Cloud WAF Service

REST API USER GUIDE

Document Version 3.2
January 2022
TABLE OF CONTENTS
INTRODUCTION ........................................................................................................................................... 7
REST API OVERVIEW ................................................................................................................................. 7
Radware Cloud WAF REST API ........................................................................................................... 7
General Request Structure .................................................................................................................... 7
General Response Structure ................................................................................................................. 8
REST Response Codes ........................................................................................................................ 8
Error Handling ....................................................................................................................................... 9
REST API USAGE PREPARATION .......................................................................................................... 10
Creating an API User in Cloud WAF ................................................................................................... 10
Managing an API User .............................................................................................................. 13
Authentication and Authorization......................................................................................................... 14
Getting the Session Token ........................................................................................................ 14
Getting the Authorization Token ............................................................................................... 15
Obtaining Your Tenant ID .................................................................................................................... 18
NEW APPLICATION ONBOARDING ........................................................................................................ 20
Add a Certificate .................................................................................................................................. 20
Add an Application .............................................................................................................................. 21
Add an Application—Request ................................................................................................... 21
Add an Application—Response ................................................................................................ 23
Check Your Application Status ............................................................................................................ 23
Check Application Status—Request ......................................................................................... 23
Check Application Deployment Status—Response .................................................................. 24
List Applications................................................................................................................................... 24
List Applications—Request ....................................................................................................... 24
List Applications—Response .................................................................................................... 25
DNS Configuration .............................................................................................................................. 29
Retrieve DNS Settings—Request ............................................................................................. 29
Retrieve DNS Settings—Response .......................................................................................... 29
Retrieve DNS Settings—Update your DNS Server .................................................................. 31
CERTIFICATE MANAGEMENT ................................................................................................................. 32
Add a Certificate .................................................................................................................................. 32
Add a Certificate—Request....................................................................................................... 32
Add a Certificate—Response .................................................................................................... 34

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 2
 Get the List of Account Certificates ..................................................................................................... 35
Get the List of Account Certificates—Request.......................................................................... 35
Get the List of Account Certificates—Response ....................................................................... 35
Bind a Certificate to an Application ..................................................................................................... 36
Bind a Certificate to an Application—Request .......................................................................... 36
Bind a Certificate to an Application—Response ....................................................................... 37
Unbind a Certificate from an Application ............................................................................................. 37
Delete a Certificate .............................................................................................................................. 37
Delete a Certificate—Request................................................................................................... 37
Delete a Certificate—Response ................................................................................................ 37
ACCOUNT MANAGEMENT ....................................................................................................................... 38
Get User Activity Log List .................................................................................................................... 38
Get User Activity Log List—Request ......................................................................................... 38
Get User Activity Log List—Response ...................................................................................... 39
Get Users List ...................................................................................................................................... 40
Get Users—Request ................................................................................................................. 40
Get Users List—Response........................................................................................................ 41
Add a User........................................................................................................................................... 42
Add a User—Request ............................................................................................................... 42
Add a User—Response ............................................................................................................ 43
Update a User ..................................................................................................................................... 43
Update a User—Request .......................................................................................................... 43
Update a User—Response ....................................................................................................... 44
Delete a User....................................................................................................................................... 44
Delete a User—Request ........................................................................................................... 44
Delete a User—Response ........................................................................................................ 45
RETRIEVING DASHBOARD DATA ........................................................................................................... 46
Get Security Events Statistics over Time ............................................................................................ 46
Get Security Events Statistics over Time—Request ................................................................. 46
Get Security Events Statistics over Time—Response .............................................................. 47
Get Security Events Statistics by Source Geolocation ....................................................................... 51
Get Security Events Statistics by Source Geolocation Request ............................................... 51
Get Security Events Statistics by Source Geographical Location—Response ........................ 52
Get Transactions Statistics over Time................................................................................................. 54
Get Transactions Statistics over Time—Request ..................................................................... 54

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 3
 Get Transactions Statistics over Time—Response .................................................................. 56
SECURITY EVENTS MANAGEMENT ....................................................................................................... 59
Get Security Events List ...................................................................................................................... 59
Get Security Events List—Request ........................................................................................... 59
Get Security Events List—Response ........................................................................................ 61
Additional Example Requests: .................................................................................................. 63
Refine a Security Policy Based on an Event ....................................................................................... 65
Refine a Security Policy Based on an Event—Request ........................................................... 65
Refine a Security Policy Based on an Event—Response......................................................... 65
CONFIGURE APPLICATION SETTINGS .................................................................................................. 66
Get Application Access Rules ............................................................................................................. 66
Get Application Access Rules—Request .................................................................................. 66
Get Application Access Rules—Response ............................................................................... 66
Set Application Access Rules .............................................................................................................. 67
Set Application Access Rules—Request .................................................................................. 67
Set Application Access Rules—Response ............................................................................... 68
Get Application AllowList Refinements and State ............................................................................... 69
Get Application AllowList Refinements—Request .................................................................... 69
Get Application AllowList Refinements—Response ................................................................. 70
Set Application AllowList Module State ............................................................................................... 71
Set Application AllowList Module State—Request ................................................................... 71
Set Application AllowList Module State—Response ................................................................. 72
Set Application AllowList Refinements ................................................................................................ 72
Set Application AllowList Refinements—Request..................................................................... 72
Set Application AllowList Refinements—Response .................................................................. 74
Get Application Vulnerabilities Refinements and State ....................................................................... 74
Get Application Vulnerabilities Refinements and State—Request ........................................... 74
Get Application Vulnerabilities Refinements and State—Response ........................................ 75
Set Application Vulnerabilities Module State ....................................................................................... 76
Set Application Vulnerabilities Module State—Request ........................................................... 76
Set Application Vulnerabilities Module State—Response ........................................................ 77
Set Application Vulnerabilities Refinements ........................................................................................ 77
Set Application Vulnerabilities Refinements—Request ............................................................ 77
Set Application Vulnerabilities Refinements—Response ......................................................... 79
Get Application Database Module State ............................................................................................. 80

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 4
 Get Application Database Module State—Request .................................................................. 80
Get Application Database Module State—Response ............................................................... 80
Set Application Database Module State .............................................................................................. 80
Set Application Database Module State—Request .................................................................. 80
Set Application Database Module State—Response ............................................................... 81
Get Application Security Rules ............................................................................................................ 82
Get Application Security Rules—Request ................................................................................ 82
Get Application Security Rules—Response.............................................................................. 82
Enable All Application Security Rules ................................................................................................. 87
Enable All Application Security Rules—Request ...................................................................... 87
Enable All Application Security Rules—Response ................................................................... 87
Disable All Application Security Rules ................................................................................................ 87
Disable All Application Security Rules—Request ..................................................................... 87
Disable All Application Security Rules—Response .................................................................. 87
Enable Specific Application Security Rules ......................................................................................... 88
Enable Specific Application Rules—Request ........................................................................... 88
Enable Specific Application Rules—Response......................................................................... 88
Disable Specific Application Security Rules ........................................................................................ 88
Disable Specific Application Rules—Request........................................................................... 88
Disable Specific Application Rules—Response ........................................................................ 89
Delete All Application Security Rules .................................................................................................. 89
Delete All Application Security Rules—Request ....................................................................... 89
Delete All Application Security Rules—Response .................................................................... 90
Delete Specific Application Security Rules ......................................................................................... 90
Delete Specific Application Rules—Request ............................................................................ 90
Delete Specific Application Rules—Response ......................................................................... 90
Create New Application Security Rules .............................................................................................. 91
Create New Application Rules—Request ................................................................................. 91
Create New Application Security Rule—Response .................................................................. 95
Update Existing Application Security Rules ........................................................................................ 98
Update Existing Application Rules—Request ........................................................................... 98
Update Existing Application Security Rules—Response ........................................................ 102
Get API Protection Module State ...................................................................................................... 105
Get API Protection Module State—Request ........................................................................... 105
Get API Protection Module State—Response ........................................................................ 105

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 5
 Set API Protection Status .................................................................................................................. 106
Set API Protection Status—Request ...................................................................................... 106
Set API Protection Status—Response .................................................................................... 107
Get API Protection Endpoints............................................................................................................ 107
Get API Protection Endpoints—Request ................................................................................ 107
Get API Protection Endpoints—Response ............................................................................. 108
Get API Discovery Status .................................................................................................................. 112
Get API Discovery Status—Request ...................................................................................... 112
Get API Protection Status—Response ................................................................................... 112
Upload OpenAPI File ......................................................................................................................... 113
Upload OpenAPI File—Request ............................................................................................. 113
Upload OpenAPI File Status—Response ............................................................................... 119
Start and Stop API Discovery ............................................................................................................ 124
Start and Stop API Discovery —Request ............................................................................... 124
Start and Stop API Discovery—Response.............................................................................. 125

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 6
INTRODUCTION
Radware Cloud WAF Service provides customers and partners with the ability to
programmatically perform service-related actions via a RESTful API.
The API can be used to automate application creation and day-to-day management, to retrieve
up-to-date data about the applications, their status as well as and their protection.
This guide will take you through the steps required to set up an API user, and how to use API to
automate your activities.
The document assumes familiarity with Cloud WAF Service portal and user scenarios. It is
highly recommended to review the Cloud WAF Quick Start Guide before reading this document.

REST API OVERVIEW

Radware Cloud WAF REST API
Cloud WAF REST API has the following characteristics:
• REST API is used.
• All API communication is over SSL (requests and responses).
• API communication channel always requires a first step of client authentication and
authorization, after which the client receives a session token that must be used in all
following requests.
• UTF-8 encoding is always used.
For technical support, contact Radware Technical Support at [email protected].

General Request Structure

All API calls to Radware Cloud WAF Services are sent as HTTP requests. The request
parameters are specified through the URL used, URL parameters, HTTP headers and HTTP
Body.
Example:
• Request URL: to create a new application, the following URL is used:
HTTPS://portal.radwarecloud.com/v1/configuration/applications/
• Various HTTP commands are used:
▪ GET—Used to view existing configuration.
▪ POST—Used to create a new entity, or a bind entities.
▪ PUT—Used to update configuration.
▪ DELETE—Used to delete a configuration entity.
• URL parameters are sometimes used, for example, to set order of table entries in the
response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 7
• HTTP Headers are used to provide parameters to the API call.
Commonly used HTTP headers:
▪ Authorization:
o Used to identify the OKTA-authorized session.
o Received through client authorization.
o HTTP Header: Authorization: Bearer {session authorization key as received from
OKTA}.
▪ Requesting entity:
o Identifies the Tenant (account or sub-account) with Cloud WAF.
o Received through client summary command.
o HTTP Header: requestEntityIds: {tenantId}.
Important: For all REST API calls, make sure that you are using the Content-Type
application/json.

General Response Structure

Response content is provided as a JSON document.
Important: After a successful POST command for creating a new resource, the JSON response
includes the new Object ID that was created.

REST Response Codes

The REST API responds to each request with an HTTP response code.
The HTTP standard RFC 2616 is a primary source for a description of error codes.
In addition, the following table provides details of response codes, typical scenarios, and what
information can be expected in the response body:
Name Description
200 OK Command succeeded
400 BAD REQUEST Invalid parameters
401 UNAUTHORIZED User not logged in
403 FORBIDDEN User does not have permission
500 INTERNAL SERVER ERROR Internal error (unsupported or wrong parameters)

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 8
Error Handling
When there is an API call failure, Radware Cloud WAF Services responds with an error
message using the following format:
JSON Parameter Explanation
Severity The severity of the error: LOW, MEDIUM, HIGH, CRITICAL
message Short description of the API exception
description Detailed description of the API exception
requestURI URI that was used the request that failed
stackTrace For internal use
type For internal use
validationFailures Specific fields where the failure occurred (optional)

Example:
{"severity":"HIGH","message":"SSL certificate verification Exceptions","requestURI":"/device-
config-
service/v1/configuration/sslcertificates/secret","type":"com.device.configuration.service.web.ex
ception.certificate.SSLCertificateVerifyException","stackTrace":null,"certificateValidationErrors"
:[{"code":"CERTCHAIN_NOT_TRUSTED","description":"No valid path from certificate #1 in chain
to a trusted root certificate"}]}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 9
REST API USAGE PREPARATION
As a prerequisite to invoking the REST API, the following steps must be performed.

Creating an API User in Cloud WAF

You can create an API user for your account that can be used for API calls.
To add an API user
Login to the portal.
Navigate to Settings > Users, and then, click the + button.
Select the “API” radio button.
Set the User ID field, using an email format, for example, [email protected].

Note: The user ID does not need to be a real existing email address, it is just using email
format.
Save the new User entry.
An API user is created in a state of 'Pending Activation' and his role is Basic-User.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 10
 The user that created the API User receives an e-mail invitation to access the Radware
Cloud WAF Services portal.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 11
 After clicking SET API PASSWORD, you are redirected to Radware Cloud WAF and
required to set password of the user.

Notes:
▪ If you were logged in the Radware Cloud WAF Portal, you will be logged out so you can
set the API User credentials.
▪ As long as password is not set, the API user is in status of Pending Activation.
After the API user is activated, make sure to update Permission Groups for the API user.
If required you can update the Allowed IP Addresses, in order to limit API access from
specific IP addresses only.
The first-time setup procedure is completed. The API user is now ready, you are all set to make
your first API call!
Notes:
• To be able to create users, including API Users, you must have permission group of
administrator or users-administrator
• You can create additional API Users for your organization, to be used for different purpose,
and optionally using different permission groups. Follow the above procedure to create each
API user.
• API user can not login through web UI
• Real Users typically use 2-factor authentication, and should not be used for API calls.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 12
Managing an API User
You can manage the following settings for an API User:
• Lock/unlock API User—Lock the user out of the system, for example, to prevent access in
case of compromised credentials. Alternatively, you can unlock a user who gets locked out of the
system by mistake.
• Reset credentials for an API user—When you rest credentials for an API user, you will
receive an email with a link to rest the password for this user.
Note: Available only for users that have been activated.
• Re-invite—Resend an e-mail invitation to the e-mail address of a user who was invited to
access the portal but did not complete the activation.
Note: Available only for users which are Pending Activation.
• Allowed IP addresses—Set allowed source IP addresses that can be used for this API
user.
• Membership tab—Set API User Permission Groups.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 13
Authentication and Authorization
Before you can do any API communication with Cloud WAF, you must first open the
communication channel for the API User to be used. This is done using the following steps:
1. Getting the Session Token
a. Send a Client Authentication request to Radware Cloud WAF.
b. The response includes a dynamic session token that should be used throughout the
session. The session token is expired if there is no communication for 1 day (idle
timeout).
2. Getting the Authorization Token
a. Send a Client Authorization request to Radware Cloud WAF.
b. The response provides the data access token, which is required for the rest of the API
communication.

Getting the Session Token

Client Authentication (login) is required to get the Session Token.

Client Authentication Request

HTTP Request
HTTP Method POST
URL https://radware-public.okta.com/api/v1/authn
Request body {
"username":"[email protected]",
"password":"1qaz!QAZ",
"options": {
"multiOptionalFactorEnroll": true,
"warnBeforePasswordExpired": true
}
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 14
Client Authentication Response
If the login was successful, an HTTP 200 OK response is sent along with the following
information:
JSON Code
{
"expiresAt":"2018-08-08T13:37:47.000Z",
"status":"SUCCESS",
"sessionToken":"20111x9hyMoU1QoCFwwMifkRKfKHeWzd285RuONfdN-5apxRQU1tVrG",
"_embedded":{
"user":{
"id":"00ufvxyhcueaOy2z00h9",
"passwordChanged":"2018-08-08T00:19:27.000Z",
"profile":{
"login":"[email protected]",
"firstName":"api",
"lastName":"user ",
"locale":"en",
"timeZone":"America/Los_Angeles"}
}
}
}
The sessionToken is required for further processing, in the OKTA Authorization API.

Getting the Authorization Token

Once the authentication is completed, you need to authorize the client, and to receive an
identifier for this session.
This request authenticates the user and returns tokens along with an authorization grant to the
client application as a part of the callback response.

