaywebapplicationfirewallpolicies Policyname put: tags: - WebApplicationFirewallPolicies description: Creates or update policy with specified rule set name within a resource group. operationId: microsoftAzureWebapplicationfirewallpoliciesCreateorupdate x-ms-examples: Creates or updates a WAF policy within a resource group: $ref: ./examples/WafPolicyCreateOrUpdate.json parameters: - name: resourceGroupName in: path required: true type: string description: The name of the resource group. - name: policyName in: path required: true type: string maxLength: 128 description: The name of the policy. - $ref: ./network.json#/parameters/SubscriptionIdParameter - description: Policy to be created. in: body name: parameters required: true schema: $ref: '#/definitions/WebApplicationFirewallPolicy' - $ref: ./network.json#/parameters/ApiVersionParameter responses: '200': description: OK. The request has succeeded. schema: $ref: '#/definitions/WebApplicationFirewallPolicy' '201': description: Created. The request has been fulfilled and a new protection policy has been created. schema: $ref: '#/definitions/WebApplicationFirewallPolicy' default: description: Error response describing why the operation failed. schema: $ref: ./network.json#/definitions/CloudError summary: Microsoft Azure Put Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Network Applicationgatewaywebapplicationfirewallpolicies Policyname delete: tags: - WebApplicationFirewallPolicies description: Deletes Policy. operationId: microsoftAzureWebapplicationfirewallpoliciesDelete x-ms-examples: Deletes a WAF policy within a resource group: $ref: ./examples/WafPolicyDelete.json parameters: - name: resourceGroupName in: path required: true type: string description: The name of the resource group. - name: policyName in: path required: true type: string maxLength: 128 description: The name of the policy. - $ref: ./network.json#/parameters/SubscriptionIdParameter - $ref: ./network.json#/parameters/ApiVersionParameter responses: '200': description: Delete successful. '202': description: Accepted. The request has been accepted for processing and the operation will complete asynchronously. '204': description: No Content. The request has been accepted but the policy was not found. default: description: Error response describing why the operation failed. schema: $ref: ./network.json#/definitions/CloudError x-ms-long-running-operation: true x-ms-long-running-operation-options: final-state-via: location summary: Microsoft Azure Delete Subscriptions Subscriptionid Resourcegroups Resourcegroupname Providers Microsoft Network Applicationgatewaywebapplicationfirewallpolicies Policyname definitions: ManagedRuleSet: type: object description: Defines a managed rule set. required: - ruleSetType - ruleSetVersion properties: ruleSetType: description: Defines the rule set type to use. type: string ruleSetVersion: description: Defines the version of the rule set to use. type: string anomalyScore: description: 'Verizon only : If the rule set supports anomaly detection mode, this describes the threshold for blocking requests.' type: integer format: int32 maximum: 20 exclusiveMaximum: false minimum: 0 exclusiveMinimum: false ruleGroupOverrides: description: Defines the rule overrides to apply to the rule set. type: array items: $ref: '#/definitions/ManagedRuleGroupOverride' x-ms-identifiers: - ruleGroupName CdnWebApplicationFirewallPolicyList: description: Defines a list of WebApplicationFirewallPolicies for Azure CDN. It contains a list of WebApplicationFirewallPolicy objects and a URL link to get the next set of results. properties: value: type: array readOnly: true items: $ref: '#/definitions/CdnWebApplicationFirewallPolicy' description: List of Azure CDN WebApplicationFirewallPolicies within a resource group. nextLink: type: string description: URL to get the next set of WebApplicationFirewallPolicy objects if there are any. ExclusionManagedRuleGroup: type: object description: Defines a managed rule group to use for exclusion. required: - ruleGroupName properties: ruleGroupName: description: The managed rule group for exclusion. type: string rules: description: List of rules that will be excluded. If none specified, all rules in the group will be excluded. type: array items: $ref: '#/definitions/ExclusionManagedRule' WebApplicationFirewallCustomRule: description: Defines