---
title: "List WAF rules."
method: GET
path: "/v1/waf/rules"
tags: ["WAF"]
---

# List WAF rules.

`GET /v1/waf/rules`

## Request

- Base URL: `https://api.scalix.world`
- URL: `https://api.scalix.world/v1/waf/rules`
- Auth: HTTP bearer

Returns all configured web application firewall rules.

## Response `200`

All WAF rules

- WafRule[]
  - `id` string, uuid, required
  - `tenant_id` string: Owning project/tenant. SEC-2: rules and their enforcement are scoped to this — a rule is only ever applied to its own tenant's traffic, and only its owner can see/update/delete it.
  - `name` string, required
  - `pattern` union, required
    - object
      - `addresses` string[], required
      - `type` 'ip_block', required
    - object
      - `pattern` string, required
      - `type` 'path_match', required
    - object
      - `name` string, required
      - `pattern` string, required
      - `type` 'header_match', required
    - object
      - `max_bytes` integer, required
      - `type` 'body_size_limit', required
    - object
      - `window_secs` integer, required
      - `max_requests` integer, required
      - `type` 'rate_limit', required
    - object
      - `countries` string[], required
      - `type` 'geo_block', required
    - object
      - `type` 'sql_injection', required
    - object
      - `type` 'xss', required
  - `action` 'block' | 'log' | 'challenge' | 'rate_limit', required
  - `priority` integer, required
  - `enabled` boolean, required

## Other responses

- `401`: Missing or invalid credentials
- `403`: Token lacks the waf:read scope
- `500`: Internal error

---

[API](https://skmtc.dev/scalix/apis/scalix-cloud-api.md) · [All operations](https://skmtc.dev/scalix/apis/scalix-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scalix/apis/scalix-cloud-api/revisions/2c04ca0a90bb?raw)