Client Authorization Request

HTTP Request
HTTP Method GET

URL https://radware-
public.okta.com/oauth2/aus7ky2d5wXwflK5N1t7/v1/authorize
Always use aus7ky2d5wXwflK5N1t7. It identifies the authorization server of
Radware Cloud WAF.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 15
 HTTP Request
Parameters, sent client_id=M1Bx6MXpRXqsv3M1JKa6 Client identification in OKTA,
as URL must match the value
Parameters preregistered in Okta.

nonce=n-0S6_WzA2M A value that will be returned

in the ID token. It is used to
mitigate replay attacks

prompt=none Set to ‘none’

redirect_uri= Callback location where the
https%3A%2F%2Ffanyv88.com%3A443%2Fhttps%2Fportal.radwarecloud authorization code or tokens
.com should be sent. It must match
the value preregistered in
OKTA during client
registration.
Always set to
https://portal.radwarecloud.c
om.
response_mode=form_post How the authorization
response should be returned.
response_type=token Set to ‘token ‘
scope=api_scope Set to ‘api_scope’
sessionToken={{sessionToken}} sessionToken value taken
from Client Authentication
step above.
state=af0ifjsldkj A value to be returned in the
token.

Client Authorization Full URLS Example

https://radware-
public.okta.com/oauth2/aus7ky2d5wXwflK5N1t7/v1/authorize?client_id=M1
Bx6MXpRXqsv3M1JKa6&nonce=n-
0S6_WzA2M&prompt=none&redirect_uri=https://portal.radwarecloud.com&re
sponse_mode=form_post&response_type=token&scope=api_scope&sessionToke
n= 20111x9hyMoU1QoCFwwMifkRKfKHeWzd285RuONfdN-
5apxRQU1tVrG&state=af0ifjsldkj

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 16
Client Authorization Response
If the authorization is successful, the access token will be returned as an html with form
elements.
The contents of the response are as described in the below table.
Client Authorization Response Parameters
access_token The Session Identifier. This is the Authorization Token required for any
further communication with Radware Cloud WAF Portal, referred to as
Bearer {{JWT}}, or Bearer {Session Identifier}.
In subsequent API calls, this would look like “Authorization: Bearer
{{JWT}}”, where JWT is Json Web Token, and means the data access
token should be used, as received here.
This is returned if response_type includes a token.
Error Error-code (if something went wrong).
error_description Description of the error.
expires_in Number of seconds until the access_token expires.
This is only returned if the response included an access_token.
Scope Scopes specified in the access_token.
Returned only if the response includes an access_token.
State The unmodified state value from the request.
token_type The token type is always Bearer and is returned only when token is
specified as a response_type.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 17
Client Authorization Success Response Example
<html>
...
<body>
<form id="appForm" method="post" name="oauthResponse"
action="https&#x3a;&#x2f;&#x2f;portal.radwarecloud.com">
<input type="hidden" name="state" value="af0ifjsldkj"/>
<input type="hidden" name="access_token" value="JWT.some-long-value"/>
<input type="hidden" name="token_type" value="Bearer"/>
<input type="hidden" name="expires_in" value="86400"/>
<input type="hidden" name="scope" value="api_scope"/>
</form>
</body>
</html>

Client Authorization Failure Response Example

<html>
...
<body>
<form id="appForm" method="post" name="oauthResponse"
action="https&#x3a;&#x2f;&#x2f;portal.radwarecloud.com">
<input type="hidden" name="state" value="af0ifjsldkj"/>
<input type="hidden" name="error" value="invalid_scope"/>
<input type="hidden" name="error_description"
value="One&#x20;or&#x20;more&#x20;scopes&#x20;are&#x20;not&#x20;configured&#x20;for&#x20;the
&#x20;authorization&#x20;server&#x20;resource."/>
</form>
</body>
</html>

Obtaining Your Tenant ID

Tenant ID represents the customer ID within Radware Cloud WAF Portal. It is required for any
API communication that provides customer related data and added to each request under the
requestEntityId header.

Obtaining Tenant ID—Request

To find tenant ID, use the following API command:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 18
 HTTP Request
HTTP Method GET
URL https://portal.radwarecloud.com/v1/users/me/summary
Request authorization: Bearer Session header String
Parameters identifier

Obtaining Tenant ID—Request Example

GET https://portal.radwarecloud.com/v1/users/me/summary
Accept: application/json, text/plain, */*
Authorization: Bearer {session identifier}

Obtaining Tenant ID—Response

Response data model includes various user parameters, including tenantEntityId, which is of
type string.

Obtaining Tenant ID—Response Example

tenantEntityId: "bf9e84be-f6he-48fd-947e-3b9760c69580"

Note: Within the entire response (JSON), fetch the record UserDetailsSummary to get the
record with the tenantEntityId data.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 19
NEW APPLICATION ONBOARDING
An Application is a logical entity in Radware Cloud WAF Services that protects your domains
against Web application and DDoS attacks. This section describes the API calls that can be
used to onboard a new protected application, and to manage existing applications.
The API-based application-onboarding process includes the following steps:
# Step Description Activity
1 Add a certificate Relevant for HTTPS API call to add certificate
applications.
2. Add an application Provides application parameters API call to add an application
and pointing to the certificates (if
applicable).
Once set, the setup for
protecting your application is
built within Radware Cloud WAF
Services.
3. Application is API call to check application
Provisioned state
4. Divert the application To go through Cloud WAF PoPs, API call to retrieve DNS
traffic by updating the DNS server Settings
settings.
5. Your application is Your application is now API call to check state of
now protected! protected against both Web application is Protecting
Application attacks and DDoS
attacks.

Add a Certificate
The first step before onboarding an HTTPS application is to upload a certificate to Cloud WAF
Portal.
To add a new certificate, please refer to the Add Certificate section under Certificate
Management.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 20
If your application only requires HTTP, you may skip the following steps and continue directly to
Add an application.

Add an Application
Add an Application—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/
Request authorization: Bearer Session header String
Parameters identifier
requestEntityIds tenantEntityId header String
applicationConfigurati Details of the Body Model
onRequest application
configuration

applicationConfigurationRequest Model
{
applicationId (string, optional), Unique ID for your application within Cloud
WAF. Required for any further API calls
regarding this application.
applicationName (string, optional), Descriptive name for your application, within
Cloud WAF
fingerprint (string, optional), For HTTP applications, leave empty.
For HTTPS applications, use the fingerprint as
received from certificate upload.
mainDomain (string, optional), The main domain that Radware WAF Service is
protecting, for example, www.mydomain.com.
originServers (Array[ServerAddress], optional), Only a single origin server can be used in app
creation, additional servers can be added later.
protocol (string, optional) Protocol supported for your application.
Available values: HTTP, HTTPS, or BOTH
region (string, optional) Radware WAF Service deploy a setup for your
Application at this location.
It is recommended to select a region that is
closest to the origin server location.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 21
 applicationConfigurationRequest Model
Available values:
'ANZ_1'
'ASIA_CENTRALEAST_1'
'ASIA_NORTHEAST_1'
'ASIA_SOUTHEAST_1'
'ASIA_SOUTHWEST_1'
'EU_CENTRAL_1'
'EU_WEST_1'
'ME_1'
'US_CENTRAL_1'
'US_EAST_1'
'US_WEST_1'
'SA_EAST_1'
'AZ_US_EAST_1'
securityPolicy (SecurityPolicy, optional)
}
ServerAddress {
addressType (string, optional) = ['IP', 'FQDN'] Available values:
'IP'
'FQDN'
address (string, optional), IP address or FQDN of your origin server, for
example, 1.2.3.4.
Note: at application creation time, only one IP
address can be set for origin servers. You can
then update the application origin servers.
}
SecurityPolicy {
protectionMode (string, optional) = Always set to 'LEARNING_BASED'
technology (string, optional) Not required
}
After you configure your application, the application goes into the in the Provisioning state. This
process typically takes a few minutes, but may take up to a few hours to complete. When the
application is in the Provisioning state, you cannot update the Application parameters.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 22
Example:
POST https://portal.radwarecloud.com/v1/configuration/applications/
authorization: Bearer {session Identifier}
requestEntityIds: bf9e84be-f6he-48fd-947e-3b9760c69580

applicationConfigurationRequest{
"applicationName":"TestApp","mainDomain":"www.test.com","fingerprint":
“B4D0984C074F2C60593883DAEA6ABF460625B507”,"originServers":[{"address":"1.2.3.4","add
ressType":"IP"}],"protocol":"BOTH","region":"US_EAST_1","securityPolicy":{"protectionMode":"L
EARNING_BASED"}}

Add an Application—Response
When the application creation was successful, the portal will return an HTTP 200 OK response.
The response includes multiple configuration models that reflect the full configuration details of
the created application.

Check Your Application Status

Check Application Status—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}

Request applicationId Application Path String

Parameters Identifier
authorization: Bearer Session header String
identifier

requestEntityIds tenantEntityId header String

Example:
GET https://portal.radwarecloud.com/v1/gms/applications/4781b64a-8317-486e-87e8-
04551bb8c13a

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 23
Check Application Deployment Status—Response
The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter deploymentStatus in the record ApplicationConfiguration indicates the
application status.
Values of Deployment Status Description
'PROVISIONING' The setup for protecting your application is in progress,
being built within Radware Cloud Services.
'LEARNING' The setup for protecting your application is ready!
It is time to do the DNS redirection and divert your
application traffic to Radware Cloud Services. See DNS
configuration to determine the IP address to be used.
'PROTECTING' When learning period is over, Policy review is done by
Radware ERT experts, and the application state is
changed to Protecting.
Your application is now protected!

List Applications
Get a list of all applications associated with the account.

List Applications—Request
To get a list of all applications associated with an account use the following REST call:

HTTP GET
Method
URL https://portal.radwarecloud.com/v1/gms/applications
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String

Example:
GET https://portal.radwarecloud.com/v1/gms/applications/
authorization: Bearer {session Identifier}
requestEntityIds: bf9e84be-f6he-48fd-947e-3b9760c69580

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 24
List Applications—Response
Upon successful request of list of applications, a 200 OK response code is returned along with
the applications information.
The response is using the JSON format and contains the following fields.
Application list data fields
Pagination data Includes pagination information for the list of
applications. By default, the number of
applications per page is 200
Application ID
Application Name
Deployment Status “Provisioning”, “Learning”, “Protecting”
Network Settings Various application network settings such as the
IP addresses and ports of the application, TLS
version, etc.
Security Settings Protection state information and refinements

Example:
{

"number": 0,

"size": 200,

"totalPages": 1,

"numberOfElements": 1,

"totalElements": 1,

"previousPage": false,

"first": true,
"nextPage": false,

"last": true,

"content": [{

"id": "1a08ee22-63e7-4eb7-b73c-16e05b5301ae",

"name": "test.com",

"deploymentStatus": "LEARNING",

"creationDate": 1555244980278,

"featuresData": {

"wafFeatureData": {

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 25
 "protocol": {

"protocolType": "Redirect",

"httpProtocol": null,

"httpsProtocol": {

"frontEndPort": 443,

"backEndPort": 443,

"interval": 30,

"uri": "/",

"responseCode": 200,

"hostName": "test.com",

"successCriteria": "HTTP",
"fingerprint": "ABCDEFDGHIJKLMNOPQRSTUVWYZ"

},

"dns": {

"dnsRecords": [{

"type": "CNAME",

"value": "test-com.acme.radwarecloud.net"

}, {

"type": "A",

"value": "10.11.12.13"

},

"operationMode": {

"mode": "LOAD_BALANCE",
"failoverMode": null,

"loadBalanceMode": {

"serverAddresses": [{

"addressType": "IP",

"address": "1.2.3.4"

],

"loadBalanceMetric": "ROUND_ROBIN"

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 26
 }

},

"mainDomain": {

"mainDomain": "www.test.com"

},

"ipRange": ["10.11.12.13"],

"sourceIpHeader": null,

"accessRules": {

"accessRules": []

},

"accessControlList": {
"accessControlListItems": [],

"defaultOperation": "PERMIT"

},

"securityPolicy": {

"protectionMode": "LEARNING_BASED",

"technology": null

},

"region": "US_EAST_1",

"blockPage": {

"url": null

},

"protectionConfiguration": {

"allowedFileExtensionProtection": {

"protectionStatus": "PASSIVE",

"allowList": {
"allowListItems": []

},

"knownAttackTypesProtection": {

"protectionStatus": "PASSIVE"

},

"httpProtocolComplianceProtection": {

"protectionStatus": "ACTIVE"

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 27
 },

"ddosProtection": {

"protectionStatus": "ACTIVE"

},

"ipReputationProtection": {

"protectionStatus": "DISABLE"

},

"vulnerabilityProtection": {

"protectionStatus": "PASSIVE",

"vulnerabilityList": {

"vulnerabilityItems": []
}

},

"databaseProtection": {

"protectionStatus": "PASSIVE",

"databaseList": {

"databaseItems": []

},

},

},

"applicationSecuritySettings": {

"cipherSuite": {

"name": "Compatible",

"ciphers": ["ALL", "!NULL", "!aNULL", "!EXPORT", "!RSA", "!RC4"],

"defaultSet": true,

"systemSet": true

},

"useDefaultCipherSuite": true,

"securityProtocolSet": {

"ssl30": false,

"tls10": true,

"tls11": true,

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 28
 "tls12": true,

"defaultSet": true

},

"useDefaultProtocolSet": true

},

"certificate": null

DNS Configuration
Once the application is fully provisioned, you can obtain the application settings that allow you
to provision your DNS environment (A records or CNAME).
This is using the same command as Checking Application Deployment Status, looking at a
different parameter in the response, which includes the required data only once the application
is provisioned.

Retrieve DNS Settings—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Retrieve DNS Settings—Response

The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter dns section in the response provides the DNS settings you should apply to your
DNS.
DNSConfiguration Model
{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 29
 DNSConfiguration Model
dnsRecords (Array[DNSRecord], optional)
}
DNSRecord { Typical response would have two entries like
this, one for the A record and one for CNAME.
type (string, optional) Each entry displays the required DNS
value (string, optional) configuration:
When Type is A, the value specifies the IP
address to be used in an A record for the DNS
Settings for your application domain
When type is CNAME, the value specifies the
name to be used in the DNS CNAME entry for
your domain
}

Example:
"dnsConfiguration":
{
"dnsRecords": [
{
"type": "A",
"value": "94.188.200.100"
},
{
"type": "CNAME",
"value": "mydomain.radwarecloud.net"
}
]
}

Note: Within the entire response (JSON), fetch the record dnsConfiguration.dnsRecords
to get the record with the CNAME type and the records with A type.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 30
Retrieve DNS Settings—Update your DNS Server
To complete the setup, configure your name servers to point to Radware Cloud WAF Services
by creating or updating the record of your main domain as set for this application, and optionally
additional domains you want to be protected.
• If your application is using a subdomain, for example, mydomain.com, set the DNS using a
CNAME record according to the CNAME entry in the response. The example here is
"mydomain.radwarecloud.net".
• If your application is using a root domain that need to be routed through Radware Cloud
WAF Services, for example, www.mydomain.com, set the DNS using an A record, using the
IP address in the entry of type A in the response. The example here is using
94.188.200.100.
Note: The response may include multiple A record entries. In such cases, create multiple A
entries.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 31
CERTIFICATE MANAGEMENT
The following API calls are used to manage certificates in the Cloud Services Portal.