contents of a web application rule. required: - priority - ruleType - matchConditions - action properties: name: type: string description: The name of the resource that is unique within a policy. This name can be used to access the resource. maxLength: 128 etag: type: string readOnly: true description: A unique read-only string that changes whenever the resource is updated. priority: description: Priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. type: integer state: description: Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified. type: string enum: - Disabled - Enabled x-ms-enum: name: WebApplicationFirewallState modelAsString: true rateLimitDuration: type: string description: Duration over which Rate Limit policy will be applied. Applies only when ruleType is RateLimitRule. enum: - OneMin - FiveMins x-ms-enum: name: ApplicationGatewayFirewallRateLimitDuration modelAsString: true rateLimitThreshold: description: Rate Limit threshold to apply in case ruleType is RateLimitRule. Must be greater than or equal to 1 type: integer format: int32 ruleType: description: The rule type. type: string enum: - MatchRule - RateLimitRule - Invalid x-ms-enum: name: WebApplicationFirewallRuleType modelAsString: true matchConditions: description: List of match conditions. type: array items: $ref: '#/definitions/MatchCondition_2' groupByUserSession: description: List of user session identifier group by clauses. type: array x-ms-identifiers: [] items: $ref: '#/definitions/GroupByUserSession' action: description: Type of Actions. type: string enum: - Allow - Block - Log - JSChallenge x-ms-enum: name: WebApplicationFirewallAction modelAsString: true MatchCondition_2: description: Define match conditions. required: - matchVariables - operator - matchValues properties: matchVariables: description: List of match variables. type: array items: $ref: '#/definitions/MatchVariable' operator: description: The operator to be matched. type: string enum: - IPMatch - Equal - Contains - LessThan - GreaterThan - LessThanOrEqual - GreaterThanOrEqual - BeginsWith - EndsWith - Regex - GeoMatch - Any x-ms-enum: name: WebApplicationFirewallOperator modelAsString: true negationConditon: description: Whether this is negate condition or not. type: boolean matchValues: description: Match value. type: array items: type: string transforms: description: List of transforms. type: array items: $ref: '#/definitions/Transform' ManagedRuleOverride: description: Defines a managed rule group override setting. required: - ruleId properties: ruleId: description: Identifier for the managed rule. type: string enabledState: description: Describes if the managed rule is in enabled or disabled state. Defaults to Disabled if not specified. type: string enum: - Disabled - Enabled x-ms-enum: name: ManagedRuleEnabledState modelAsString: true action: description: Describes the override action to be applied when rule matches. $ref: '#/definitions/ActionType' ManagedRuleSetList: description: Defines the list of managed rule sets for the policy. properties: managedRuleSets: description: List of rule sets. type: array items: $ref: '#/definitions/ManagedRuleSet' x-ms-identifiers: - ruleSetType - ruleSetVersion RateLimitRule: description: Defines a rate limiting rule that can be included in a waf policy type: object required: - rateLimitThreshold - rateLimitDurationInMinutes properties: rateLimitThreshold: description: Defines rate limit threshold. type: integer format: int32 minimum: 0 exclusiveMinimum: false rateLimitDurationInMinutes: description: Defines rate limit duration. Default is 1 minute. type: integer format: int32 maximum: 60 exclusiveMaximum: false minimum: 0 exclusiveMinimum: false allOf: - $ref: '#/definitions/CustomRule' PolicySettings: description: Defines contents of a web application firewall global configuration. properties: state: description: The state of the policy. type: string enum: - Disabled - Enabled x-ms-enum: name: WebApplicationFirewallEnabledState modelAsString: true mode: description: The mode of the policy. type: string enum: - Prevention - Detection x-ms-enum: name: WebApplicationFirewallMode modelAsString: true requestBodyCheck: type: boolean description: Whether to allow WAF to check request Body. requestBodyInspectLimitInKB: type: integer format: int32 description: Max inspection limit in KB for request body inspection for