---
title: "Update a WAF rule."
method: PUT
path: "/v1/waf/rules/{id}"
tags: ["WAF"]
---

# Update a WAF rule.

`PUT /v1/waf/rules/{id}`

## Request

- Base URL: `https://api.scalix.world`
- URL: `https://api.scalix.world/v1/waf/rules/{id}`
- Auth: HTTP bearer

Replaces the configuration of an existing web application firewall rule.

## Path parameters

- `id` string, required

## Request body

- CreateRuleRequest
  - `name` string, required
  - `pattern` union, required
    - object
      - `addresses` string[], required
      - `type` 'ip_block', required
    - object
      - `pattern` string, required
      - `type` 'path_match', required
    - object
      - `name` string, required
      - `pattern` string, required
      - `type` 'header_match', required
    - object
      - `max_bytes` integer, required
      - `type` 'body_size_limit', required
    - object
      - `window_secs` integer, required
      - `max_requests` integer, required
      - `type` 'rate_limit', required
    - object
      - `countries` string[], required
      - `type` 'geo_block', required
    - object
      - `type` 'sql_injection', required
    - object
      - `type` 'xss', required
  - `action` 'block' | 'log' | 'challenge' | 'rate_limit', required
  - `priority` integer
  - `enabled` boolean: SEC-6: enable/disable a rule. Defaults to enabled on create; on update, this is what makes the toggle actually work (the old update ignored it).

## Response `200`

Rule updated

- WafRule
  - `id` string, uuid, required
  - `tenant_id` string: Owning project/tenant. SEC-2: rules and their enforcement are scoped to this — a rule is only ever applied to its own tenant's traffic, and only its owner can see/update/delete it.
  - `name` string, required
  - `pattern` union, required
    - object
      - `addresses` string[], required
      - `type` 'ip_block', required
    - object
      - `pattern` string, required
      - `type` 'path_match', required
    - object
      - `name` string, required
      - `pattern` string, required
      - `type` 'header_match', required
    - object
      - `max_bytes` integer, required
      - `type` 'body_size_limit', required
    - object
      - `window_secs` integer, required
      - `max_requests` integer, required
      - `type` 'rate_limit', required
    - object
      - `countries` string[], required
      - `type` 'geo_block', required
    - object
      - `type` 'sql_injection', required
    - object
      - `type` 'xss', required
  - `action` 'block' | 'log' | 'challenge' | 'rate_limit', required
  - `priority` integer, required
  - `enabled` boolean, required

## Other responses

- `401`: Missing or invalid credentials
- `403`: Token lacks the waf:write scope
- `404`: Rule not found
- `500`: Internal error

---

[API](https://skmtc.dev/scalix/apis/scalix-cloud-api.md) · [All operations](https://skmtc.dev/scalix/apis/scalix-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scalix/apis/scalix-cloud-api/revisions/2c04ca0a90bb?raw)