Add a Certificate
Add a Certificate—Request
To upload a certificate to Radware Cloud use the following REST call:

HTTP Method POST

URL https://portal.radwarecloud.com/v1/configuration/sslcertificates/secret
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
sslCertificateData Data of SSL certificate of Body Model
your HTTPS application, to
be uploaded to Radware
Cloud.

sslCertificateData Model
{
"certificate": "string", The certificate in PEM format
"chain": "string", The certificate chain in PEM format
"key": "string", The key in PEM format.
"passphrase": "string"
}

Example:
{"certificate":"-----BEGIN CERTIFICATE-----
\nMIIEczCCA1ugAwIBAgIEWjxDHjANBgkqhkiG9w0BAQsFADBpMRkwFwYDVQQDDBAq\nLnJhZ
HdhcmVsYWJzLmNhMQswCQYDVQQGEwJDQTELMAkGA1UECAwCUUMxDDAKBgNV\nBAcMA0
1UTDEQMA4GA1UECgwHUmFkd2FyZTESMBAGA1UECwwJU0UgQ2FuYWRhMB4X\nDTE4MDEx
NTE5MTUxOVoXDTE5MDExNTE5MTUxOVowaTEZMBcGA1UEAwwQKi5yYWR3\nYXJlbGFicy5jY
TELMAkGA1UEBhMCQ0ExCzAJBgNVBAgMAlFDMQwwCgYDVQQHDANN\nVEwxEDAOBgNVBAo
MB1JhZHdhcmUxEjAQBgNVBAsMCVNFIENhbmFkYTCCASIwDQYJ\nKoZIhvcNAQEBBQADggEPA
DCCAQoCggEBAKtc9GvMu122K7utl59VGpbXxQt91Kr4\nqY6ZUS5XKngF/loANbFI6MkaXZOfZ+
wG7UV6jTwAams2Ge7D7VVxH2icteOV0WG6\npWpHtEf0Sz4udztAUrrm85V6fDT61cIzZ0BQoY
HnMAyLqArfu617HgBHtoo1Rnql\n04laYnk8TNi7ETQRBN1Blzlq6j76SbnSSo5/6m03wd5HR7uN

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 32
Hq8Es1jZxZDjzrt1\n7BF9DnUWFMACwiaABxDMwC3D4y8zlV7zubvlTi/g+bFYxYJEWKgBaQbE8a
SmpVlw\nE4nS7/Vr5aDDzJJDxUHQA3gJuTT2otzuKJ3dfTGDqlAAnWk6bh51MAUCAwEAAaOC\n
ASEwggEdMA8GA1UdEwEB/wQFMAMBAf8wEQYJYIZIAYb4QgEBBAQDAgJEMDIGCWCG\nSAGG
+EIBDQQlFiNBbHRlb24vTm9ydGVsIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAd\nBgNVHQ4EFgQU
Gg3rn4gSPa4glPTCahw1XRH8BT0wgZYGA1UdIwSBjjCBi4AUGg3r\nn4gSPa4glPTCahw1XRH8BT
2hbaRrMGkxGTAXBgNVBAMMECoucmFkd2FyZWxhYnMu\nY2ExCzAJBgNVBAYTAkNBMQswCQ
YDVQQIDAJRQzEMMAoGA1UEBwwDTVRMMRAwDgYD\nVQQKDAdSYWR3YXJlMRIwEAYDVQQL
DAlTRSBDYW5hZGGCBFo8Qx4wCwYDVR0PBAQD\nAgLsMA0GCSqGSIb3DQEBCwUAA4IBAQBY
N6U4EtnqYaotjK955FzmmDoJEPjlJb2y\n2GAZAIIW4doVE1/7fgbhavlHbgjIrf9MiU0KrNGUyJ79JA
Y4D24fvhJC37CVAIWo\nxK16dSsRm6d8TULkVTs9nQ21NQyEEkldM0IssNU+M0i4OFzJsHEHWs
L6/RWnN7WE\nsHmJBoLEl58MnolhicepvZ8tyNO/9H6iiC0XY9tudy+3m/Ik4Nxuv+urQZPOBL3l
\nP686jzKUmSRT10IaV1/jsNy+JYy8RCTjj/GJuuszM7J9j96JAGz9nqRNbXx9d+jW\nE+cE16WiDd
34ZUujNQTttI57kQsUITh0EfKozX3X0Jj58sc2MxHl\n-----END CERTIFICATE-----
","chain":"","key":"-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nDEK-Info:
DES-EDE3-
CBC,3A85493EB7B9880A\n\njMl9Ur6Yvugx74Eu+Wiikf3r/ocghUR3XE1L3VbvWRLO2ntDvoLdj
4xz/phsbtLT\n2g9Uq637vb00y6rDnuGVogzdZq3FYwjjUFsadF5IuYuGZWXwYDVa1PWdlxMbKO
vP\nAo02J5Guz09jL+ip/knRLvsM4RxXNNrw79QAxlEU7bQiz07BMVVRg+SATfXyatza\nG4UiZw
THb3M201rsFlEBSkP9nQ2UrdfJwTZjZSUucWhwBNeVJj/LOTS3YichB3fp\nxhCj4D0qNRWrTtjME
NgtScqTcbz561f7NZ2y4gDV6jJJp6gHvby5SiUNEGeWNaST\nKCynWszL/pLoBryO9d64VP11X9id
cZ5DBr9KQytb3iuFZYQWc8DE2OI2sVWa3kQ1\nViI0uZyhzpHdpOWHk/AEAGsvLHpHB/NAi2ud
zWiZhTdznVNl5vrQnq78RsQCVEyY\nT+zNv1eINOon94U6bSPmcSkFEH6yRZIp1jbssXZvGOfwuu
VUenbu24RrY6KkF/tS\n6stUTCEsPKIw3yMxtHIByEATVLZ38ZgquWsLvG9RhmnVLHcXlqzD+LQ
oTBaY/HNX\nD4c2zYzopkP+uqPRcM4pklfyj3zW6YeM+kzgIwHrEuJyjqw3jbtRGFVrxSB+IB4p\n
bxMhxlq0PeJSzSVdLNVmicXLETEedkUqaUjv+8qooblI1DIrYyHJkfJxO4wKV2gi\nuVD9scZglNxcdij
dP9Jxe4Cwn4lbLdz0X7OyyeB0c9YD5Wp2L6lEtWR89uReqFI5\nFvvCJMIkYm/8KEPK7r9nyf9hN
4D1JqQKNLX7clVuOoli6Uh67iWPvA5MIEPMiso5\nbfjLw0J0qsCJgFLiUSj08pFX8YuTxWhxMIZZ5
ni3Vds/AENsSMkzskfj7mqA7yR4\nHNW9S6vR7EOIyFc78RFMj9u9ITHoeH3NB6nnrchC9lHPmK
YBblNZI1aboZfNL1iS\nm6gMinhE4HPhXbumsIoLM7M8pzmGmNC+TFbiU7j7Tg+4c0Hw6EZ+sd
1MLtOUmVGX\nt7g9aIhwAACCYo4A6B6kd4NjhtympLevBcprsXf4wfEd0BTy+UHCz2+FpaG4WU
Q9\nejT48JLi4YkpGYNCfVyZhlfh/Z6vm/7JCxVXeqDjq68EK0NK9ad+mSzW6F1r7kew\ntUEsjOG
SS1PecXQNUYjPT0AewsiRZho/uKySZiWFRf6LpoXBOXI20hA1TWNCeIPL\nOkBK2M1CJYshrtKB
T2JyC84NXmD6lGBCtBVJpz40ZzIkRTdbXSI9UECGSI+UHofm\nMG2bQnAxXELFzAjl7uYiaD+7wRi
HQ61pN8ZQ/M6yfQ8aQzpauUzx0mUvZdARJ5nq\naDCx0aXYQkjDc5A2ycz6jD6twoyF+9ymHQol
rL+O035twUZQJw6ctg5vDZn0Pq2R\nUKRO6S/5mudFDF07WjSP1ejUAHOqGLx+M21AxzVkzw6
ZS4ufVmz99NlqdAmLPszf\nLG+JljdVfHdSy8bgw24mYJd+NttsAwvr8xGq3dkmZOgf+bQG++fEK0
XCJpDMBWiH\noYA9Muivn7AkUMrradZOPlaxGpXdcrVgWdQJbbetK1tY9xiOYpOY/w==\n-----
END RSA PRIVATE KEY-----","passphrase":"test"}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 33
Add a Certificate—Response
Upon successful creation of a certificate, a 200 OK response code is returned along with the
certificate information, containing all the certificate properties.
The response is using the SSLCertificateApplicationsSummary Model.
SSLCertificateApplicationsSummary Model
{
applications (Array[SSLApplication], optional), Used to bind the certificate to existing
application, empty in this use case.
certificateChain (string, optional), The certificate chain as was sent in the
certificate upload request.
creationDate (string, optional), Creation date.
email (string, optional),
fingerprint (string, optional), The fingerprint for this certificate in Radware
Cloud.
This fingerprint should be used later to bind
the certificate to an application upon
application creation.
issuer (string, optional), Data taken from the uploaded certificate.
keySize (string, optional),
protectedDomains (string, optional),
selfSigned (boolean, optional),
validFrom (string, optional),
validTo (string, optional)
}
SSLApplication { Array used to indicate applications bound to
applicationName (string, optional), this certificate.

applicationUUID (string, optional)

}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 34
Example:
{"fingerprint":"B4D0984C074F2C60593793DAEA6ABF460625B507","issuer":"OU=SE
Canada,O=Radware,L=MTL,ST=QC,C=CA,CN=*.radwarelabs.ca","validFrom":1516043719000,"val
idTo":1547579719000,"certificateChain":"","protectedDomains":"*.radwarelabs.ca","keySize"
:"2048","email":null,"creationDate":1524154442023,"applications":null,"selfSigned":true}

Get the List of Account Certificates

Get the List of Account Certificates—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/configuration/sslcertificates/
Request Parameters authorization: Bearer Session header String
identifier
requestEntityIds tenantEntityId header String

Example:
GET https://portal.radwarecloud.com/v1/configuration/sslcertificates/

Get the List of Account Certificates—Response

The portal returns an HTTP 200 OK response including list of account certificates and the
application information that is bounded to the certificates.
Example:
[
{
"applications": [
{
"applicationName": "string",
"applicationUUID": "string"
}
],
"certificateChain": "string",
"certificateType": "REGULAR",
"creationDate": "2019-04-17T08:33:04.156Z",
"email": "string",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 35
 "fingerprint": "string",
"issuer": "string",
"keySize": "string",
"protectedDomains": "string",
"validFrom": "2019-04-17T08:33:04.156Z",
"validTo": "2019-04-17T08:33:04.156Z"
}
]

Bind a Certificate to an Application

Bind a Certificate to an Application—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/sslcertificates/{fingerprint}/
applications
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
fingerprint Certificate fingerprint request Integer
Target applications A JSON containing list of Body String
applications that will be bounded
to the certificate which can be
found in the Get certificates
response.

Example:
POST
https://portal.radwarecloud.com/v1/configuration/sslcertificates/{fingerprint}/applications
[
{
"applicationName": "string",
"applicationUUID": "string"
}
]

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 36
Bind a Certificate to an Application—Response
The portal returns an HTTP 200 OK response including application information that is bounded
to the certificate.
Example:
[
{
"applicationName": "string",
"applicationUUID": "string"
}
]

Unbind a Certificate from an Application

To unbind a certificate from application, invoke the Bind Certificate API call and send an empty
JSON in the request body.

Delete a Certificate

Delete a Certificate—Request

HTTP DELETE
Method
URL https://portal.radwarecloud.com/v1/configuration/sslcertificates/{fingerprint}
Request authorization: Bearer Session header String
Parameters identifier
requestEntityIds tenantEntityId header String
fingerprint Certificate request Integer
fingerprint

Example:
DELETE https://portal.radwarecloud.com/v1/configuration/sslcertificates/{fingerprint}

Delete a Certificate—Response
The portal returns an HTTP 200 OK response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 37
ACCOUNT MANAGEMENT
The account management APIs allows you to view, search, and manage account settings and
information such as the User Activity Log.

Get User Activity Log List

Get User Activity Log List—Request

HTTP Method POST

URL https://portal.radwarecloud.com/v1/userActivityLogs/reports/
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
Content-Length 12345 header Integer
activityLogFilter Model A JSON containing filter Body String
parameters to include or
exclude user activity log
entries in the response

activityLogFilter Model
Criteria The criteria upon which to include or exclude the
user activity log entries in the response.
Valid filters: TimeFilter, Status, Text Search
Pagination Page number and the number of records per
page. Maximum page size 200.
Order The order in which to return the results. You can
sort the results by ascending or descending order
by the fields mentioned above.

Example:
POST https://portal.radwarecloud.com/v1/userActivityLogs/reports/

{
"order":[{
"type":"Order",
"order":"DESC",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 38
 "field":"startDate"
}],
"pagination":{
"size":100,
"page":0
},
"criteria":[
{
"type":"fullTextSearchFilter",
"inverseFilter":false,
"fields":["trackingId","processTypeText","userEmail"],
"searchText":"admin"
},
{
"type":"termFilter",
"field":"status",
"value":"SUCCESS"
},
{
"type":"timeFilter",
"field":"startDate",
"includeLower":true,
"includeUpper":true,
"upper":1582052522960,
"lower":1581966122960
}
]
}

Get User Activity Log List—Response

The portal returns an HTTP 200 OK response including multiple user activity log entries.
Example:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 39
{
"userActivityLogs":[
{
"trackingId":"937561fc-a8c1-8c14-c52c-252d6c29e112",
"startDate":1582051448147,
"userEmail":"[email protected]",
"processTypeText":"updated the Allow list for Application app1 , Event ID:
6582713272",
"status":"SUCCESS",
"referenceId":"ADXJmqD3AZZ4h5LB2dVa",
"activityType":"Refine"
}
],
"metaData":{
"totalHits":"1"
}
}

Get Users List

Get Users—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/users
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
limit The number of user query Integer
entries to return
after The start number of the query integer
users in the list, used for
pagination
search A search string to filter to query string,
results by email address optional

Example:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 40
 GET https://portal.radwarecloud.com/v1/users?limit=50&after=0&search=admin

Get Users List—Response

The portal returns an HTTP 200 OK response including multiple user entries.
Example:
[
{
"id":"00u2stlwutrHPxEX81a7",
"username":"[email protected]",
"tenantEntityId":"bf4e27je-f3fe-88fd-910e-3b9660c39520",
"status":"ACTIVE",
"firstName":"Rad",
"lastName":"Ware",
"phoneNumber":"987654321",
"country":"US",
"sessionExpiration":15,
"userType":"REGULAR",
"allowedIps":[],
"tenantType":"Customer"
},
{
"id":"00uejelwc4uBAbTpw1n3",
"username":"[email protected]",
"tenantEntityId":"bf4e27je-f3fe-88fd-910e-3b9660c39520",
"status":"PASSWORD_EXPIRED",
"firstName":"Support",
"lastName":"Radware",
"phoneNumber":null,
"country":"US",
"sessionExpiration":15,
"userType":"REGULAR",
"allowedIps":[],
"tenantType":"Customer"
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 41
]

Add a User
Add a User—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/uesrs
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
UserDetailsRequ Details of the new user Body Model
est configuration

UserDetailsRequest Model
{
username (string, required), Unique ID for the newly created user within
Cloud WAF. Required for any further API calls
regarding this user. The string must be in a
form of an email address.
firstname (string, optional), The first name of the user.
lastname (string, optional), The last name of the user.
country (string, optional), A 2-letter country code of the user. (ISO 3166-
1 alpha-2)
phone (string, optional), The phone number of the user.
}

Example:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 42
 POST https://portal.radwarecloud.com/v1/users
authorization: Bearer {session Identifier}
requestEntityIds: bf9e84be-f6he-48fd-947e-3b9760c69580

UserDetailsRequest
{
“username":"[email protected]”,
"firstName":"user",
"lastName":"admin",
"country":"US",
"phone":"987654321"
}

Add a User—Response
When the user creation was successful, the portal will return an HTTP 200 OK response.

Update a User

Update a User—Request

HTTP PUT
Method
URL https://portal.radwarecloud.com/v1/users/{userID}
Request userID The user ID to be updated, path string
Parameters in base64 format
authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
UserDetailsRequ Details of the new user Body Model
est configuration

UserDetailsRequest Model
{
firstname (string, optional), The first name of the user.
lastname (string, optional), The last name of the user.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 43
 UserDetailsRequest Model
country (string, optional), A 2-letter country code of the user. (ISO 3166-
1 alpha-2)
phone (string, optional), The phone number of the user.
}

Example:
PUT https://portal.radwarecloud.com/v1/users/bsFhd6FZlQJhZHdmUuY29t
authorization: Bearer {session Identifier}
requestEntityIds: bf9e84be-f6he-48fd-947e-3b9760c69580

UserDetailsRequest
{
"firstName":"user",
"lastName":"admin",
"country":"US",
"phone":"987654321"
}

Update a User—Response
When the user update was successful, the portal will return an HTTP 200 OK response.

