v32

latestOpenAPI 3.1.0raw.githubusercontent.com2026-05-151,1412,2144.5 MB

Advanced Rules

Create an advanced rule

post/waap/v1/domains/{domain_id}/advanced-rules

Path parameters

domain_idinteger required

The domain ID

Request body

namestring required

The name assigned to the rule

descriptionstring

The description assigned to the rule

enabledboolean required

Whether or not the rule is enabled

sourcestring required

A CEL syntax expression that contains the rule's conditions. Allowed objects are: request, whois, session, response, tags, user_defined_tags, user_agent, client_data.

More info can be found here: https://gcore.com/docs/waap/waap-rules/advanced-rules

phase'access' | 'header_filter' | 'body_filter' nullable

The WAAP request/response phase for applying the rule. Default is "access".

The "access" phase is responsible for modifying the request before it is sent to the origin server.

The "header_filter" phase is responsible for modifying the HTTP headers of a response before they are sent back to the client.

The "body_filter" phase is responsible for modifying the body of a response before it is sent back to the client.

Example request

{
  "name": "Block foobar bot",
  "action": {
    "block": {
      "action_duration": "12h"
    }
  },
  "source": "request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session']"
}

Response

Successful Response