--- title: "Read Firewall Configuration" method: GET path: "/v1/security/firewall/config/{configVersion}" tags: ["security"] --- # Read Firewall Configuration `GET /v1/security/firewall/config/{configVersion}` Retrieve the specified firewall configuration for a project. The deployed configVersion will be `active` ## Path parameters - `configVersion` string, required ## Query parameters - `projectId` string, required - `teamId` string - `slug` string ## Response `200` If the firewall configuration includes a [custom managed ruleset](https://vercel.com/docs/security/vercel-waf/managed-rulesets), it will include a `crs` item that has the following values: sd: Scanner Detection ma: Multipart Attack lfi: Local File Inclusion Attack rfi: Remote File Inclusion Attack rce: Remote Execution Attack php: PHP Attack gen: Generic Attack xss: XSS Attack sqli: SQL Injection Attack sf: Session Fixation Attack java: Java Attack - object - `ownerId` string, required - `projectKey` string, required - `id` string, required - `version` number, required - `updatedAt` string, required - `firewallEnabled` false | true, required - `crs` object — Custom Ruleset - `sd` object, required — Scanner Detection - Detect and prevent reconnaissance activities from network scanning tools. - `active` false | true, required - `action` 'deny' | 'log', required - `ma` object, required — Multipart Attack - Block attempts to bypass security controls using multipart/form-data encoding. - `active` false | true, required - `action` 'deny' | 'log', required - `lfi` object, required — Local File Inclusion Attack - Prevent unauthorized access to local files through web applications. - `active` false | true, required - `action` 'deny' | 'log', required - `rfi` object, required — Remote File Inclusion Attack - Prohibit unauthorized upload or execution of remote files. - `active` false | true, required - `action` 'deny' | 'log', required - `rce` object, required — Remote Execution Attack - Prevent unauthorized execution of remote scripts or commands. - `active` false | true, required - `action` 'deny' | 'log', required - `php` object, required — PHP Attack - Safeguard against vulnerability exploits in PHP-based applications. - `active` false | true, required - `action` 'deny' | 'log', required - `gen` object, required — Generic Attack - Provide broad protection from various undefined or novel attack vectors. - `active` false | true, required - `action` 'deny' | 'log', required - `xss` object, required — XSS Attack - Prevent injection of malicious scripts into trusted webpages. - `active` false | true, required - `action` 'deny' | 'log', required - `sqli` object, required — SQL Injection Attack - Prohibit unauthorized use of SQL commands to manipulate databases. - `active` false | true, required - `action` 'deny' | 'log', required - `sf` object, required — Session Fixation Attack - Prevent unauthorized takeover of user sessions by enforcing unique session IDs. - `active` false | true, required - `action` 'deny' | 'log', required - `java` object, required — Java Attack - Mitigate risks of exploitation targeting Java-based applications or components. - `active` false | true, required - `action` 'deny' | 'log', required - `rules` union[], required - union - object - `id` string, required - `name` string, required - `description` string - `active` false | true, required - `conditionGroup` object[], required - `conditions` object[], required - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required - `neg` false | true - `key` string - `value` union - … - `action` object, required - `mitigate` object - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required - `rateLimit` object, nullable - … - `redirect` object, nullable - … - `actionDuration` string, nullable - `bypassSystem` false | true | null, nullable - `logHeaders` union - … - `valid` true, required - `validationErrors` unknown, required - object - `id` string, required - `name` string, required - `description` string - `active` false | true, required - `conditionGroup` object[], required - `conditions` object[], required - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required - `neg` false | true - `key` string - `value` union - … - `action` object, required - `mitigate` object - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required - `rateLimit` object, nullable - … - `redirect` object, nullable - … - `actionDuration` string, nullable - `bypassSystem` false | true | null, nullable - `logHeaders` union - … - `valid` false, required - `validationErrors` string[], required - `ips` object[], required - `id` string, required - `hostname` string, required - `ip` string, required - `notes` string - `action` 'bypass' | 'challenge' | 'deny' | 'log', required - `rulesets` union - object[] - `description` string - `id` string, required - `name` string, required - `active` false | true, required - `conditionGroup` object[], required - `conditions` object[], required - `type` 'bot_category' | 'bot_name' | 'bot_protection' | 'bot_status' | 'cookie' | 'domain_environment' | 'environment' | 'geo_as_number' | 'geo_city' | 'geo_continent' | 'geo_country' | 'geo_country_region' | 'header' | 'host' | 'ip_address' | 'ja3_digest' | 'ja4_digest' | 'method' | 'path' | 'protocol' | 'query' | 'rate_limit_api_id' | 'raw_path' | 'region' | 'route' | 'ruleset' | 'scheme' | 'server_action' | 'target_path' | 'trusted_source' | 'user_agent', required - `op` 'eq' | 'ex' | 'gt' | 'gte' | 'inc' | 'list' | 'lt' | 'lte' | 'neq' | 'nex' | 'ninc' | 'pre' | 're' | 'sub' | 'suf', required - `neg` false | true - `key` string - `value` union - string - number - string[] - `action` object - `mitigate` object - `action` 'allow' | 'bypass' | 'challenge' | 'deny' | 'log' | 'rate_limit' | 'redirect', required - `rateLimit` object, nullable - `algo` 'fixed_window' | 'token_bucket', required - `window` number, required - `limit` number, required - `keys` string[], required - `action` 'challenge' | 'deny' | 'log' | 'rate_limit' | 'null', nullable - `redirect` object, nullable - `location` string, required - `permanent` false | true, required - `actionDuration` string, nullable - `bypassSystem` false | true | null, nullable - `logHeaders` union - string[] - '*' - object - `changes` object[], required - `managedRules` object - `bot_protection` object - `active` false | true, required - `action` 'challenge' | 'deny' | 'log' - `updatedAt` string - `userId` string - `username` string - `ai_bots` object - `active` false | true, required - `action` 'challenge' | 'deny' | 'log' - `updatedAt` string - `userId` string - `username` string - `owasp` object - `active` false | true, required - `action` 'challenge' | 'deny' | 'log' - `updatedAt` string - `userId` string - `username` string - `vercel_ruleset` object - `active` false | true, required - `action` 'challenge' | 'deny' | 'log' - `updatedAt` string - `userId` string - `username` string - `traffic_sources` object - `active` false | true, required - `action` 'challenge' | 'deny' | 'log' - `updatedAt` string - `userId` string - `username` string - `botIdEnabled` false | true - `logHeaders` union - string[] - '*' ## Other responses - `400` — One of the provided values in the request query is invalid. - `401` — The request is not authorized. - `403` — You do not have permission to access this resource. - `404` - `410` --- [API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/versions/b4d86a3e3479/schema)