WAF. requestBodyEnforcement: type: boolean default: true description: Whether allow WAF to enforce request body limits. maxRequestBodySizeInKb: type: integer format: int32 minimum: 8 exclusiveMinimum: false description: Maximum request body size in Kb for WAF. fileUploadEnforcement: type: boolean default: true description: Whether allow WAF to enforce file upload limits. fileUploadLimitInMb: type: integer format: int32 minimum: 0 exclusiveMinimum: false description: Maximum file upload size in Mb for WAF. customBlockResponseStatusCode: description: If the action type is block, customer can override the response status code. type: integer format: int32 minimum: 0 customBlockResponseBody: description: If the action type is block, customer can override the response body. The body must be specified in base64 encoding. type: string pattern: ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ maxLength: 32768 logScrubbing: description: To scrub sensitive log fields type: object properties: state: type: string description: State of the log scrubbing config. Default value is Enabled. enum: - Disabled - Enabled x-ms-enum: name: WebApplicationFirewallScrubbingState modelAsString: true scrubbingRules: type: array items: $ref: '#/definitions/WebApplicationFirewallScrubbingRules' x-ms-identifiers: [] description: The rules that are applied to the logs for scrubbing. jsChallengeCookieExpirationInMins: description: Web Application Firewall JavaScript Challenge Cookie Expiration time in minutes. type: integer format: int32 minimum: 5 maximum: 1440 CdnEndpoint: description: Defines the ARM Resource ID for the linked endpoints type: object readOnly: true properties: id: type: string description: ARM Resource ID string. WebApplicationFirewallPolicyListResult: description: Result of the request to list WebApplicationFirewallPolicies. It contains a list of WebApplicationFirewallPolicy objects and a URL link to get the next set of results. properties: value: type: array readOnly: true items: $ref: '#/definitions/WebApplicationFirewallPolicy' description: List of WebApplicationFirewallPolicies within a resource group. nextLink: readOnly: true type: string description: URL to get the next set of WebApplicationFirewallPolicy objects if there are any. ManagedRuleSet_2: type: object description: Defines a managed rule set. required: - ruleSetType - ruleSetVersion properties: ruleSetType: description: Defines the rule set type to use. type: string ruleSetVersion: description: Defines the version of the rule set to use. type: string ruleGroupOverrides: description: Defines the rule group overrides to apply to the rule set. type: array items: $ref: '#/definitions/ManagedRuleGroupOverride_2' CustomRuleList: description: Defines contents of custom rules properties: rules: description: List of rules type: array items: $ref: '#/definitions/CustomRule' x-ms-identifiers: - name OwaspCrsExclusionEntry: required: - matchVariable - selectorMatchOperator - selector description: Allow to exclude some variable satisfy the condition for the WAF check. properties: matchVariable: type: string enum: - RequestHeaderNames - RequestCookieNames - RequestArgNames - RequestHeaderKeys - RequestHeaderValues - RequestCookieKeys - RequestCookieValues - RequestArgKeys - RequestArgValues description: The variable to be excluded. x-ms-enum: name: OwaspCrsExclusionEntryMatchVariable modelAsString: true selectorMatchOperator: type: string enum: - Equals - Contains - StartsWith - EndsWith - EqualsAny description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this exclusion applies to. x-ms-enum: name: OwaspCrsExclusionEntrySelectorMatchOperator modelAsString: true selector: type: string description: When matchVariable is a collection, operator used to specify which elements in the collection this exclusion applies to. exclusionManagedRuleSets: type: array items: $ref: '#/definitions/ExclusionManagedRuleSet' description: The managed rule sets that are associated with the exclusion. ActionType_2: description: Defines the action to take on rule match. type: string enum: - AnomalyScoring - Allow - Block - Log - JSChallenge x-ms-enum: name: ActionType modelAsString: true ManagedRulesDefinition: description: Allow to exclude some variable satisfy the condition for the WAF check. required: - managedRuleSets properties: exclusions: type: array items: $ref: '#/definitions/OwaspCrsExclusionEntry' description: The Exclusions that are applied on the policy. managedRuleSets: type: array items: $ref: '#/definitions/ManagedRuleSet_2' description: The managed rule sets that are associated with the policy. ActionType: description: Defines the action to take on rule match. type: string enum: - Allow - Block - Log - Redirect x-ms-enum: name: ActionType modelAsString: true ManagedRuleGroupOverride_2: type: object description: Defines a managed rule group override setting. required: - ruleGroupName properties: ruleGroupName: description: The managed rule group to override. type: string rules: description: List of rules that will be disabled. If none specified, all rules in the group will be disabled. type: array items: $ref: '#/definitions/ManagedRuleOverride_2' CustomRule: description: Defines the common attributes for a custom rule that can be included in a waf policy type: object required: - name - priority - matchConditions - action properties: name: description: Defines the name of the custom rule type: string enabledState: description: Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified. type: string enum: - Disabled - Enabled x-ms-enum: name: CustomRuleEnabledState modelAsString: true priority: description: Defines in what order this rule be evaluated in the overall list of custom rules type: integer format: int32 maximum: 1000 exclusiveMaximum: false minimum: 0 exclusiveMinimum: false matchConditions: description: List of match conditions. type: array items: $ref: '#/definitions/MatchCondition' x-ms-identifiers: [] action: description: Describes what action to be applied when rule matches $ref: '#/definitions/ActionType' MatchCondition: description: Define match conditions required: - matchVariable - operator - matchValue properties: matchVariable: description: Match variable to compare against. type: string enum: - RemoteAddr - SocketAddr - RequestMethod - RequestHeader - RequestUri - QueryString - RequestBody - Cookies - PostArgs x-ms-enum: name: WafMatchVariable modelAsString: true selector: description: Selector can used to match a specific key for QueryString, Cookies, RequestHeader or PostArgs. type: string operator: description: Describes operator to be matched type: string enum: - Any - IPMatch - GeoMatch - Equal - Contains - LessThan - GreaterThan - LessThanOrEqual - GreaterThanOrEqual - BeginsWith - EndsWith - RegEx x-ms-enum: name: operator modelAsString: true negateCondition: description: Describes if the result of this condition should be negated. type: boolean matchValue: description: List of possible match values. type: array items: type: string transforms: description: List of transforms. type: array items: $ref: '#/definitions/TransformType' CdnWebApplicationFirewallPolicyProperties: description: Defines CDN web application firewall policy properties. properties: policySettings: description: Describes policySettings for policy $ref: '#/definitions/policySettings' rateLimitRules: description: Describes rate limit rules inside the policy. $ref: '#/definitions/RateLimitRuleList' customRules: description: Describes custom rules inside the policy. $ref: '#/definitions/CustomRuleList' managedRules: description: Describes managed rules inside the policy. $ref: '#/definitions/ManagedRuleSetList' endpointLinks: description: Describes Azure CDN endpoints associated with this Web Application Firewall policy. type: array readOnly: true items: $ref: '#/definitions/CdnEndpoint' extendedProperties: description: Key-Value pair representing additional properties for Web Application Firewall policy. type: object additionalProperties: type: string provisioningState: readOnly: true type: string description: Provisioning state of the WebApplicationFirewallPolicy. enum: - Creating - Succeeded - Failed x-ms-enum: name: ProvisioningState modelAsString: true resourceState: title: Resource status of the policy. readOnly: true enum: - Creating - Enabling - Enabled - Disabling - Disabled - Deleting type: string x-ms-enum: name: PolicyResourceState modelAsString: true WebApplicationFirewallPolicyPropertiesFormat: description: Defines web application firewall policy properties. required: - managedRules properties: policySettings: description: The PolicySettings for policy. $ref: '#/definitions/PolicySettings' customRules: description: The custom rules inside the