---
title: "Retrieve account's firewall rules across all domains"
method: GET
path: "/waap/v2/firewall-rules"
tags: ["Firewall Rules"]
---

# Retrieve account's firewall rules across all domains

`GET /waap/v2/firewall-rules`

Returns all firewall rules across all domains belonging to the authenticated account. Supports filtering, ordering, and pagination.

## Query parameters

- `ordering` 'id' | 'name' | 'description' | 'enabled' | 'action' | '-id' | '-name' | '-description' | '-enabled' | '-action', nullable — Order results by field (prefix with - for descending)
- `limit` integer — Number of items to return
- `offset` integer — Number of items to skip
- `name` string — Filter rules by name (supports wildcards)
- `description` string — Filter rules by description (supports wildcards)
- `action` 'allow' | 'block'
- `enabled` boolean — Filter by enabled status
- `domain_ids` integer[] — Filter by domain IDs (can specify multiple)

## Response `200`

Successful Response

- PaginatedResponseAccountFirewallRuleResponse
  - `limit` integer, required — Number of items requested in the response
  - `offset` integer, required — Items response offset used
  - `count` integer, required — Number of items contain in the response
  - `results` AccountFirewallRuleResponse[], required — List of items returned in the response following given criteria
    - `name` string, required — The name assigned to the rule
    - `description` string — The description assigned to the rule
    - `enabled` boolean, required — Whether or not the rule is enabled
    - `action` FirewallRuleAction, required — The action that a firewall rule takes when triggered
      - `allow` RuleAllowAction — The WAAP allows the request
      - `block` RuleBlockAction — WAAP block action behavior could be configured with response status code and action duration.
        - `status_code` 403 | 405 | 418 | 429 — Designates the HTTP status code to deliver when a request is blocked.
        - `action_duration` string — How long a rule's block action will apply to subsequent requests. Can be specified in seconds or by using a numeral followed by 's', 'm', 'h', or 'd' to represent time format (seconds, minutes, hours, or days). Empty time intervals are not allowed.
    - `conditions` FirewallRuleCondition[], required — The condition required for the WAAP engine to trigger the rule.
      - `ip` IpCondition — Match the incoming request against a single IP address
        - `negation` boolean — Whether or not to apply a boolean NOT operation to the rule's condition
        - `ip_address` string, ipvanyaddress, required — A single IPv4 or IPv6 address
      - `ip_range` IpRangeCondition — Match the incoming request against an IP range
        - `negation` boolean — Whether or not to apply a boolean NOT operation to the rule's condition
        - `lower_bound` string, ipvanyaddress, required — The lower bound IPv4 or IPv6 address to match against
        - `upper_bound` string, ipvanyaddress, required — The upper bound IPv4 or IPv6 address to match against
    - `id` integer, required — The unique identifier of the rule
    - `domain` AppModelsDomainsDomainInfo, required — Minimal domain information for inclusion in resource responses
      - `id` integer, required — The domain ID
      - `name` string, required — The domain name

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Unauthenticated
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error

---

[API](https://skmtc.net/g-core/apis/gcore-openapi.md) · [All operations](https://skmtc.net/g-core/apis/gcore-openapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/g-core/gcore-openapi/revisions/09e652815095/schema)