Delete a User

Delete a User—Request

HTTP DELETE
Method
URL https://portal.radwarecloud.com/v1/users/{userID}
Request userID The user ID to be deleted, in path string
Parameters base64 format
authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 44
Delete a User—Response
When the user creation was successful, the portal will return an HTTP 200 OK response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 45
RETRIEVING DASHBOARD DATA
The following include API calls to retrieve statistical data to build dashboard components and
graphs.

Get Security Events Statistics over Time

Get Security Events Statistics over Time—Request

HTTP Method POST

URL https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
Content-Length 12345 header Integer
Statistics parameters A JSON containing filter Body String
parameters to include
or exclude events
statistics in the
response

Example:
POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS

{
"order": [{
"type": "Order",
"order": "ASC",
"field": "date"
}
],
"aggregation": {
"type": "dateHistogram",
"aggName": "date",
"aggField": "receivedTimeStamp",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 46
 "criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555459250765,
"lower": 1554854450765
}
],
"aggregation": {
"type": "groupBy",
"aggName": "severity",
"aggField": "severity",
"aggregation": {
"type": "calculation",
"metrices": [{
"type": "count"
}
]
}
},
"timeInterval": {
"dateFraction": "DAY",
"amount": 1
}
}
}

Get Security Events Statistics over Time—Response

The portal returns an HTTP 200 OK response including timeframes and the number of events
for each timeframe.
Example:
[{
"row": {

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 47
 "date": "1554854400000",
"severity": "High",
"Count": "2681"
}
}, {
"row": {
"date": "1554897600000",
"severity": "High",
"Count": "2893"
}
}, {
"row": {
"date": "1554897600000",
"severity": "Low",
"Count": "1"
}
}, {
"row": {
"date": "1554940800000",
"severity": "High",
"Count": "2887"
}
}, {
"row": {
"date": "1554984000000",
"severity": "High",
"Count": "2886"
}
}, {
"row": {
"date": "1555027200000",
"severity": "High",
"Count": "2898"
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 48
 }, {
"row": {
"date": "1555070400000",
"severity": "High",
"Count": "2887"
}
}, {
"row": {
"date": "1555113600000",
"severity": "High",
"Count": "3084"
}
}, {
"row": {
"date": "1555156800000",
"severity": "High",
"Count": "2886"
}
}, {
"row": {
"date": "1555200000000",
"severity": "High",
"Count": "2875"
}
}, {
"row": {
"date": "1555200000000",
"severity": "Low",
"Count": "1"
}
}, {
"row": {
"date": "1555243200000",
"severity": "High",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 49
 "Count": "1842"
}
}, {
"row": {
"date": "1555286400000",
"severity": "High",
"Count": "2892"
}
}, {
"row": {
"date": "1555286400000",
"severity": "Low",
"Count": "3"
}
}, {
"row": {
"date": "1555329600000",
"severity": "High",
"Count": "2892"
}
}, {
"row": {
"date": "1555372800000",
"severity": "High",
"Count": "2890"
}
}, {
"row": {
"date": "1555372800000",
"severity": "Low",
"Count": "3"
}
}, {
"row": {

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 50
 "date": "1555416000000",
"severity": "High",
"Count": "2899"
}
}, {
"row": {
"date": "1555459200000",
"severity": "High",
"Count": "201"
}
}
]

Get Security Events Statistics by Source Geolocation

Get Security Events Statistics by Source Geolocation Request

HTTP Method POST

URL https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS
Request authorization: Bearer header String
Parameters Session
identifier
requestEntityIds tenantEntityI header String
d
Content-Length 12345 header Integer
Statistics parameters A JSON Body String
containing
filter
parameters to
include or
exclude
events
statistics in
the response

Example:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 51
 POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS

{
"aggregation": {
"type": "groupBy",
"aggName": "countryCode",
"aggField": "enrichmentContainer.geoLocation.countryCode",
"size": 0,
"criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555462588703,
"lower": 1554857788703
}
],
"aggregation": {
"type": "count",
"aggName": "count",
"size": 0
}
}
}

Get Security Events Statistics by Source Geographical Location—Response

The portal returns an HTTP 200 OK response including country codes and the number of
events for each country.
Example:
[{
"row": {
"countryCode": "US",
"Count": "1157"

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 52
 }
}, {
"row": {
"countryCode": "RO",
"Count": "101"
}
}, {
"row": {
"countryCode": "CN",
"Count": "5"
}
}, {
"row": {
"countryCode": "JP",
"Count": "4"
}
}, {
"row": {
"countryCode": "DE",
"Count": "1"
}
}, {
"row": {
"countryCode": "EE",
"Count": "1"
}
}, {
"row": {
"countryCode": "FR",
"Count": "1"
}
}, {
"row": {
"countryCode": "IL",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 53
 "Count": "1"
}
}
]

Get Transactions Statistics over Time

Get Transactions Statistics over Time—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_STATISTICS_REPORTS
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
Content-Length 12345 header Integer
Statistics parameters A JSON containing filter Body String
parameters to include or
exclude events statistics in
the response

Example:
POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_STATISTICS_REPORTS

{
"order": [{
"type": "Order",
"order": "ASC",
"field": "date",
"sortingType": "STRING"
}
],
"aggregation": {
"type": "dateHistogram",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 54
 "aggName": "date",
"aggField": "receivedTimeStamp",
"criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555462889184,
"lower": 1554858089184
}
],
"aggregation": {
"type": "calculation",
"metrices": [{
"type": "sumMetric",
"aggName": "blockedHttpTransactions",
"aggField": "blockedHttpTransactions"
}, {
"type": "sumMetric",
"aggName": "passiveHttpTransactions",
"aggField": "passiveHttpTransactions"
}, {
"type": "sumMetric",
"aggName": "cleanHttpTransactions",
"aggField": "cleanHttpTransactions"
}
]
},
"timeInterval": {
"dateFraction": "HOUR",
"amount": 12
}
}
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 55
Get Transactions Statistics over Time—Response
The portal returns an HTTP 200 OK response including timeframes and the number of
transactions for each timeframe.
Example:
[{
"row": {
"date": "1554854400000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "3"
}
}, {
"row": {
"date": "1554897600000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "2"
}
}, {
"row": {
"date": "1554940800000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "2"
}
}, {
"row": {
"date": "1554984000000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "7"
}
}, {
"row": {

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 56
 "date": "1555027200000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "4"
}
}, {
"row": {
"date": "1555070400000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "2"
}
}, {
"row": {
"date": "1555113600000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "103"
}
}, {
"row": {
"date": "1555156800000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "6"
}
}, {
"row": {
"date": "1555200000000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "1"
}
}, {

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 57
 "row": {
"date": "1555243200000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "0"
}
}, {
"row": {
"date": "1555286400000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "6"
}
}, {
"row": {
"date": "1555329600000",
"blockedHttpTransactions": "1357",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "377"
}
}, {
"row": {
"date": "1555372800000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "32"
}
}, {
"row": {
"date": "1555416000000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "7"
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 58
 }, {
"row": {
"date": "1555459200000",
"blockedHttpTransactions": "0",
"passiveHttpTransactions": "0",
"cleanHttpTransactions": "0"
}
}
]

SECURITY EVENTS MANAGEMENT

The Security Events APIs allows you to view, search, and even refine security policies by
security events.

Get Security Events List

Get Security Events List—Request

HTTP Method POST

URL https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS
Request authorization: Bearer Session identifier header String
Parameters requestEntityIds tenantEntityId header String
Content-Length 12345 header Integer
eventsFilter Model A JSON containing filter Body String
parameters to include or
exclude events in the
response

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 59
 eventsFilter Model
Criteria The criteria by which to include or exclude the
events in the response.
Valid filters: TimeFilter, Event Action, Transaction
ID, Application ID, Host name, Source IP, Source
geo-location, Security violation type, Event
severity, event OWASP category
Pagination Page number and the number of records per
page. Maximum page size 200.
Order The order in which to return the results. You can
sort the results by ascending or descending order
by the above-mentioned fields.

Example:
POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS

{
"criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555459250765,
"lower": 1554854450765
}
],
"pagination": {
"page": 0,
"size": 25
},
"order": [{
"type": "Order",
"order": "DESC",
"field": "receivedTimeStamp",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 60
 "sortingType": "STRING"
}
]
}

Get Security Events List—Response

The portal returns an HTTP 200 OK response including multiple events.
Example:
{
"metaData": {
"totalHits": "32036925"
},
"data": [{
"row": {
"devType": null,
"tunnelListenPort": null,
"sourcePort": "15682",
"refineDate": null,
"transId": "1797177213",
"patternId": null,
"parameterName": null,
"destinationIp": "10.12.13.14",
"paramType": null,
"protocol": "HTTP",
"violationType": "URL Access Violation",
"appwallIP": null,
"host": "test.com",
"action": "Reported",
"details": "AllowList Security Filter intercepted a malicious
request. Users are forbidden to access the requested page.\nMethod: GET.\nNo Src Page:
might be manual hacking attempt !\nAuthenticated as Public\n",
"id": null,
"receivedTimeStamp": "1555459956811",
"ruleId": null,

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 61
 "paramValue": null,
"violationCategory": "Access Control",
"method": "GET",
"module": "AllowList",
"refine": "&#60;Vd&#62;&#60;Id&#62;269;&#60;/Vd&#62;",
"params": null,
"appwallVersion": null,
"originatorIp": "",
"vhost": "&lt;any host&gt;",
"sourceIp": "1.2.3.4",
"vulnData": null,
"appwallTimeStamp": "1555459936529",
"_id": "AWooo2FcFSx7dRoGeJF6",
"destinationPort": "54002",
"request": "GET /login.aspx",
"extension": "*.aspx",
"role": "public",
"description": null,
"paramName": null,
"title": "Access denied due to malicious request",
"appPath": "/login.aspx",
"directory": "/",
"parameterValue": null,
"example": null,
"refineCRC": "3698473375",
"tunnelListenIP": null,
"appwallHostName": null,
"severity": "High",
"webApp": "App_test_acme",
"targetModule": "AllowList",
"enrichmentContainer":
"{\"owaspCategory\":\"A7\",\"geoLocation\":{\"countryCode\":\"US\"},\"owaspCategory2017\":\"
A5\",\"contractId\":\"7324c836-fef7-414e-cwd7d17f46438e3\",\"applicationId\":\"4c2133af-
e4bc-414b-9cc3-752653244b1e\",\"tenant\":\"b01wef3-fq4d-4dfq-9cq2-16ascs0b4217\"}",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 62
 "uri": "/login.aspx",
"passive": "true",
"originatorPort": null,
"externalIp": null,
"user": "public",
"tunnel": "test_acme_HTTPS"
}
}

Additional Example Requests:

Requesting a specific event by event ID 223424:
POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS

{
"criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555459250765,
"lower": 1554854450765
}, {
"type": "likeFilter",
"inverseFilter": false,
"field": "transId",
"value": "223424"
}
],
"pagination": {
"page": 0,
"size": 25
},
"order": [{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 63
 "type": "Order",
"order": "DESC",
"field": "receivedTimeStamp",
"sortingType": "STRING"
}
]
}

Requesting only blocked events:

POST https://portal.radwarecloud.com/mgmt/monitor/reporter/reports-
ext/APPWALL_REPORTS

{
"criteria": [{
"type": "timeFilter",
"field": "receivedTimeStamp",
"includeLower": true,
"includeUpper": true,
"upper": 1555459250765,
"lower": 1554854450765
}, {
"type": "orFilter",
"filters": [{
"type": "termFilter",
"inverseFilter": false,
"field": "action",
"value": "Blocked"
}
]
} ],
"pagination": {
"page": 0,
"size": 25
},

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 64
 "order": [{
"type": "Order",
"order": "DESC",
"field": "receivedTimeStamp",
"sortingType": "STRING"
}
]
}

Refine a Security Policy Based on an Event

To modify a security policy to not block future similar events to a specific event, you must first
get the security event information.

Refine a Security Policy Based on an Event—Request

HTTP Method POST

URL https://portal.radwarecloud.com/v1/configuration/refinements
Request authorization: Bearer Session identifier header String
Parameters requestEntityI tenantEntityId header String
ds
Attack ID A JSON formatted entry with the Body String
Model attack ID to allow in the security
policy. The attack ID is part of
the event information JSON
under the field name “_id”

Example:
POST https://portal.radwarecloud.com/v1/configuration/refinements

{"attackId":"AWohvQLt8NG-c0J9Qmp7"}

Refine a Security Policy Based on an Event—Response

When the security event refinement is successful, the portal will return an HTTP 200 OK
response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 65
CONFIGURE APPLICATION SETTINGS
The Application Settings APIs allow you to manage application settings and security policy
configuration.

Get Application Access Rules

Get Application Access Rules—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Get Application Access Rules—Response

The portal returns an HTTP 200 OK response, including multiple configuration models that
reflect the full configuration details of the created application.
The parameter accessControlList section in the response provides the access rules for the
application.
AccessControlConfiguration Model
{
accessControlListItems
(Array[AccessControlItem], optional)
defaultOperation (string, required) The default action to be taken for all IP
addresses not listed in the Access Control List.
Values: BLOCK and PERMIT
}
AccessControlItem { The order of the list of IP addresses affects the
way they will be handled by the blocking engine.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 66
 AccessControlConfiguration Model
description (string, optional) Each entry displays the required configuration,
ip (string, optional) including the following:
operation (string, optional) • Description of the record.
• IP address, which can also be a CIDR.
• Operation which is the action to be taken if
the IP is matched.
BLOCK and PERMIT.
}

Example:
"accessControlList": {
"accessControlListItems": [{
"operation": "BLOCK",
"ip": "1.2.3.4",
"description": "test"
}
],
"defaultOperation": "PERMIT"
}
Note: Within the entire response (JSON), fetch the record accessControlList to get the
record with the access control list.

Set Application Access Rules

Set Application Access Rules—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications//{applicationid}
/acl
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
AccessControlConfiguration Details of the access Body Model
model control list configuration

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 67
 AccessControlConfiguration Model
{
accessControlListItems
(Array[AccessControlItem], optional)
defaultOperation (string, required) The default action to be taken for all IP
addresses not listed in the Access Control List.
Values: BLOCK, PERMIT
}
AccessControlItem { The order of the list of IPs affects the way they
will be handled by the blocking engine
description (string, optional) Each entry displays the required configuration:
ip (string, optional) • Description of the record.
operation (string, optional) • IP address which can also be a CIDR.
• Operation which is the action to be taken if
the IP is matched.
Values: BLOCK, PERMIT
}

Example:
"accessControlList": {
"accessControlListItems": [{
"operation": "BLOCK",
"ip": "1.2.3.4",
"description": "test"
}],
"defaultOperation": "PERMIT"
}

Set Application Access Rules—Response

The portal returns an HTTP 200 OK response including access control configuration.
AccessControlConfiguration Model
{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 68
 AccessControlConfiguration Model
accessControlListItems
(Array[AccessControlItem], optional)
defaultOperation (string, required) The default action to be taken for all IP
addresses not listed in the Access Control List.
Values: BLOCK, PERMIT
}
AccessControlItem { The order of the list of IPs affects the way they
will be handled by the blocking engine
description (string, optional) Each entry displays the required configuration:
ip (string, optional) • Description of the record.
operation (string, optional) • IP address, which can also be a CIDR.
• Operation which is the action to be taken if
the IP is matched.
Values: BLOCK, PERMIT
}

Example:
"accessControlList": {
"accessControlListItems": [{
"operation": "BLOCK",
"ip": "1.2.3.4",
"description": "test"
}],
"defaultOperation": "PERMIT"
}

Get Application AllowList Refinements and State

Get Application AllowList Refinements—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 69
Get Application AllowList Refinements—Response
The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter featuresData > protectionConfiguration > allowedFileExtensionProtection
section in the response provides the AllowList module state and the list of refinements.
AllowListConfiguration Model
{
protectionStatus The state of the protection module.
Values: ACTIVE, PASSIVE, DISABLED
allowList (Array[allowListItem])
}
allowListItem {
uri (string, optional) Each entry displays an AllowList module
method (string, optional) refinement:

acceptable (bool, optional) • The allowed extension in the “*.extension”

format.
• The allowed method type for the extension.
• A flag stating that the extension is allowed.
Default is true.
}

Example:
"allowedFileExtensionProtection": {
"protectionStatus": "ACTIVE",
"allowList": {
"allowListItems": [{
"uri": "*.asp",
"method": "OPTIONS",
"acceptable": true
}, {
"uri": "*.aspx",
"method": "PUT",
"acceptable": true
}, {
"uri": "*.js",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 70
 "method": "HEAD",
"acceptable": true
}, {
"uri": "*.no-extension",
"method": "GET",
"acceptable": true
}, {
"uri": "*.no-extension",
"method": "POST",
"acceptable": true
}
]
}

Note: Within the entire response (JSON), fetch the record

allowedFileExtensionProtection to get the record with the AllowList module
configuration.