policy. type: array items: $ref: '#/definitions/WebApplicationFirewallCustomRule' applicationGateways: readOnly: true type: array items: $ref: ./applicationGateway.json#/definitions/ApplicationGateway description: A collection of references to application gateways. provisioningState: readOnly: true $ref: ./network.json#/definitions/ProvisioningState description: The provisioning state of the web application firewall policy resource. resourceState: title: Resource status of the policy. readOnly: true type: string description: Resource status of the policy. enum: - Creating - Enabling - Enabled - Disabling - Disabled - Deleting x-ms-enum: name: WebApplicationFirewallPolicyResourceState modelAsString: true managedRules: description: Describes the managedRules structure. $ref: '#/definitions/ManagedRulesDefinition' httpListeners: readOnly: true type: array items: $ref: ./network.json#/definitions/SubResource description: A collection of references to application gateway http listeners. pathBasedRules: readOnly: true type: array items: $ref: ./network.json#/definitions/SubResource description: A collection of references to application gateway path rules. ManagedRuleGroupOverride: description: Defines a managed rule group override setting. required: - ruleGroupName properties: ruleGroupName: description: Describes the managed rule group within the rule set to override type: string rules: description: List of rules that will be enabled. If none specified, all rules in the group will be disabled. type: array items: $ref: '#/definitions/ManagedRuleOverride' x-ms-identifiers: - ruleId RateLimitRuleList: description: Defines contents of rate limit rules properties: rules: description: List of rules type: array items: $ref: '#/definitions/RateLimitRule' x-ms-identifiers: - name ManagedRuleOverride_2: type: object description: Defines a managed rule group override setting. required: - ruleId properties: ruleId: description: Identifier for the managed rule. type: string state: description: The state of the managed rule. Defaults to Disabled if not specified. type: string enum: - Disabled - Enabled x-ms-enum: name: ManagedRuleEnabledState modelAsString: true action: description: Describes the override action to be applied when rule matches. $ref: '#/definitions/ActionType_2' policySettings: description: Defines contents of a web application firewall global configuration properties: enabledState: description: describes if the policy is in enabled state or disabled state type: string enum: - Disabled - Enabled x-ms-enum: name: PolicyEnabledState modelAsString: true mode: description: Describes if it is in detection mode or prevention mode at policy level. type: string enum: - Prevention - Detection x-ms-enum: name: PolicyMode modelAsString: true defaultRedirectUrl: description: If action type is redirect, this field represents the default redirect URL for the client. type: string defaultCustomBlockResponseStatusCode: description: If the action type is block, this field defines the default customer overridable http response status code. type: integer format: int32 enum: - 200 - 403 - 405 - 406 - 429 defaultCustomBlockResponseBody: description: If the action type is block, customer can override the response body. The body must be specified in base64 encoding. type: string pattern: ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$ GroupByVariable: type: object description: Define user session group by clause variables. required: - variableName properties: variableName: description: User Session clause variable. type: string enum: - ClientAddr - GeoLocation - None x-ms-enum: name: ApplicationGatewayFirewallUserSessionVariable modelAsString: true ExclusionManagedRule: type: object description: Defines a managed rule to use for exclusion. required: - ruleId properties: ruleId: description: Identifier for the managed rule. type: string CdnWebApplicationFirewallPolicyPatchParameters: type: object description: Properties required to update a CdnWebApplicationFirewallPolicy. properties: tags: description: CdnWebApplicationFirewallPolicy tags type: object additionalProperties: type: string x-ms-azure-resource: true GroupByUserSession: type: object description: Define user session identifier group by clauses. required: - groupByVariables properties: groupByVariables: description: List of group by clause variables. type: