---
title: "Add App WAF Rule"
method: POST
path: "/app/{app_id}/waf/rules"
tags: ["apps"]
---

# Add App WAF Rule

`POST /app/{app_id}/waf/rules`

## Request

- Base URL: `https://api.faable.com`
- URL: `https://api.faable.com/app/{app_id}/waf/rules`
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `https://faable.auth.faable.link/authorize`, token URL `https://faable.auth.faable.link/oauth/token`)
  - HTTP bearer
  - OAuth 2 (client credentials, token URL `https://faable.auth.faable.link/oauth/token`)
  - HTTP bearer
  - HTTP basic
  - API key in query parameter `apikey`

Add a WAF rule to an App

## Path parameters

- `app_id` string, required

## Request body

- object
  - `pattern` string: RE2 path-regex fragment, e.g. ^/robots\.txt$
  - `user_agent` string: RE2 fragment matched against User-Agent. With `pattern`, BOTH must match.
  - `query` string: LITERAL query parameter name, e.g. rest_route (never a regex). With `pattern`, BOTH must match.
  - `action` union, required: deny → 403 at the edge; sink → synthetic 404 from the platform (the app is never woken); allow → a path the platform blocks for every app (e.g. *.zip) reaches this app (path rules only)
    - 'deny'
    - 'sink'
    - 'allow'
  - `description` string
  - `force` boolean: Accept a user-agent pattern that also matches a known search/AI crawler or uptime monitor, or a query parameter that carries an auth flow

## Response `201`

Default Response

- object
  - `enabled` boolean, required
  - `platform_profiles` object[], required
    - `name` string, required
    - `action` string, required
    - `match` string, required
    - `rule_count` integer, required
    - `rules` object[]
      - `pattern` string, required
      - `user_agent` string
      - `query` string
      - `description` string
  - `rules` object[], required
    - `pattern` string
    - `user_agent` string
    - `query` string
    - `action` string, required
    - `match` string, required
    - `description` string

## Other responses

- `400`: `bad_request` — The request is malformed. `message` says what is wrong. `validation_error` — The body, query or path failed schema validation. `details.issues` lists each failing field.
- `401`: `unauthorized` — The request carries no valid credentials. `invalid_token` — The bearer token is missing, malformed or expired.
- `403`: `forbidden` — The credentials are valid but do not allow this operation. `user_suspended` — The account is suspended. Contact support@faable.com.
- `409`: `conflict` — The request conflicts with the current state of the resource.
- `429`: `too_many_requests` — Rate limit exceeded. Honour the `Retry-After` header.
- `500`: `internal_error` — Unexpected server error. Retry later; the request id is logged.
- `503`: `database_unavailable` — Faable cannot reach its database right now. Transient: retry after the `Retry-After` header.

---

[API](https://skmtc.dev/faable/apis/faablecloud-api.md) · [All operations](https://skmtc.dev/faable/apis/faablecloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/faable/apis/faablecloud-api/revisions/e2fc93da3c49?raw)