Set Application AllowList Module State

Set Application AllowList Module State—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationid}/
protections/allowedFileExtensionProtection/status/
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
AllowListState model Details of the AllowList Body Model
module state

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 71
 AllowListState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{
"protectionStatus":"ACTIVE"
}

Set Application AllowList Module State—Response

The portal returns an HTTP 200 OK response including the new module state.
AllowListState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{"protectionStatus":"ACTIVE"}

Set Application AllowList Refinements

Set Application AllowList Refinements—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationid}/
protections/allowedFileExtensionProtection/allowlist/
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 72
 AllowListRefinements model Details of the AllowList Body Model
refinements
configuration

AllowListRefinements Model
{
allowListItems
(Array[allowListItem], required)
}
allowListItem {
uri (string, required) Each entry displays the required configuration:
method (string, required) • The allowed extension in “*.extension”
format
• The allowed method type for the extension
}

Example:
{
"allowListItems":[
{
"uri":"*.jpg",
"method":"GET"
}
]
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 73
Set Application AllowList Refinements—Response
The portal returns an HTTP 200 OK response including the AllowList refinements configuration.
AllowListConfiguration Model
{
allowList (Array[allowListItem])
}
allowListItem {
uri (string,) Each entry displays an AllowList module
method (string,) refinement:

acceptable (bool,) • The allowed extension in “*.extension”

format
• The allowed method type for the extension
• A flag stating that the extension is allowed.
Default is true.
}

Example:
{
"allowListItems":[
{
"uri":"*.jpg",
"method":"GET",
"acceptable":true
}
]
}

Get Application Vulnerabilities Refinements and State

Get Application Vulnerabilities Refinements and State—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 74
 requestEntityIds tenantEntityId header String

Get Application Vulnerabilities Refinements and State—Response

The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter featuresData > protectionConfiguration > vulnerabilityProtection section in
the response provides the Vulnerabilities module state and list of refinements.
VulnerabilitiesConfiguration Model
{
protectionStatus The state of the protection module.
Values: ACTIVE, PASSIVE, DISABLED
vulnerabilityList -> vulnerabilityItems
(Array[vulnerabilitiesItem])
}
vulnerabilitiesItem {
ruleId (string) Each entry displays a Vulnerabilities module
pattern (string) refinement:

details (string) • The rule ID number

• The pattern that was matched
• Detailed description of the pattern
}

Example:
“vulnerabilityProtection”: {
“protectionStatus”: “ACTIVE”,
“vulnerabilityList”: {
“vulnerabilityItems”: [
{
“ruleId”: “7592”,
“pattern”: “cmd.exe”,
“details”: “There was an attempt to retrieve Windows Applications
file”
},
{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 75
 “ruleId”: “7788”,
“pattern”: “cookieauth.dll”,
“details”: “Cross-site scripting (XSS) vulnerability in
cookieauth.dll”
}
]
}
}

Note: Within the entire response (JSON), fetch the record vulnerabilityProtection to
get the record with the Vulnerabilities module configuration.

Set Application Vulnerabilities Module State

Set Application Vulnerabilities Module State—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationid}/
protections/vulnerabilityProtection/status/
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
VulnerabilitiesState model Details of the Body Model
Vulnerabilities module
state

VulnerabilitiesState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{
"protectionStatus":"ACTIVE"
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 76
Set Application Vulnerabilities Module State—Response
The portal returns an HTTP 200 OK response including the new module state.
VulnerabilitiesState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{"protectionStatus":"ACTIVE"}

Set Application Vulnerabilities Refinements

Set Application Vulnerabilities Refinements—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationid}/
protections/vulnerabilityProtection/vulnerabilityList
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
VulnerabilitiesRefinements Details of the Body Model
model Vulnerabilities
refinements
configuration

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 77
 VulnerabilitiesRefinements Model
{
VulnerabilitiesItems
(Array[vulnerabilitiesItem], required)
}
vulnerabilitiesItem {
ruleId (string, required) Each entry displays a Vulnerabilities module
pattern (string, required) refinement:
details (string, required) • The rule ID number
• The pattern that was matched
• Detailed description of the pattern
}

Example:
{
"vulnerabilityItems":[
{
"ruleId":"7762",
"pattern":"index.php",
"details":"PHP remote file inclusion vulnerability in FlashGameScript
1.5.4"
},
{
"ruleId":"9281",
"pattern":"/admin/",
"details":"Attempt to access administrative location"
}
]
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 78
Set Application Vulnerabilities Refinements—Response
The portal returns an HTTP 200 OK response including the Vulnerabilities refinements
configuration.
VulnerabilitiesRefinements Model
{
VulnerabilitiesItems
(Array[vulnerabilitiesItem])
}
vulnerabilitiesItem {
ruleId (string) Each entry displays a Vulnerabilities module
pattern (string) refinement:

details (string) • The rule ID number

• The pattern that was matched
• Detailed description of the pattern
}

Example:
{
"vulnerabilityItems":[
{
"ruleId":"7762",
"pattern":"index.php",
"details":"PHP remote file inclusion vulnerability in FlashGameScript
1.5.4"
},
{
"ruleId":"9281",
"pattern":"/admin/",
"details":"Attempt to access administrative location"
}
]
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 79
Get Application Database Module State

Get Application Database Module State—Request

HTTP Method GET

URL https://portal.radwarecloud.com/v1/gms/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

Get Application Database Module State—Response

The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter featuresData > protectionConfiguration > databaseProtection section in the
response provides the Database module state.
VulnerabilitiesConfiguration Model
{
protectionStatus The state of the protection module.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
"databaseProtection ": {
"protectionStatus": "ACTIVE",
}

Note: Within the entire response (JSON), fetch the record databaseProtection to get the
record with the Database module configuration.

Set Application Database Module State

Set Application Database Module State—Request

HTTP Method PUT

URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationid}/
protections/databaseProtection/status/

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 80
 Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
DatabaseState model Details of the Body Model
Vulnerabilities module
state

DatabaseState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{
"protectionStatus":"ACTIVE"
}

Set Application Database Module State—Response

The portal returns an HTTP 200 OK response including the new module state.
DatabaseState Model
{
protectionStatus (string, required) The protection state.
Values: ACTIVE, PASSIVE, DISABLED
}

Example:
{"protectionStatus":"ACTIVE"}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 81
Get Application Security Rules

Get Application Security Rules—Request

HTTP GET
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

GET https://portal.radwarecloud.com/v1/configuration/applications/f09ce1e5-5895-44a1-
a777-d06e7e3e2f81/advancedRules/securityRules

Get Application Security Rules—Response

The portal returns an HTTP 200 OK response including the existing configuration of the
application security rules.
Rule Model
[
{
id (integer, Required) Each entry displays the rule configuration:
order(integer, Optional) • The security rule ID number.
name(string, Required) • The priority of the rule against other rules.
enabled
• The security rule name.
(boolean, Required)
• Detailed description.
description
(string, Optional) • The status of the security rule.
lastChanged(integer, Values: true, false
Optional) • The time the rule was updated last.
Trigger {
Conditions [ Conditions are used to trigger the rule by matching a
condition to the content of the request.
{
conditionType (string, The condition type.
Required)

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 82
 Rule Model
headerName(string, Values: HEADER, METHOD, URI, IP, COUNTRY
Optional) For each condition type, follow the required
headerValue(string, configuration options.
Optional) You may set condition to state that the request header
operator(string, Required) must meet a certain criterion,conditionType = HEADER
• The HTTP header name
• The HTTP header value
• The criteria that must be true for the action to be
carried out.
Values:
EXISTS, NOT_EXIST, STARTS, NOT_START,
CONTAINS,
NOT_CONTAIN, EQUALS, NOT_EQUAL,
ENDS, NOT_END
method(string, Optional) You may set conditions to state that the request method
that must be included or not in a list of methods.
Condition Types = METHOD
• The HTTP method(s).
Values: GET, POST, PATCH, DELETE, HEAD,
OPTIONS, PUT, TRACE
• The criteria that must be true for the action to be
carried out.
Values: CONTAINS, NOT_CONTAIN
ips(string, Optional) You may set conditions to state that the source
IP/CIDR/IPs Group address of the request must be
included or not. conditionType = IP.
• ips—Source IP/CIDR/IPs Group addresses
• Operator—The criteria or condition that must be true
for the action to be carried out.
Values: CONTAINS, NOT_CONTAIN

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 83
 Rule Model
countries(string, conditionType = COUNTRY. You may set conditions to
Optional) state that the geographical source of the request must
be included or not.
• According to ISO 3166 codes for the representation
of names of countries and their subdivisions
• The criteria that must be true for the action to be
carried out.
Values: CONTAINS, NOT_CONTAIN
urlValue(string, conditionType = URI. You may set condition to state that
Optional) the request URL must meet a certain criterion.
• The request URL address.
• The criteria or condition that must be true for the
action to be carried out.
Possible values, STARTS, NOT_START,
CONTAINS, NOT_CONTAIN, EQUALS,
NOT_EQUAL, ENDS, NOT_END.
}
]
operator (boolean, When multiple conditions are configured, you can select
Required) between matching all or any of the rules.
Values: OR, AND
}
action {
type (string, Required) The action that will take place if the requests matched
the conditions described in the conditions section of the
rule.
Values: BYPASS, BLOCK, BLOCK_AND_REPORT
}
}
]

Example:
[
{
"id": 120,

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 84
 "order": 1,
"name": "rule1",
"enabled": true,
"description": "bypass method ",
"lastChanged": 1642406164855,
"trigger": {
"conditions": [
{
"conditionType": "METHOD",
"operator": "CONTAINS",
"methods": [
"GET",
"OPTIONS"
]
}
],
"operator": "AND"
},
"action": {
"type": "BYPASS"
}
},
{
"id": 121,
"order": 2,
"name": "rule2",
"enabled": true,
"description": "block country",
"lastChanged": 1642406164856,
"trigger": {
"conditions": [
{
"conditionType": "COUNTRY",
"operator": "NOT_CONTAIN",
"countries": [
"AX",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 85
 "AD"
]
}
],
"operator": "AND"
},
"action": {
"type": "BLOCK"
}
},
{
"id": 122,
"order": 3,
"name": "rule3",
"enabled": false,
"description": "block header",
"lastChanged": 1642406164856,
"trigger": {
"conditions": [
{
"conditionType": "HEADER",
"operator": "EQUALS",
"headerName": "RequestEntity",
"headerValue": "Value"
}
],
"operator": "AND"
},
"action": {
"type": "BLOCK"
}
}
]

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 86
Enable All Application Security Rules

Enable All Application Security Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules/enableAll
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

POST https://portal.radwarecloud.com/v1/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/advancedRules/securityRules/enableAll

Enable All Application Security Rules—Response

The portal returns an HTTP 200 OK response.

Disable All Application Security Rules

Disable All Application Security Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/vi/configuration/applications/{applicationId}/adv
ancedRules/securityRules/disableAll
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

POST https://portal.radwarecloud.com/v1/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/advancedRules/securityRules/disableAll

Disable All Application Security Rules—Response

The portal returns an HTTP 200 OK response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 87
Enable Specific Application Security Rules

Enable Specific Application Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com//vi/configuration/applications/{applicationId}/ad
vancedRules/securityRules/enable
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
RulesBulkRequest Details the security rule IDs Body Model
Model required for status change.

RulesBulkRequest Model
{
ruleIds (integer) The ID number of the security rule. You can add
multiple IDs separated by a comma.
}

POST https://portal.radwarecloud.com/vi/configuration/applications/ f09ce1e5-5895-44a1-

a777-d06e7e3e2f81/advancedRules/securityRules/enable

{
"ruleIds": [ 102, 103 ]
}

Enable Specific Application Rules—Response

The portal returns an HTTP 200 OK response.

Disable Specific Application Security Rules

Disable Specific Application Rules—Request

HTTP POST
Method

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 88
 URL https://portal.radwarecloud.com/vi/configuration/applications/{applicationId}/adv
ancedRules/securityRules/disable
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
RulesBulkRequest Details the security rule IDs Body Model
Model required for status change.

RulesBulkRequest Model
{
ruleIds (integer) The ID number of the security rule. You can add
multiple IDs separated by a comma.
}

POST https://portal.radwarecloud.com/vi/configuration/applications/f09ce1e5-5895-44a1-
a777-d06e7e3e2f81/advancedRules/securityRules/disable
{
"ruleIds": [ 102,103 ]
}

Disable Specific Application Rules—Response

The portal returns an HTTP 200 OK response.

Delete All Application Security Rules

Delete All Application Security Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules/deleteAll
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

POST https://portal.radwarecloud.com/vi/configuration/applications/f09ce1e5-5895-44a1-
a777-d06e7e3e2f81/advancedRules/securityRules/deleteAll

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 89
Delete All Application Security Rules—Response
The portal returns an HTTP 200 OK.

Delete Specific Application Security Rules

Delete Specific Application Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules/delete
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
RulesBulkRequest Details the security rule IDs Body Model
Model required for deletion.

RulesBulkRequest Model
{
ruleIds (integer) The ID number of the security rule. You can add
multiple IDs separated by a comma.
}

POST https://portal.radwarecloud.com/vi/configuration/applications/f09ce1e5-5895-44a1-
a777-d06e7e3e2f81/advancedRules/securityRules/delete
{
"ruleIds": [ 103,104 ]
}

Delete Specific Application Rules—Response

The portal returns an HTTP 200 OK response.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 90
Create New Application Security Rules

Create New Application Rules—Request

HTTP POST
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
AdvancedRulesEncod A JSON containing details of the Body String
edUpdate security rules configuration,
encoded (base64)

Rule Model
[
{
order(integer, Optional) Each entry displays the rule configuration:
name(string, Required) • The priority of the rule against other rules
enabled (boolean, Required) • The security rule name
description (string, Optional) • Detailed description
Trigger { • The status of the security rule.
Values: true, false.
Conditions [ Conditions are used to trigger the rule by matching a
condition to the content of the request.
{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 91
 Rule Model
conditionType The condition type.
(string, Required) Values: HEADER, METHOD, URI, IP, COUNTRY
For each condition type, follow the required
configuration options.
You may set condition to state that the request header
must meet a certain criterion,conditionType = HEADER
• The HTTP header name
• The HTTP header value
The criteria that must be true for the action to be carried
out.
Values: EXISTS, NOT_EXIST, STARTS, NOT_START,
CONTAINS, NOT_CONTAIN, EQUALS, NOT_EQUAL,
ENDS,NOT_END
headerName(string, The condition type.
Optional) Values: HEADER, METHOD, URI, IP, COUNTRY.
headerValue(string, For each condition type, follow the required
Optional) configuration options.
operator(string, Required) You may set condition to state that the request header
method(string, Optional) must meet a certain criterion,conditionType = HEADER
• The HTTP header name
• The HTTP header value
• The criteria that must be true for the action to be
carried out.
Values:
EXISTS, NOT_EXIST, STARTS, NOT_START,
CONTAINS, NOT_CONTAIN, EQUALS,
NOT_EQUAL, ENDS, NOT_END
You may set conditions to state that the request method
that must be included or not in a list of methods.
Condition Types = METHOD
The HTTP method(s).
Values: GET, POST, PATCH, DELETE, HEAD,
OPTIONS, PUT, TRACE
The criteria that must be true for the action to be carried
out.
Values: CONTAINS, NOT_CONTAIN

