---
title: "Create an Firewall Rule"
method: POST
path: "/workspace/firewalls/{firewall_id}/request_rules"
tags: ["Firewalls - Rules Engine"]
---

# Create an Firewall Rule

`POST /workspace/firewalls/{firewall_id}/request_rules`

Create a new Rule for a specific Firewall in your account.

## Path parameters

- `firewall_id` integer, required

## Request body

- FirewallRuleRequest
  - `name` string, required
  - `active` boolean
  - `criteria` array[], required
    - FirewallCriterionFieldRequest[]
      - `conditional` 'if' | 'or' | 'and', required — * `if` - if * `or` - or * `and` - and
      - `variable` '$(header_accept)' | '$(header_accept_encoding)' | '$(header_accept_language)' | '$(header_cookie)' | '$(header_origin)' | '$(header_referer)' | '$(header_user_agent)' | '$(host)' | '$(network)' | '$(request_args)' | '$(request_method)' | '$(request_uri)' | '$(scheme)' | '$(ssl_verification_status)' | '$(client_certificate_validation)', required — * `$(header_accept)` - $(header_accept) * `$(header_accept_encoding)` - $(header_accept_encoding) * `$(header_accept_language)` - $(header_accept_language) * `$(header_cookie)` - $(header_cookie) * `$(header_origin)` - $(header_origin) * `$(header_referer)` - $(header_referer) * `$(header_user_agent)` - $(header_user_agent) * `$(host)` - $(host) * `$(network)` - $(network) * `$(request_args)` - $(request_args) * `$(request_method)` - $(request_method) * `$(request_uri)` - $(request_uri) * `$(scheme)` - $(scheme) * `$(ssl_verification_status)` - $(ssl_verification_status) * `$(client_certificate_validation)` - $(client_certificate_validation)
      - `operator` 'does_not_exist' | 'does_not_match' | 'does_not_start_with' | 'exists' | 'is_equal' | 'is_in_list' | 'is_not_equal' | 'is_not_in_list' | 'matches' | 'starts_with', required — * `does_not_exist` - does_not_exist * `does_not_match` - does_not_match * `does_not_start_with` - does_not_start_with * `exists` - exists * `is_equal` - is_equal * `is_in_list` - is_in_list * `is_not_equal` - is_not_equal * `is_not_in_list` - is_not_in_list * `matches` - matches * `starts_with` - starts_with
      - `argument` union
        - 'SUCCESS' | 'CERTIFICATE_VERIFICATION_ERROR' | 'MISSING_CLIENT_CERTIFICATE' — These values are only valid when using ${ssl_verification_status} variable.
        - integer
        - string
  - `behaviors` FirewallBehaviorRequest[], required
    - union
      - object — Behaviors without arguments
        - `type` 'deny' | 'drop', required — * `deny` - deny * `drop` - drop
      - object — Firewall behaviors with a simple argument (e.g., run_function)
        - `type` 'run_function', required
        - `attributes` FirewallBehaviorRunFunctionAttributesRequest, required
          - `value` integer, required
      - object — Firewall behaviors with complex object attributes (set_custom_response, set_rate_limit, set_waf)
        - `type` 'set_custom_response' | 'set_rate_limit' | 'set_waf', required — Behavior type
        - `attributes` union, required — Attributes object whose shape depends on the behavior type. Use SetCustomResponseAttributes for set_custom_response, SetRateLimitAttributes for set_rate_limit, SetWafAttributes for set_waf.
          - FirewallBehaviorSetCustomResponseAttributesRequest
            - `status_code` integer, required
            - `content_type` string
            - `content_body` string
          - FirewallBehaviorSetRateLimitAttributesRequest
            - `type` 'second' | 'minute' — * `second` - second * `minute` - minute
            - `limit_by` 'client_ip' | 'global', required — * `client_ip` - client_ip * `global` - global
            - `average_rate_limit` integer, required
            - `maximum_burst_size` integer, nullable
          - FirewallBehaviorSetWafAttributesRequest
            - `waf_id` integer, required
            - `mode` 'logging' | 'blocking', required — * `logging` - logging * `blocking` - blocking
  - `description` string

## Response `201`

Firewall rule created successfully.

