---
title: "Returns activated WAF config"
method: GET
path: "/v1/security/firewall/config"
tags: ["security"]
---

# Returns activated WAF config

`GET /v1/security/firewall/config`

Lists WAF configs for a project

## Response `200`

- object
  - `active` object, nullable, required
    - `ownerId` string, required
    - `projectKey` string, required
    - `id` string, required
    - `version` number, required
    - `updatedAt` string, required
    - `firewallEnabled` false | true, required
    - `crs` object
      - `sd` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `ma` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `lfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rce` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `php` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `gen` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `xss` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sqli` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sf` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `java` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
    - `rules` union[], required
      - union
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` true, required
          - `validationErrors` unknown, required
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` false, required
          - `validationErrors` string[], required
    - `ips` object[], required
      - `id` string, required
      - `hostname` string, required
      - `ip` string, required
      - `notes` string
      - `action` 'bypass' | 'challenge' | 'deny' | 'log', required
    - `rulesets` union
      - object[]
        - `description` string
        - `id` string, required
        - `name` string, required
        - `active` false | true, required
        - `conditionGroup` object[], required
          - `conditions` object[], required
            - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required
            - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required
            - `neg` false | true
            - `key` string
            - `value` union
              - …
        - `action` object
          - `mitigate` object
            - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required
            - `rateLimit` object, nullable
              - …
            - `redirect` object, nullable
              - …
            - `actionDuration` string, nullable
            - `bypassSystem` false | true | null, nullable
            - `logHeaders` union
              - …
      - object
    - `changes` object[], required
    - `managedRules` object
      - `bot_protection` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `ai_bots` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `owasp` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `vercel_ruleset` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `traffic_sources` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
    - `botIdEnabled` false | true
    - `logHeaders` union
      - string[]
      - '*'
  - `draft` object, nullable, required
    - `ownerId` string, required
    - `projectKey` string, required
    - `id` string, required
    - `version` number, required
    - `updatedAt` string, required
    - `firewallEnabled` false | true, required
    - `crs` object
      - `sd` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `ma` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `lfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rce` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `php` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `gen` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `xss` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sqli` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sf` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `java` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
    - `rules` union[], required
      - union
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` true, required
          - `validationErrors` unknown, required
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` false, required
          - `validationErrors` string[], required
    - `ips` object[], required
      - `id` string, required
      - `hostname` string, required
      - `ip` string, required
      - `notes` string
      - `action` 'bypass' | 'challenge' | 'deny' | 'log', required
    - `rulesets` union
      - object[]
        - `description` string
        - `id` string, required
        - `name` string, required
        - `active` false | true, required
        - `conditionGroup` object[], required
          - `conditions` object[], required
            - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required
            - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required
            - `neg` false | true
            - `key` string
            - `value` union
              - …
        - `action` object
          - `mitigate` object
            - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required
            - `rateLimit` object, nullable
              - …
            - `redirect` object, nullable
              - …
            - `actionDuration` string, nullable
            - `bypassSystem` false | true | null, nullable
            - `logHeaders` union
              - …
      - object
    - `changes` object[], required
    - `managedRules` object
      - `bot_protection` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `ai_bots` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `owasp` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `vercel_ruleset` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `traffic_sources` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
    - `botIdEnabled` false | true
    - `logHeaders` union
      - string[]
      - '*'
  - `versions` object[], required
    - `ownerId` string, required
    - `projectKey` string, required
    - `id` string, required
    - `version` number, required
    - `updatedAt` string, required
    - `firewallEnabled` false | true, required
    - `crs` object
      - `sd` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `ma` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `lfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rfi` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `rce` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `php` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `gen` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `xss` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sqli` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `sf` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
      - `java` object, required
        - `active` false | true, required
        - `action` 'deny' | 'log', required
    - `rules` union[], required
      - union
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` true, required
          - `validationErrors` unknown, required
        - object
          - `id` string, required
          - `name` string, required
          - `description` string
          - `active` false | true, required
          - `conditionGroup` object[], required
            - `conditions` object[], required
              - …
          - `action` object, required
            - `mitigate` object
              - …
          - `valid` false, required
          - `validationErrors` string[], required
    - `ips` object[], required
      - `id` string, required
      - `hostname` string, required
      - `ip` string, required
      - `notes` string
      - `action` 'bypass' | 'challenge' | 'deny' | 'log', required
    - `rulesets` union
      - object[]
        - `description` string
        - `id` string, required
        - `name` string, required
        - `active` false | true, required
        - `conditionGroup` object[], required
          - `conditions` object[], required
            - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required
            - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required
            - `neg` false | true
            - `key` string
            - `value` union
              - …
        - `action` object
          - `mitigate` object
            - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required
            - `rateLimit` object, nullable
              - …
            - `redirect` object, nullable
              - …
            - `actionDuration` string, nullable
            - `bypassSystem` false | true | null, nullable
            - `logHeaders` union
              - …
      - object
    - `changes` object[], required
    - `managedRules` object
      - `bot_protection` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `ai_bots` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `owasp` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `vercel_ruleset` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
      - `traffic_sources` object
        - `active` false | true, required
        - `action` 'challenge' | 'deny' | 'log'
        - `updatedAt` string
        - `userId` string
        - `username` string
    - `botIdEnabled` false | true
    - `logHeaders` union
      - string[]
      - '*'

## Other responses

- `400`
- `401` — The request is not authorized.
- `403` — You do not have permission to access this resource.
- `404`
- `410`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/versions/61d1ba3f6dac/schema)