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 92
 Rule Model
ips(string, Optional) You may set conditions to state that the source
IP/CIDR/IPs Group address of the request must be
included or not. conditionType = IP
ips—Source IP/CIDR/IPs Group addresses
Operator—The criteria or condition that must be true for
the action to be carried out.
Values: CONTAINS, NOT_CONTAIN
countries(string, conditionType = COUNTRY. You may set conditions to
Optional) state that the geographical source of the request must
be included or not.
According to ISO 3166 codes for the representation of
names of countries and their subdivisions.
The criteria that must be true for the action to be carried
out.
Values: CONTAINS, NOT_CONTAIN
urlValue(string, conditionType = URI. You may set condition to state that
Optional) the request URL must meet a certain criterion.
The request URL address.
The criteria or condition that must be true for the action
to be carried out.
Possible values, STARTS, NOT_START, CONTAINS,
NOT_CONTAIN, EQUALS, NOT_EQUAL,
ENDS,NOT_END
}
]
operator (boolean, When multiple conditions are configured, you can select
Required) between matching all or any of the rules.
Values: OR, AND
}
action {
type (string, Required) The action that will be taken place if the requests
matched the conditions described in the conditions
section of the rule.
Values: BYPASS, BLOCK, BLOCK_AND_REPORT
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 93
 Rule Model
}
]

Example—Encoded request body:

{

"value":
"Ww0KCXsNCgkJIm5hbWUiOiAiTmV3UnVsZSIsDQoJCSJlbmFibGVkIjogdHJ1ZSwNCgkJImRlc2N
yaXB0aW9uIjogIk5ldyBydWxlIGZvciBwYXRjaCBtZXRob2QgIiwNCgkJInRyaWdnZXIiOiB7DQoJCQ
kiY29uZGl0aW9ucyI6IFsNCgkJCQl7DQoJCQkJCSJjb25kaXRpb25UeXBlIjogIk1FVEhPRCIsDQoJCQ
kJCSJvcGVyYXRvciI6ICJDT05UQUlOUyIsDQoJCQkJCSJtZXRob2RzIjogWw0KCQkJCQkJIlBBVENIIg
0KCQkJCQldDQoJCQkJfQ0KCQkJXSwNCgkJCSJvcGVyYXRvciI6ICJBTkQiDQoJCX0sDQoJCSJhY3Rp
b24iOiB7DQoJCQkidHlwZSI6ICJCWVBBU1MiDQoJCX0NCgl9DQpd"

Example—Decoded request body:

[
{
"name": "NewRule",
"enabled": true,
"description": "New rule for patch method ",
"trigger": {
"conditions": [
{
"conditionType": "METHOD",
"operator": "CONTAINS",
"methods": [
"PATCH"
]
}
],
"operator": "AND"
},

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 94
 "action": {
"type": "BYPASS"
}
}
]

Create New Application Security Rule—Response

The portal returns an HTTP 200 OK response including the security rules configuration object
encoded (base64).
Example—Encoded response body:
{

“value”:
“W3siaWQiOjEyMywib3JkZXIiOjAsIm5hbWUiOiJOZXdSdWxlIiwiZW5hYmxlZCI6Dhj1ZSwiZGVzY3JpcHRp
b24iOiJOZXcgcnVsZSBmb3IgcGF0Y2ggbWV0Ag9kICIsImxhc3RdaGFuZ2VkIjoxNjQyNDA5MTU5NzQyLCJ
0cmlnZ2VyIjp7ImNvbmRpdGlvbnMiOlt7ImNvbmRpdGlvblR5cGUiOiJNRVRIT0QiLCJvcGVyYXRvciI6IkNP
TlRBSU5TiiwibWV0Ag9kcyI6WyJQQVRDSCJdfV0sIm9wZXJhdG9yIjoiQU5Ein0sImFjdGlvbiI6eyJ0eXBlIjoi
QllQQVNTIn19LhsiaWQiOjEyMCwib3JkZXIiOjEsIm5hbWUiOiJydWxlMSIsImVuYWJsZWQiOnRydWUsIm
Rlc2NyaXB0Aw9uIjoiYnlwYXNzIG1ldGhvZCAiLCJsYXN0Q2hhbmdlZCI6MTY0MjQwOTE1Otc0MiwidHJpZ
2dlciI6eyJjb25kaXRpb25zIjpbeyJjb25kaXRpb25UeXBlIjoiTUVUSE9Eiiwib3BlcmF0b3IiOiJDT05UQUlOUyI
sIm1ldGhvZHMiOlsiR0VUIiwiT1BUSU9OUyIsIlBPU1QiXX1dLCJvcGVyYXRvciI6IkFORCJ9LCJhY3Rpb24iOn
sidHlwZSI6IkJZUEFTUyJ9fSx7ImlkIjoxMjEsIm9yZGVyIjoyLCJuYW1lIjoicnVsZTIiLCJlbmFibGVkIjp0cnVlLCJk
ZXNjcmlwdGlvbiI6ImJsb2NrIGNvdW50cnkiLCJsYXN0Q2hhbmdlZCI6MTY0MjQwOTE1Otc0MiwidHJpZ2d
lciI6eyJjb25kaXRpb25zIjpbeyJjb25kaXRpb25UeXBlIjoiQ09VTlRSWSIsIm9wZXJhdG9yIjoiTk9UX0NPTlRBS
U4iLCJjb3VudHJpZXMiOlsiQVgiLCJBRCJdfV0sIm9wZXJhdG9yIjoiQU5Ein0sImFjdGlvbiI6eyJ0eXBlIjoiQkxP
Q0sifX0seyJpZCI6MTIyLCJvcmRlciI6MywibmFtZSI6InJ1bGUzIiwiZW5hYmxlZCI6ZmFsc2UsImRlc2NyaXB
0Aw9uIjoiYmxvY2sgaGVhZGVyIiwibGFzdENoYW5nZWQiOjE2NDI0MDkxNTk3NDIsInRyaWdnZXIiOnsiY2
9uZGl0Aw9ucyI6W3siY29uZGl0Aw9uVHlwZSI6IkhFQURFUiIsIm9wZXJhdG9yIjoiRVFVQUxTIiwiaGVhZGV
yTmFtZSI6IlJlcXVlc3RFbnRpdHkiLCJoZWFkZXJWYWx1ZSI6IlZhbHVlIn1dLCJvcGVyYXRvciI6IkFORCJ9LCJh
Y3Rpb24iOnsidHlwZSI6IkJMT0NLIn19XQ==”

Example—Decoded response body:

[
{
“id”: 123,
“order”: 0,
“name”: “NewRule”,
“enabled”: true,

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 95
 “description”: “New rule for patch method “,
“lastChanged”: 1642409159742,
“trigger”: {
“conditions”: [
{
“conditionType”: “METHOD”,
“operator”: “CONTAINS”,
“methods”: [
“PATCH”
]
}
],
“operator”: “AND”
},
“action”: {
“type”: “BYPASS”
}
},
{
“id”: 120,
“order”: 1,
“name”: “rule1”,
“enabled”: true,
“description”: “bypass method “,
“lastChanged”: 1642409159742,
“trigger”: {
“conditions”: [
{
“conditionType”: “METHOD”,
“operator”: “CONTAINS”,
“methods”: [
“GET”,
“OPTIONS”,
“POST”
]
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 96
 ],
“operator”: “AND”
},
“action”: {
“type”: “BYPASS”
}
},
{
“id”: 121,
“order”: 2,
“name”: “rule2”,
“enabled”: true,
“description”: “block country”,
“lastChanged”: 1642409159742,
“trigger”: {
“conditions”: [
{
“conditionType”: “COUNTRY”,
“operator”: “NOT_CONTAIN”,
“countries”: [
“AX”,
“AD”
]
}
],
“operator”: “AND”
},
“action”: {
“type”: “BLOCK”
}
},
{
“id”: 122,
“order”: 3,
“name”: “rule3”,
“enabled”: false,

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 97
 “description”: “block header”,
“lastChanged”: 1642409159742,
“trigger”: {
“conditions”: [
{
“conditionType”: “HEADER”,
“operator”: “EQUALS”,
“headerName”: “RequestEntity”,
“headerValue”: “Value”
}
],
“operator”: “AND”
},
“action”: {
“type”: “BLOCK”
}
}
]

Update Existing Application Security Rules

Update Existing Application Rules—Request

HTTP PATCH
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/ad
vancedRules/securityRules
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
AdvancedRulesEncod A JSON containing details of the Body String
edUpdate security rules configuration,
encoded (base64).

Rule Model
[
{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 98
 Rule Model
id (integer, Required) Each entry displays the rule configuration:
Order(integer, Optional) • The security rule ID number
name(string, Required) • The priority of the rule against other rules
enabled (boolean, Required) • The security rule name
description (string, Optional) • Detailed description
• The status of the security rule.
Values: true, false.
Trigger {
Conditions [ Conditions are used to trigger the rule by matching a condition
to the content of the request.
{
conditionType The condition type.
(string, Required) Values: HEADER, METHOD, URI, IP, COUNTRY
headerName(string, For each condition type, follow the required configuration
Optional) options.
headerValue(string, You may set condition to state that the request header must
Optional) meet a certain criterion,conditionType = HEADER
operator(string, • The HTTP header name
Required)
• The HTTP header value
The criteria that must be true for the action to be carried out.
Values: EXISTS, NOT_EXIST, STARTS, NOT_START,
CONTAINS, NOT_CONTAIN, EQUALS, NOT_EQUAL, ENDS,
NOT_END
method(string, You may set conditions to state that the request method that
Optional) must be included or not in a list of methods. Condition Types =
METHOD
• The HTTP method(s).
Values: GET, POST, PATCH, DELETE, HEAD, OPTIONS,
PUT, TRACE
• The criteria that must be true for the action to be carried
out.
Values: CONTAINS, NOT_CONTAIN

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 99
 Rule Model
ips(string, You may set conditions to state that the source IP/CIDR/IPs
Optional) Group address of the request must be included or not.
ConditionType = IP
• ips—Source IP/CIDR/IPs Group addresses
• Operator—The criteria or condition that must be true for the
action to be carried out.
Values: CONTAINS, NOT_CONTAIN
countries(string, conditionType = COUNTRY. You may set conditions to state
Optional) that the geographical source of the request must be included or
not.
• According to ISO 3166 codes for the representation of
names of countries and their subdivisions.
• The criteria that must be true for the action to be carried
out.
Values: CONTAINS, NOT_CONTAIN
urlValue(string, conditionType = URI: You may set condition to state that the
Optional) request URL must meet a certain criterion.
• The request URL address.
• The criteria or condition that must be true for the action to
be carried out.
Possible values, STARTS, NOT_START, CONTAINS,
NOT_CONTAIN, EQUALS, NOT_EQUAL, ENDS,
NOT_END
}
]
operator (100oolean, When multiple conditions are configured, you can select
Required) between matching all or any of the rules.
Values: OR, AND
}
action {
type (string, The action that will be taken if the requests matched the
Required) conditions described in the conditions section of the rule.
Values: BYPASS, BLOCK, BLOCK_AND_REPORT
}
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 100
 Rule Model
]

Example—Encoded request body:

{

“value”:
“Ww0KCXsNCgkJImlkIjogMTIwLA0KCQkib3JkZXIiOiAxLA0KCQkibmFtZSI6ICJydWxlMSIsDQoJCS
JlbmFibGVkIjogdHJ1ZswNCgkJImRlc2NyaXB0Aw9uIjogImJ5cGFzcyBtZXRob2QgIiwNCgkJInRya
WdnZXIiOiB7DQoJCQkiY29uZGl0Aw9ucyI6IFsNCgkJCQl7DQoJCQkJCSJjb25kaXRpb25UeXBlIjog
Ik1FVEhPRCIsDQoJCQkJCSJvcGVyYXRvciI6ICJDT05UQUlOUyIsDQoJCQkJCSJtZXRob2RzIjogWw0
KCQkJCQkJIkdFVCIsDQoJCQkJCQkiT1BUSU9OUyIsDQoJCQkJCQkiUE9TVCINCgkJCQkJXQ0KCQk
JCX0NCgkJCV0sDQoJCQkib3BlcmF0b3IiOiAiQU5Eig0KCQl9LA0KCQkiYWN0Aw9uIjogew0KCQkJ
InR5cGUiOiAiQllQQVNTIg0KCQl9DqoJfQ0KXQ”

Example—Decoded request body:

[
{
“id”: 120,
“order”: 1,
“name”: “rule1”,
“enabled”: true,
“description”: “bypass method “,
“trigger”: {
“conditions”: [
{
“conditionType”: “METHOD”,
“operator”: “CONTAINS”,
“methods”: [
“GET”,
“OPTIONS”,
“POST”
]
}
],

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 101
 “operator”: “AND”
},
“action”: {
“type”: “BYPASS”
}
}
]

Update Existing Application Security Rules—Response

The portal returns an HTTP 200 OK response including the security rules configuration object
encoded (base64).
Example—Encoded response body:
{
“value” :
“W3siaWQiOjEyMCwib3JkZXIiOjEsIm5hbWUiOiJydWxlMSIsImVuYWJsZWQiOnRydWUs
ImRlc2NyaXB0aW9uIjoiYnlwYXNzIG1ldGhvZCAiLCJsYXN0Q2hhbmdlZCI6MTY0MjQwO
DA3NTAwNCwidHJpZ2dlciI6eyJjb25kaXRpb25zIjpbeyJjb25kaXRpb25UeXBlIjoiTU
VUSE9EIiwib3BlcmF0b3IiOiJDT05UQUlOUyIsIm1ldGhvZHMiOlsiR0VUIiwiT1BUSU9
OUyIsIlBPU1QiXX1dLCJvcGVyYXRvciI6IkFORCJ9LCJhY3Rpb24iOnsidHlwZSI6IkJZ
UEFTUyJ9fSx7ImlkIjoxMjEsIm9yZGVyIjoyLCJuYW1lIjoicnVsZTIiLCJlbmFibGVkI
jp0cnVlLCJkZXNjcmlwdGlvbiI6ImJsb2NrIGNvdW50cnkiLCJsYXN0Q2hhbmdlZCI6MT
Y0MjQwNjE2NDg1NiwidHJpZ2dlciI6eyJjb25kaXRpb25zIjpbeyJjb25kaXRpb25UeXB
lIjoiQ09VTlRSWSIsIm9wZXJhdG9yIjoiTk9UX0NPTlRBSU4iLCJjb3VudHJpZXMiOlsi
QVgiLCJBRCJdfV0sIm9wZXJhdG9yIjoiQU5EIn0sImFjdGlvbiI6eyJ0eXBlIjoiQkxPQ
0sifX0seyJpZCI6MTIyLCJvcmRlciI6MywibmFtZSI6InJ1bGUzIiwiZW5hYmxlZCI6Zm
Fsc2UsImRlc2NyaXB0aW9uIjoiYmxvY2sgaGVhZGVyIiwibGFzdENoYW5nZWQiOjE2NDI
0MDYxNjQ4NTYsInRyaWdnZXIiOnsiY29uZGl0aW9ucyI6W3siY29uZGl0aW9uVHlwZSI6
IkhFQURFUiIsIm9wZXJhdG9yIjoiRVFVQUxTIiwiaGVhZGVyTmFtZSI6IlJlcXVlc3RFb
nRpdHkiLCJoZWFkZXJWYWx1ZSI6IlZhbHVlIn1dLCJvcGVyYXRvciI6IkFORCJ9LCJhY3
Rpb24iOnsidHlwZSI6IkJMT0NLIn19XQ==”
}

Example—Decoded response body:

[
{
"id": 120,
"order": 1,
"name": "rule1",
"enabled": true,
"description": "bypass method ",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 102
 "lastChanged": 1642408075004,
"trigger": {
"conditions": [
{
"conditionType": "METHOD",
"operator": "CONTAINS",
"methods": [
"GET",
"OPTIONS",
"POST"
]
}
],
"operator": "AND"
},
"action": {
"type": "BYPASS"
}
},
{
"id": 121,
"order": 2,
"name": "rule2",
"enabled": true,
"description": "block country",
"lastChanged": 1642406164856,
"trigger": {
"conditions": [
{
"conditionType": "COUNTRY",
"operator": "NOT_CONTAIN",
"countries": [
"AX",
"AD"
]
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 103
 ],
"operator": "AND"
},
"action": {
"type": "BLOCK"
}
},
{
"id": 122,
"order": 3,
"name": "rule3",
"enabled": false,
"description": "block header",
"lastChanged": 1642406164856,
"trigger": {
"conditions": [
{
"conditionType": "HEADER",
"operator": "EQUALS",
"headerName": "RequestEntity",
"headerValue": "Value"
}
],
"operator": "AND"
},
"action": {
"type": "BLOCK"
}
}
]

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 104
Get API Protection Module State

Get API Protection Module State—Request

HTTP GET
Method
URL https://portal.radwarecloud.com/v2/configuration/applications/{applicationid}
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

GET https://portal.radwarecloud.com/v2/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6

GET
https://portal.radwarecloud.com/v2/configuration/applications/649182b3
-9d9f-4604-8a21-9b3d738e80a6

Get API Protection Module State—Response

The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter apiProtection section in the response provides the API Protection module state.
APIProtectionSummary Model
{
status (string, Required) The state of the protection module.
Values: ACTIVE, PASSIVE, DISABLE
}

Example:
"apiProtection": {
"status": "PASSIVE",
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 105
Note: Within the entire response (JSON), fetch the record apiProtection to get the record
with the API Protection status.