- FirewallRuleResponse
  - `state` string
  - `data` FirewallRule, required
    - `id` integer, required
    - `name` string, required
    - `last_editor` string, required
    - `last_modified` string, date-time, required
    - `created_at` string, date-time, required
    - `active` boolean
    - `criteria` array[], required
      - FirewallCriterionField[]
        - `conditional` 'if' | 'or' | 'and', required — * `if` - if * `or` - or * `and` - and
        - `variable` '$(header_accept)' | '$(header_accept_encoding)' | '$(header_accept_language)' | '$(header_cookie)' | '$(header_origin)' | '$(header_referer)' | '$(header_user_agent)' | '$(host)' | '$(network)' | '$(request_args)' | '$(request_method)' | '$(request_uri)' | '$(scheme)' | '$(ssl_verification_status)' | '$(client_certificate_validation)', required — * `$(header_accept)` - $(header_accept) * `$(header_accept_encoding)` - $(header_accept_encoding) * `$(header_accept_language)` - $(header_accept_language) * `$(header_cookie)` - $(header_cookie) * `$(header_origin)` - $(header_origin) * `$(header_referer)` - $(header_referer) * `$(header_user_agent)` - $(header_user_agent) * `$(host)` - $(host) * `$(network)` - $(network) * `$(request_args)` - $(request_args) * `$(request_method)` - $(request_method) * `$(request_uri)` - $(request_uri) * `$(scheme)` - $(scheme) * `$(ssl_verification_status)` - $(ssl_verification_status) * `$(client_certificate_validation)` - $(client_certificate_validation)
        - `operator` 'does_not_exist' | 'does_not_match' | 'does_not_start_with' | 'exists' | 'is_equal' | 'is_in_list' | 'is_not_equal' | 'is_not_in_list' | 'matches' | 'starts_with', required — * `does_not_exist` - does_not_exist * `does_not_match` - does_not_match * `does_not_start_with` - does_not_start_with * `exists` - exists * `is_equal` - is_equal * `is_in_list` - is_in_list * `is_not_equal` - is_not_equal * `is_not_in_list` - is_not_in_list * `matches` - matches * `starts_with` - starts_with
        - `argument` union
          - 'SUCCESS' | 'CERTIFICATE_VERIFICATION_ERROR' | 'MISSING_CLIENT_CERTIFICATE' — These values are only valid when using ${ssl_verification_status} variable.
          - integer
          - string
    - `behaviors` FirewallBehavior[], required
      - union
        - object — Behaviors without arguments
          - `type` 'deny' | 'drop', required — * `deny` - deny * `drop` - drop
        - object — Firewall behaviors with a simple argument (e.g., run_function)
          - `type` 'run_function', required
          - `attributes` FirewallBehaviorRunFunctionAttributes, required
            - `value` integer, required
        - object — Firewall behaviors with complex object attributes (set_custom_response, set_rate_limit, set_waf)
          - `type` 'set_custom_response' | 'set_rate_limit' | 'set_waf', required — Behavior type
          - `attributes` union, required — Attributes object whose shape depends on the behavior type. Use SetCustomResponseAttributes for set_custom_response, SetRateLimitAttributes for set_rate_limit, SetWafAttributes for set_waf.
            - FirewallBehaviorSetCustomResponseAttributes
              - …
            - FirewallBehaviorSetRateLimitAttributes
              - …
            - FirewallBehaviorSetWafAttributes
              - …
    - `description` string
    - `order` integer, required

## Other responses

- `400` — Validation Error
- `401` — Authentication Failed
- `403` — Permission Denied
- `404` — Not Found
- `405` — Method Not Allowed
- `406` — Not Acceptable
- `429` — Throttled
- `500` — Internal Server Error

---

[API](https://skmtc.dev/azion/apis/azion-api.md) · [All operations](https://skmtc.dev/azion/apis/azion-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/azion/azion-api/revisions/bb3250697218/schema)