---
title: "Get security configuration"
method: GET
path: "/clusters/{cluster_id}/security"
tags: ["Cluster Security"]
---

# Get security configuration

`GET /clusters/{cluster_id}/security`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/clusters/{cluster_id}/security`
- Auth: API key in header `API-Key`

Returns the current WAF, bot management, geo-blocking, rate limiting, CAPTCHA,
and IP access control configuration for the cluster.

Required scope: `clusters:security:read`

## Path parameters

- `cluster_id` string, uuid, required

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- ClusterSecurityConfig: Security policy configuration for this cluster.
  - `waf` WAFConfig
    - `enabled` boolean, required
    - `mode` 'detect' | 'block', required: Action taken when a security rule matches.
    - `paranoia_level` integer, required: Detection sensitivity. Higher levels add more rules but increase false-positive rates.
    - `preset` 'full_crs' | 'owasp_top_10' | 'custom', required
    - `enabled_categories` WAFCategories: OWASP CRS rule categories available for selection when `preset` is `custom`.
      - `protocol_enforcement` boolean, required: Protocol Enforcement (rules 920xxx, ~30–40 rules) — HTTP protocol violations and malformed requests.
      - `protocol_attacks` boolean, required: Protocol Attacks (rules 921xxx, ~25–30 rules) — CRLF injection, HTTP request smuggling, and header attacks.
      - `local_file_inclusion` boolean, required: Local File Inclusion (rules 930xxx, ~15–20 rules) — Path traversal attacks and directory access attempts.
      - `remote_file_inclusion` boolean, required: Remote File Inclusion (rules 931xxx, ~10–15 rules) — Remote URL inclusion and SSRF attacks.
      - `remote_code_execution` boolean, required: Remote Code Execution (rules 932xxx, 60+ rules) — Command injection, shell attacks, and code execution.
      - `php_injection` boolean, required: PHP Injection (rules 933xxx, ~30–40 rules) — PHP function exploitation and serialization attacks.
      - `cross_site_scripting` boolean, required: Cross-Site Scripting (rules 941xxx, ~50–60 rules) — Script injection, event handlers, and DOM-based XSS.
      - `sql_injection` boolean, required: SQL Injection (rules 942xxx, ~55–65 rules) — Database query manipulation and blind SQLi attacks.
      - `session_fixation` boolean, required: Session Fixation (rules 943xxx, ~15–20 rules) — Session manipulation, JWT attacks, and cookie poisoning.
      - `java_attacks` boolean, required: Java/JVM Attacks (rules 944xxx, ~20–30 rules) — Log4Shell, Spring4Shell, and Java deserialization.
      - `data_leakage` boolean, required: Data Leakage Prevention (rules 950–954xxx, 50+ rules) — Credit cards, SSNs, stack traces, and error messages.
      - `webshell_detection` boolean, required: Webshell Detection (rules 955xxx, ~20–30 rules) — Backdoor scripts and malicious shell detection.
    - `exclusions` WAFExclusions
      - `paths` string[]: URL paths exempt from WAF inspection.
      - `rules` WAFRuleExclusion[]
        - `rule_ids` string[], required: OWASP CRS rule identifiers to disable.
        - `paths` string[]: Restrict this exclusion to specific URL paths. Applies globally when omitted.
  - `bot_management` BotManagementConfig
    - `enabled` boolean, required
    - `mode` 'detect' | 'block', required: Action taken when a security rule matches.
    - `challenge_mode` 'none' | 'javascript' | 'captcha', required
    - `whitelisted_agents` string[]: User-agent regex patterns to always allow through.
    - `blacklisted_agents` string[]: User-agent regex patterns to always block.
  - `geo_blocking` GeoBlockingConfig
    - `enabled` boolean, required
    - `mode` 'allowlist' | 'blocklist', required
    - `countries` string[], required: ISO 3166-1 alpha-2 country codes. Overseas territories have their own codes, distinct from their mainland: for example `GP` (Guadeloupe), `MQ` (Martinique) and `RE` (Réunion) are not covered by `FR`, so an allowlist for France and its overseas territories must list them explicitly.
  - `rate_limiting` RateLimitingConfig
    - `enabled` boolean, required
    - `global_rpm` integer: Global requests-per-minute ceiling across all clients.
    - `per_ip_rpm` integer: Per-source-IP requests-per-minute ceiling.
    - `endpoint_limits` EndpointRateLimit[]
      - `path` string, required: URL path to apply the limit to.
      - `rpm` integer, required: Maximum requests per minute for this path.
  - `captcha` CAPTCHAConfig
    - `enabled` boolean, required
    - `enabled_realms` string[]: Realm IDs where CAPTCHA challenges are presented during the login flow.
  - `ip_access_control` IPAccessControlConfig
    - `enabled` boolean: Whether IP access control is enabled. When false, no path rules are enforced.
    - `path_rules` IPPathRule[], required
      - `path` string, required: URL path prefix to restrict.
      - `allowed_ips` string[]: Individual IP addresses (IPv4 or IPv6) to allow.
      - `allowed_cidrs` string[]: CIDR ranges to allow.
      - `description` string

## Other responses

- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)