Set API Protection Status

Set API Protection Status—Request

HTTP PUT
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}/api
Protection/status
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
APIProtectionStatus A JSON containing details of the Body Model
Wrapper API Protection status

APIProtectionStatusWrapper Model
{
status (string,Required) The state of the protection module.
Values: ACTIVE, PASSIVE, DISABLE
}

PUT https://portal.radwarecloud.com/v1/configuration/applications//649182b3-9d9f-4604-
8a21-9b3d738e80a6/apiProtection/status

{
"status": "DISABLE"
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 106
Set API Protection Status—Response
The portal returns an HTTP 200 OK response including the API Protection module state.
Example:
{
"status": "DISABLE"
}

Get API Protection Endpoints

Get API Protection Endpoints—Request

HTTP GET
Method
URL https://portal.radwarecloud.com/v2/configuration/applications/{applicationId}/api
Protection/endpoints/{endpointsFilter}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
endpointsFilter The endpoint table filter. header String
Values: all, discovered,
discovered_unmodified,
last_discovered
Note: The portal will return endpoints list according to the applied filter:
• all—Endpoint of all types appear.
• discovered—Endpoints discovered through API Discovery.
• discovered_unmodified—Endpoints discovered through API Discovery with the default
Report Only status.
• last_discovered—Endpoints discovered after the last update of an OpenAPI file (last
discovery delta).
GET https://portal.radwarecloud.com/v2/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/apiProtection/endpoints/all

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 107
Get API Protection Endpoints—Response
The portal returns an HTTP 200 OK response including the API Protection endpoints list
according to the applied filter.
Example:
[
{
"id": "bb572e90-6c79-4725-88b4-8337abc1405f",
"path": "/pets",
"status": "ACTIVE",
"origin": "OAS",
"methods": [
{
"method": "GET",
"quotaManagement": {
"timeUnit": "UNLIMITED",
"threshold": 0
},
"parameters": [
{
"name": "tags",
"in": "query",
"required": false,
"allowEmptyValue": false,
"description": "tags to filter by",
"style": "form",
"explode": false,
"allowReserved": false,
"schema": {
"type": "array",
"items": {
"type": "string"
}
}
},
{
"name": "limit",

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 108
 "in": "query",
"required": false,
"allowEmptyValue": false,
"description": "maximum number of results to return",
"style": "form",
"explode": true,
"allowReserved": false,
"schema": {
"type": "integer",
"format": "int32"
}
}
],
"requestBody": null
},
{
"method": "POST",
"quotaManagement": {
"timeUnit": "UNLIMITED",
"threshold": 0
},
"parameters": [],
"requestBody": {
"required": true,
"description": "Pet to add to the store",
"content": {
"application/json": {
"schema": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string"
},

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 109
 "tag": {
"type": "string"
}
}
}
}
}
}
}
]
},
{
"id": "f06b41e5-7cf5-4d1c-bdc4-79f5a538c714",
"path": "/pets/{id}",
"status": "ACTIVE",
"origin": "OAS",
"methods": [
{
"method": "GET",
"quotaManagement": {
"timeUnit": "UNLIMITED",
"threshold": 0
},
"parameters": [
{
"name": "id",
"in": "path",
"required": true,
"allowEmptyValue": false,
"description": "ID of pet to fetch",
"style": "simple",
"explode": false,
"allowReserved": false,
"schema": {
"type": "integer",
"format": "int64"

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 110
 }
}
],
"requestBody": null
},
{
"method": "DELETE",
"quotaManagement": {
"timeUnit": "UNLIMITED",
"threshold": 0
},
"parameters": [
{
"name": "id",
"in": "path",
"required": true,
"allowEmptyValue": false,
"description": "ID of pet to delete",
"style": "simple",
"explode": false,
"allowReserved": false,
"schema": {
"type": "integer",
"format": "int64"
}
}
],
"requestBody": null
}
]
}
]

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 111
Get API Discovery Status

Get API Discovery Status—Request

HTTP GET
Method
URL https://portal.radwarecloud.com/v2/configuration/applications/{applicationid}
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String

GET https://portal.radwarecloud.com/v2/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6

Get API Protection Status—Response

The portal returns an HTTP 200 OK response including multiple configuration models that
reflect the full configuration details of the created application.
The parameter apiProtection>apiDiscovery section in the response provides the API
Discovery status.
APIDiscoveryWrapper Model
{
apiDiscovery (string, Required) The status of API Discovery.
Values: true, false
}

Example:
"apiProtection": {
"status": "ACTIVE",
"hostname": {
"useDefault": true,
"hostname": ""
},
"basePaths": [
"/api/"
],

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 112
 "endpoints": [
],
"openApiFileStatus": "UPLOADED_BY_USER",
"apiDiscovery": false,
"startedBy":[email protected]"
},

Note: Within the entire response (JSON), fetch the record apiDiscovery to get the record
with the API Discovery status.

Upload OpenAPI File

Upload OpenAPI File—Request

HTTP PUT
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}
/apiProtection/import
Request applicationId Application Identifier Path String
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
APIProtectionImport A JSON containing details of the Body Model
OpenAPI file to upload,
encoded(base64).

APIProtectionImport Model
{
content (string,Required) The OpenAPI file content.
fileExtention(string,Optional) The file extension. If left empty, the file extension
will be set to “yaml”, and appropriately with other
file extensions.
}

Notes
• The Cloud Application Security portal supports uploading OpenAPI Specification files
version 2 and 3.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 113
• The Cloud Application Security portal supports .yaml, .yml, and .json files.
• Uploading an OpenAPI file deletes the existing enforced schema and replaces it with the
new API specification document

Example (Encoded request body)

PUT https://portal.radwarecloud.com/v1/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/apiDiscovery/ apiProtection/import
{
“fileExtention:” ”,
"content":
"c3dhZ2dlcjogIjIuMCIKaW5mbzoKICB2ZXJzaW9uOiAxLjAuMAogIHRpdGxlOiBTd2FnZ2VyIF
BldHN0b3JlCiAgZGVzY3JpcHRpb246IEEgc2FtcGxlIEFQSSB0aGF0IHVzZXMgYSBwZXRzd
G9yZSBhcyBhbiBleGFtcGxlIHRvIGRlbW9uc3RyYXRlIGZlYXR1cmVzIGluIHRoZSBzd2FnZ2V
yLTIuMCBzcGVjaWZpY2F0aW9uCiAgY29udGFjdDoKICAgIG5hbWU6IFN3YWdnZXIgQVBJI
FRlYW0KICAgIGVtYWlsOiBhcGl0ZWFtQHN3YWdnZXIuaW8KICAgIHVybDogLwogIGxpY2V
uc2U6CiAgICBuYW1lOiBBcGFjaGUgMi4wCiAgICB1cmw6IGh0dHBzOi8vd3d3LmFwYWNoZ
S5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjAuaHRtbApob3N0OiAyMTAzMjFhc2guY29tCmJh
c2VQYXRoOiAvYXBpCnNjaGVtZXM6CiAgLSBodHRwCmNvbnN1bWVzOgogIC0gYXBwbGlj
YXRpb24vanNvbgpwcm9kdWNlczoKICAtIGFwcGxpY2F0aW9uL2pzb24KcGF0aHM6CiAgL3
BldHM6CiAgICBnZXQ6CiAgICAgIGRlc2NyaXB0aW9uOiB8CiAgICAgICAgUmV0dXJucyBhb
GwgcGV0cyBmcm9tIHRoZSBzeXN0ZW0gdGhhdCB0aGUgdXNlciBoYXMgYWNjZXNzIHRvC
iAgICAgIG9wZXJhdGlvbklkOiBmaW5kUGV0cwogICAgICBwYXJhbWV0ZXJzOgogICAgICAgI
C0gbmFtZTogdGFncwogICAgICAgICAgaW46IHF1ZXJ5CiAgICAgICAgICBkZXNjcmlwdGlvbj
ogdGFncyB0byBmaWx0ZXIgYnkKICAgICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgI
CAgdHlwZTogYXJyYXkKICAgICAgICAgIGNvbGxlY3Rpb25Gb3JtYXQ6IGNzdgogICAgICAgI
CAgaXRlbXM6CiAgICAgICAgICAgIHR5cGU6IHN0cmluZwogICAgICAgIC0gbmFtZTogbGltaX
QKICAgICAgICAgIGluOiBxdWVyeQogICAgICAgICAgZGVzY3JpcHRpb246IG1heGltdW0gbn
VtYmVyIG9mIHJlc3VsdHMgdG8gcmV0dXJuCiAgICAgICAgICByZXF1aXJlZDogZmFsc2UKI
CAgICAgICAgIHR5cGU6IGludGVnZXIKICAgICAgICAgIGZvcm1hdDogaW50MzIKICAgICAgc
mVzcG9uc2VzOgogICAgICAgICIyMDAiOgogICAgICAgICAgZGVzY3JpcHRpb246IHBldCByZ
XNwb25zZQogICAgICAgICAgc2NoZW1hOgogICAgICAgICAgICB0eXBlOiBhcnJheQogICAgI
CAgICAgICBpdGVtczoKICAgICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9QZXQn
CiAgICAgICAgZGVmYXVsdDoKICAgICAgICAgIGRlc2NyaXB0aW9uOiB1bmV4cGVjdGVkIG
Vycm9yCiAgICAgICAgICBzY2hlbWE6CiAgICAgICAgICAgICRyZWY6ICcjL2RlZmluaXRpb25
zL0Vycm9yJwogICAgcG9zdDoKICAgICAgZGVzY3JpcHRpb246IENyZWF0ZXMgYSBuZXcgc
GV0IGluIHRoZSBzdG9yZS4gIER1cGxpY2F0ZXMgYXJlIGFsbG93ZWQKICAgICAgb3BlcmF
0aW9uSWQ6IGFkZFBldAogICAgICBwYXJhbWV0ZXJzOgogICAgICAgIC0gbmFtZTogcGV0
CiAgICAgICAgICBpbjogYm9keQogICAgICAgICAgZGVzY3JpcHRpb246IFBldCB0byBhZGQg
dG8gdGhlIHN0b3JlCiAgICAgICAgICByZXF1aXJlZDogdHJ1ZQogICAgICAgICAgc2NoZW1h
OgogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9OZXdQZXQnCiAgICAgIHJlc3B
vbnNlczoKICAgICAgICAiMjAwIjoKICAgICAgICAgIGRlc2NyaXB0aW9uOiBwZXQgcmVzcG9u
c2UKICAgICAgICAgIHNjaGVtYToKICAgICAgICAgICAgJHJlZjogJyMvZGVmaW5pdGlvbnMv

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 114
UGV0JwogICAgICAgIGRlZmF1bHQ6CiAgICAgICAgICBkZXNjcmlwdGlvbjogdW5leHBlY3RlZ
CBlcnJvcgogICAgICAgICAgc2NoZW1hOgogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0a
W9ucy9FcnJvcicKICAvcGV0cy97aWR9OgogICAgZ2V0OgogICAgICBkZXNjcmlwdGlvbjogU
mV0dXJucyBhIHVzZXIgYmFzZWQgb24gYSBzaW5nbGUgSUQsIGlmIHRoZSB1c2VyIGRvZ
XMgbm90IGhhdmUgYWNjZXNzIHRvIHRoZSBwZXQKICAgICAgb3BlcmF0aW9uSWQ6IGZp
bmQgcGV0IGJ5IGlkCiAgICAgIHBhcmFtZXRlcnM6CiAgICAgICAgLSBuYW1lOiBpZAogICAgI
CAgICAgaW46IHBhdGgKICAgICAgICAgIGRlc2NyaXB0aW9uOiBJRCBvZiBwZXQgdG8gZm
V0Y2gKICAgICAgICAgIHJlcXVpcmVkOiB0cnVlCiAgICAgICAgICB0eXBlOiBpbnRlZ2VyCiAgI
CAgICAgICBmb3JtYXQ6IGludDY0CiAgICAgIHJlc3BvbnNlczoKICAgICAgICAiMjAwIjoKICAgI
CAgICAgIGRlc2NyaXB0aW9uOiBwZXQgcmVzcG9uc2UKICAgICAgICAgIHNjaGVtYToKICAg
ICAgICAgICAgJHJlZjogJyMvZGVmaW5pdGlvbnMvUGV0JwogICAgICAgIGRlZmF1bHQ6CiA
gICAgICAgICBkZXNjcmlwdGlvbjogdW5leHBlY3RlZCBlcnJvcgogICAgICAgICAgc2NoZW1hO
gogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9FcnJvcicKICAgIGRlbGV0ZToKIC
AgICAgZGVzY3JpcHRpb246IGRlbGV0ZXMgYSBzaW5nbGUgcGV0IGJhc2VkIG9uIHRoZSB
JRCBzdXBwbGllZAogICAgICBvcGVyYXRpb25JZDogZGVsZXRlUGV0CiAgICAgIHBhcmFtZ
XRlcnM6CiAgICAgICAgLSBuYW1lOiBpZAogICAgICAgICAgaW46IHBhdGgKICAgICAgICAgI
GRlc2NyaXB0aW9uOiBJRCBvZiBwZXQgdG8gZGVsZXRlCiAgICAgICAgICByZXF1aXJlZDog
dHJ1ZQogICAgICAgICAgdHlwZTogaW50ZWdlcgogICAgICAgICAgZm9ybWF0OiBpbnQ2NA
ogICAgICByZXNwb25zZXM6CiAgICAgICAgIjIwNCI6CiAgICAgICAgICBkZXNjcmlwdGlvbjogc
GV0IGRlbGV0ZWQKICAgICAgICBkZWZhdWx0OgogICAgICAgICAgZGVzY3JpcHRpb246IH
VuZXhwZWN0ZWQgZXJyb3IKICAgICAgICAgIHNjaGVtYToKICAgICAgICAgICAgJHJlZjogJy
MvZGVmaW5pdGlvbnMvRXJyb3InCmRlZmluaXRpb25zOgogIFBldDoKICAgIGFsbE9mOgogI
CAgICAtICRyZWY6ICcjL2RlZmluaXRpb25zL05ld1BldCcKICAgICAgLSByZXF1aXJlZDoKICA
gICAgICAtIGlkCiAgICAgICAgdHlwZTogIm9iamVjdCIKICAgICAgICBwcm9wZXJ0aWVzOgogI
CAgICAgICAgaWQ6CiAgICAgICAgICAgIHR5cGU6IGludGVnZXIKICAgICAgICAgICAgZm9yb
WF0OiBpbnQ2NAoKICBOZXdQZXQ6CiAgICB0eXBlOiAib2JqZWN0IgogICAgcmVxdWlyZW
Q6CiAgICAgIC0gbmFtZSAgCiAgICBwcm9wZXJ0aWVzOgogICAgICBuYW1lOgogICAgICAgI
HR5cGU6IHN0cmluZwogICAgICB0YWc6CiAgICAgICAgdHlwZTogc3RyaW5nICAgIAoKICBF
cnJvcjoKICAgIHR5cGU6ICJvYmplY3QiCiAgICByZXF1aXJlZDoKICAgICAgLSBjb2RlCiAgICA
gIC0gbWVzc2FnZQogICAgcHJvcGVydGllczoKICAgICAgY29kZToKICAgICAgICB0eXBlOiBp
bnRlZ2VyCiAgICAgICAgZm9ybWF0OiBpbnQzMgogICAgICBtZXNzYWdlOgogICAgICAgIHR5
cGU6IHN0cmluZw==",
"fileExtension": ""
}