array x-ms-identifiers: [] items: $ref: '#/definitions/GroupByVariable' ExclusionManagedRuleSet: type: object description: Defines a managed rule set for Exclusions. required: - ruleSetType - ruleSetVersion properties: ruleSetType: description: Defines the rule set type to use. type: string ruleSetVersion: description: Defines the version of the rule set to use. type: string ruleGroups: description: Defines the rule groups to apply to the rule set. type: array items: $ref: '#/definitions/ExclusionManagedRuleGroup' MatchVariable: description: Define match variables. required: - variableName properties: variableName: description: Match Variable. type: string enum: - RemoteAddr - RequestMethod - QueryString - PostArgs - RequestUri - RequestHeaders - RequestBody - RequestCookies x-ms-enum: name: WebApplicationFirewallMatchVariable modelAsString: true selector: description: The selector of match variable. type: string WebApplicationFirewallScrubbingRules: description: Allow certain variables to be scrubbed on WAF logs type: object required: - matchVariable - selectorMatchOperator properties: matchVariable: type: string enum: - RequestHeaderNames - RequestCookieNames - RequestArgNames - RequestPostArgNames - RequestJSONArgNames - RequestIPAddress description: The variable to be scrubbed from the logs. x-ms-enum: name: scrubbingRuleEntryMatchVariable modelAsString: true selectorMatchOperator: type: string enum: - Equals - EqualsAny description: When matchVariable is a collection, operate on the selector to specify which elements in the collection this rule applies to. x-ms-enum: name: ' scrubbingRuleEntryMatchOperator' modelAsString: true selector: type: string description: When matchVariable is a collection, operator used to specify which elements in the collection this rule applies to. state: type: string enum: - Enabled - Disabled description: Defines the state of log scrubbing rule. Default value is Enabled. x-ms-enum: name: ' scrubbingRuleEntryState' modelAsString: true TransformType: description: Describes what transforms were applied before matching. type: string enum: - Lowercase - Uppercase - Trim - UrlDecode - UrlEncode - RemoveNulls x-ms-enum: name: TransformType modelAsString: true CdnWebApplicationFirewallPolicy: description: Defines web application firewall policy for Azure CDN. properties: properties: x-ms-client-flatten: true description: Properties of the web application firewall policy. $ref: '#/definitions/CdnWebApplicationFirewallPolicyProperties' etag: type: string description: Gets a unique read-only string that changes whenever the resource is updated. sku: description: The pricing tier (defines a CDN provider, feature list and rate) of the CdnWebApplicationFirewallPolicy. $ref: ./cdn.json#/definitions/Sku required: - sku allOf: - $ref: ./cdn.json#/definitions/TrackedResource WebApplicationFirewallPolicy: description: Defines web application firewall policy. properties: properties: x-ms-client-flatten: true $ref: '#/definitions/WebApplicationFirewallPolicyPropertiesFormat' description: Properties of the web application firewall policy. etag: readOnly: true type: string description: A unique read-only string that changes whenever the resource is updated. allOf: - $ref: ./network.json#/definitions/Resource Transform: description: Transforms applied before matching. type: string enum: - Uppercase - Lowercase - Trim - UrlDecode - UrlEncode - RemoveNulls - HtmlEntityDecode x-ms-enum: name: WebApplicationFirewallTransform modelAsString: true parameters: ResourceGroupNameParameter: name: resourceGroupName in: path required: true type: string pattern: ^[a-zA-Z0-9_\-\(\)\.]*[^\.]$ minLength: 1 maxLength: 80 x-ms-parameter-location: method description: Name of the Resource group within the Azure subscription. PolicyNameParameter: name: policyName in: path required: true type: string maxLength: 128 x-ms-parameter-location: method description: The name of the CdnWebApplicationFirewallPolicy. apiVersionParameter: name: api-version in: query required: true type: string description: Version of the API to be used with the client request. Current version is 2023-05-01. subscriptionIdParameter: name: subscriptionId in: path description: Azure Subscription ID. required: true type: string x-ms-parameterized-host: hostTemplate: '{endpoint}' useSchemePrefix: false parameters: - $ref: '#/parameters/Endpoint'