Example (Decoded request body)

PUT https://portal.radwarecloud.com/v1/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/apiDiscovery/ apiProtection/import
{
“fileExtention:” ”,
“content”: swagger: “2.0”

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 115
info:
version: 1.0.0
title: Swagger Petstore
description: A sample API that uses a petstore as an example to demonstrate features in the
swagger-2.0 specification
contact:
name: Swagger API Team
email: [email protected]
url: /
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
host: 210321ash.com
basePath: /api
schemes:
- http
consumes:
- application/json
produces:
- application/json
paths:
/pets:
get:
description: |
Returns all pets from the system that the user has access to
operationId: findPets
parameters:
- name: tags
in: query
description: tags to filter by
required: false
type: array
collectionFormat: csv
items:
type: string
- name: limit
in: query
description: maximum number of results to return
required: false
type: integer
format: int32
responses:
"200":

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 116
 description: pet response
schema:
type: array
items:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
post:
description: Creates a new pet in the store. Duplicates are allowed
operationId: addPet
parameters:
- name: pet
in: body
description: Pet to add to the store
required: true
schema:
$ref: '#/definitions/NewPet'
responses:
"200":
description: pet response
schema:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
/pets/{id}:
get:
description: Returns a user based on a single ID, if the user does not have access to the
pet
operationId: find pet by id
parameters:
- name: id
in: path
description: ID of pet to fetch
required: true
type: integer
format: int64
responses:
"200":
description: pet response

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 117
 schema:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
delete:
description: deletes a single pet based on the ID supplied
operationId: deletePet
parameters:
- name: id
in: path
description: ID of pet to delete
required: true
type: integer
format: int64
responses:
"204":
description: pet deleted
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
definitions:
Pet:
allOf:
- $ref: '#/definitions/NewPet'
- required:
- id
type: "object"
properties:
id:
type: integer
format: int64

NewPet:
type: "object"
required:
- name
properties:
name:
type: string
tag:

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 118
 type: string

Error:
type: "object"
required:
- code
- message
properties:
code:
type: integer
format: int32
message:
type: string
"fileExtension": ""
}

Upload OpenAPI File Status—Response

The portal returns an HTTP 200 OK response including the uploadedOpenAPI file.
Example (encoded response body):
{
“fileExtention:” ”,
"content":
"c3dhZ2dlcjogIjIuMCIKaW5mbzoKICB2ZXJzaW9uOiAxLjAuMAogIHRpdGxlOiBTd2FnZ2VyIF
BldHN0b3JlCiAgZGVzY3JpcHRpb246IEEgc2FtcGxlIEFQSSB0aGF0IHVzZXMgYSBwZXRzd
G9yZSBhcyBhbiBleGFtcGxlIHRvIGRlbW9uc3RyYXRlIGZlYXR1cmVzIGluIHRoZSBzd2FnZ2V
yLTIuMCBzcGVjaWZpY2F0aW9uCiAgY29udGFjdDoKICAgIG5hbWU6IFN3YWdnZXIgQVBJI
FRlYW0KICAgIGVtYWlsOiBhcGl0ZWFtQHN3YWdnZXIuaW8KICAgIHVybDogLwogIGxpY2V
uc2U6CiAgICBuYW1lOiBBcGFjaGUgMi4wCiAgICB1cmw6IGh0dHBzOi8vd3d3LmFwYWNoZ
S5vcmcvbGljZW5zZXMvTElDRU5TRS0yLjAuaHRtbApob3N0OiAyMTAzMjFhc2guY29tCmJh
c2VQYXRoOiAvYXBpCnNjaGVtZXM6CiAgLSBodHRwCmNvbnN1bWVzOgogIC0gYXBwbGlj
YXRpb24vanNvbgpwcm9kdWNlczoKICAtIGFwcGxpY2F0aW9uL2pzb24KcGF0aHM6CiAgL3
BldHM6CiAgICBnZXQ6CiAgICAgIGRlc2NyaXB0aW9uOiB8CiAgICAgICAgUmV0dXJucyBhb
GwgcGV0cyBmcm9tIHRoZSBzeXN0ZW0gdGhhdCB0aGUgdXNlciBoYXMgYWNjZXNzIHRvC
iAgICAgIG9wZXJhdGlvbklkOiBmaW5kUGV0cwogICAgICBwYXJhbWV0ZXJzOgogICAgICAgI
C0gbmFtZTogdGFncwogICAgICAgICAgaW46IHF1ZXJ5CiAgICAgICAgICBkZXNjcmlwdGlvbj
ogdGFncyB0byBmaWx0ZXIgYnkKICAgICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgI
CAgdHlwZTogYXJyYXkKICAgICAgICAgIGNvbGxlY3Rpb25Gb3JtYXQ6IGNzdgogICAgICAgI
CAgaXRlbXM6CiAgICAgICAgICAgIHR5cGU6IHN0cmluZwogICAgICAgIC0gbmFtZTogbGltaX
QKICAgICAgICAgIGluOiBxdWVyeQogICAgICAgICAgZGVzY3JpcHRpb246IG1heGltdW0gbn
VtYmVyIG9mIHJlc3VsdHMgdG8gcmV0dXJuCiAgICAgICAgICByZXF1aXJlZDogZmFsc2UKI
CAgICAgICAgIHR5cGU6IGludGVnZXIKICAgICAgICAgIGZvcm1hdDogaW50MzIKICAgICAgc
mVzcG9uc2VzOgogICAgICAgICIyMDAiOgogICAgICAgICAgZGVzY3JpcHRpb246IHBldCByZ
XNwb25zZQogICAgICAgICAgc2NoZW1hOgogICAgICAgICAgICB0eXBlOiBhcnJheQogICAgI
CAgICAgICBpdGVtczoKICAgICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9QZXQn

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 119
CiAgICAgICAgZGVmYXVsdDoKICAgICAgICAgIGRlc2NyaXB0aW9uOiB1bmV4cGVjdGVkIG
Vycm9yCiAgICAgICAgICBzY2hlbWE6CiAgICAgICAgICAgICRyZWY6ICcjL2RlZmluaXRpb25
zL0Vycm9yJwogICAgcG9zdDoKICAgICAgZGVzY3JpcHRpb246IENyZWF0ZXMgYSBuZXcgc
GV0IGluIHRoZSBzdG9yZS4gIER1cGxpY2F0ZXMgYXJlIGFsbG93ZWQKICAgICAgb3BlcmF
0aW9uSWQ6IGFkZFBldAogICAgICBwYXJhbWV0ZXJzOgogICAgICAgIC0gbmFtZTogcGV0
CiAgICAgICAgICBpbjogYm9keQogICAgICAgICAgZGVzY3JpcHRpb246IFBldCB0byBhZGQg
dG8gdGhlIHN0b3JlCiAgICAgICAgICByZXF1aXJlZDogdHJ1ZQogICAgICAgICAgc2NoZW1h
OgogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9OZXdQZXQnCiAgICAgIHJlc3B
vbnNlczoKICAgICAgICAiMjAwIjoKICAgICAgICAgIGRlc2NyaXB0aW9uOiBwZXQgcmVzcG9u
c2UKICAgICAgICAgIHNjaGVtYToKICAgICAgICAgICAgJHJlZjogJyMvZGVmaW5pdGlvbnMv
UGV0JwogICAgICAgIGRlZmF1bHQ6CiAgICAgICAgICBkZXNjcmlwdGlvbjogdW5leHBlY3RlZ
CBlcnJvcgogICAgICAgICAgc2NoZW1hOgogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0a
W9ucy9FcnJvcicKICAvcGV0cy97aWR9OgogICAgZ2V0OgogICAgICBkZXNjcmlwdGlvbjogU
mV0dXJucyBhIHVzZXIgYmFzZWQgb24gYSBzaW5nbGUgSUQsIGlmIHRoZSB1c2VyIGRvZ
XMgbm90IGhhdmUgYWNjZXNzIHRvIHRoZSBwZXQKICAgICAgb3BlcmF0aW9uSWQ6IGZp
bmQgcGV0IGJ5IGlkCiAgICAgIHBhcmFtZXRlcnM6CiAgICAgICAgLSBuYW1lOiBpZAogICAgI
CAgICAgaW46IHBhdGgKICAgICAgICAgIGRlc2NyaXB0aW9uOiBJRCBvZiBwZXQgdG8gZm
V0Y2gKICAgICAgICAgIHJlcXVpcmVkOiB0cnVlCiAgICAgICAgICB0eXBlOiBpbnRlZ2VyCiAgI
CAgICAgICBmb3JtYXQ6IGludDY0CiAgICAgIHJlc3BvbnNlczoKICAgICAgICAiMjAwIjoKICAgI
CAgICAgIGRlc2NyaXB0aW9uOiBwZXQgcmVzcG9uc2UKICAgICAgICAgIHNjaGVtYToKICAg
ICAgICAgICAgJHJlZjogJyMvZGVmaW5pdGlvbnMvUGV0JwogICAgICAgIGRlZmF1bHQ6CiA
gICAgICAgICBkZXNjcmlwdGlvbjogdW5leHBlY3RlZCBlcnJvcgogICAgICAgICAgc2NoZW1hO
gogICAgICAgICAgICAkcmVmOiAnIy9kZWZpbml0aW9ucy9FcnJvcicKICAgIGRlbGV0ZToKIC
AgICAgZGVzY3JpcHRpb246IGRlbGV0ZXMgYSBzaW5nbGUgcGV0IGJhc2VkIG9uIHRoZSB
JRCBzdXBwbGllZAogICAgICBvcGVyYXRpb25JZDogZGVsZXRlUGV0CiAgICAgIHBhcmFtZ
XRlcnM6CiAgICAgICAgLSBuYW1lOiBpZAogICAgICAgICAgaW46IHBhdGgKICAgICAgICAgI
GRlc2NyaXB0aW9uOiBJRCBvZiBwZXQgdG8gZGVsZXRlCiAgICAgICAgICByZXF1aXJlZDog
dHJ1ZQogICAgICAgICAgdHlwZTogaW50ZWdlcgogICAgICAgICAgZm9ybWF0OiBpbnQ2NA
ogICAgICByZXNwb25zZXM6CiAgICAgICAgIjIwNCI6CiAgICAgICAgICBkZXNjcmlwdGlvbjogc
GV0IGRlbGV0ZWQKICAgICAgICBkZWZhdWx0OgogICAgICAgICAgZGVzY3JpcHRpb246IH
VuZXhwZWN0ZWQgZXJyb3IKICAgICAgICAgIHNjaGVtYToKICAgICAgICAgICAgJHJlZjogJy
MvZGVmaW5pdGlvbnMvRXJyb3InCmRlZmluaXRpb25zOgogIFBldDoKICAgIGFsbE9mOgogI
CAgICAtICRyZWY6ICcjL2RlZmluaXRpb25zL05ld1BldCcKICAgICAgLSByZXF1aXJlZDoKICA
gICAgICAtIGlkCiAgICAgICAgdHlwZTogIm9iamVjdCIKICAgICAgICBwcm9wZXJ0aWVzOgogI
CAgICAgICAgaWQ6CiAgICAgICAgICAgIHR5cGU6IGludGVnZXIKICAgICAgICAgICAgZm9yb
WF0OiBpbnQ2NAoKICBOZXdQZXQ6CiAgICB0eXBlOiAib2JqZWN0IgogICAgcmVxdWlyZW
Q6CiAgICAgIC0gbmFtZSAgCiAgICBwcm9wZXJ0aWVzOgogICAgICBuYW1lOgogICAgICAgI
HR5cGU6IHN0cmluZwogICAgICB0YWc6CiAgICAgICAgdHlwZTogc3RyaW5nICAgIAoKICBF
cnJvcjoKICAgIHR5cGU6ICJvYmplY3QiCiAgICByZXF1aXJlZDoKICAgICAgLSBjb2RlCiAgICA
gIC0gbWVzc2FnZQogICAgcHJvcGVydGllczoKICAgICAgY29kZToKICAgICAgICB0eXBlOiBp
bnRlZ2VyCiAgICAgICAgZm9ybWF0OiBpbnQzMgogICAgICBtZXNzYWdlOgogICAgICAgIHR5
cGU6IHN0cmluZw==",
"fileExtension": ""
}

Example (Decoded response body)

{

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 120
 “fileExtention:” ”,
"content": swagger: "2.0"
info:
version: 1.0.0
title: Swagger Petstore
description: A sample API that uses a petstore as an example to demonstrate features in the
swagger-2.0 specification
contact:
name: Swagger API Team
email: [email protected]
url: /
license:
name: Apache 2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
host: 210321ash.com
basePath: /api
schemes:
- http
consumes:
- application/json
produces:
- application/json
paths:
/pets:
get:
description: |
Returns all pets from the system that the user has access to
operationId: findPets
parameters:
- name: tags
in: query
description: tags to filter by
required: false
type: array
collectionFormat: csv
items:
type: string
- name: limit
in: query
description: maximum number of results to return
required: false
type: integer
format: int32
responses:
"200":
description: pet response
schema:
type: array

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 121
 items:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
post:
description: Creates a new pet in the store. Duplicates are allowed
operationId: addPet
parameters:
- name: pet
in: body
description: Pet to add to the store
required: true
schema:
$ref: '#/definitions/NewPet'
responses:
"200":
description: pet response
schema:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
/pets/{id}:
get:
description: Returns a user based on a single ID, if the user does not have access to the
pet
operationId: find pet by id
parameters:
- name: id
in: path
description: ID of pet to fetch
required: true
type: integer
format: int64
responses:
"200":
description: pet response
schema:
$ref: '#/definitions/Pet'
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
delete:
description: deletes a single pet based on the ID supplied

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 122
 operationId: deletePet
parameters:
- name: id
in: path
description: ID of pet to delete
required: true
type: integer
format: int64
responses:
"204":
description: pet deleted
default:
description: unexpected error
schema:
$ref: '#/definitions/Error'
definitions:
Pet:
allOf:
- $ref: '#/definitions/NewPet'
- required:
- id
type: "object"
properties:
id:
type: integer
format: int64

NewPet:
type: "object"
required:
- name
properties:
name:
type: string
tag:
type: string

Error:
type: "object"
required:
- code
- message
properties:
code:
type: integer
format: int32
message:
type: string

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 123
"fileExtension": ""
}

Start and Stop API Discovery

Start and Stop API Discovery —Request

HTTP PUT
Method
URL https://portal.radwarecloud.com/v1/configuration/applications/{applicationId}
/apiDiscovery
Request applicationId Application Identifier Path string
Parameters authorization: Bearer Session identifier header String
requestEntityIds tenantEntityId header String
APIDiscoveryWrapper Details of the API Discovery Body Model
status

APIDiscoveryWrapper Model
{
apiDiscovery (string, Required) The status of API Discovery.
Values: true, false
}

PUT https://portal.radwarecloud.com/v1/configuration/applications/649182b3-9d9f-4604-
8a21-9b3d738e80a6/apiDiscovery
{
"apiDiscovery": true
}

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 124
Start and Stop API Discovery—Response
The portal returns an HTTP 200 OK response including the discovery status.
Example:
{
"apiDiscovery": true
}

North America International

Radware Inc. Radware Ltd.
575 Corporate Drive 22 Raoul Wallenberg St.
Mahwah, NJ 07430 Tel Aviv 69710, Israel
Tel: +1-888-234-5763 Tel: 972 3 766 8666

© 2022 Radware, Ltd. All Rights Reserved. Radware and all other Radware product and service names are registered
trademarks of Radware in the U.S. and other countries. All other trademarks and names are the property of their respective
owners. Printed in the U.S.A.

Cloud WAF REST API Users Guide, Document Version 3.2, January 2022 Page 125