https://api.gcore.com/waap.
Domains
Protection is configured on a domain. Account-level status is a separate call.- Domains — add a site and set how its traffic is handled
- WAAP service — see whether protection is active on the account and read usage over time
Request handling
A policy turns a rule set on for a domain. A firewall, custom, or advanced rule adds a match of its own, and an override exempts something the policy would otherwise catch.- Policies — turn a rule set on for a domain and change that policy’s settings
- Policy overrides — exempt a target, including an OWASP Top Threats rule, from the policy
- Firewall rules — match traffic on one domain, or with a rule shared by the account
- Custom rules — match a request and set the action for that domain
- Advanced rules — match on the fields the descriptor allows, beyond a custom rule
- Tags — drop a named bundle of policy checks into a rule
Traffic and clients
These calls only read traffic and client data. They do not change the policy.- API discovery — list paths the domain has served, group them, and scan an uploaded API description
- Analytics — read traffic, the request log, security events, and DDoS series
- Security insights — read findings for a domain, and silence a finding
- IP Spotlight — see what one address did: attacks, URLs, user agents, and sessions
- IP reputation — read the tags stored for an address, split by the domain it hit
- Network organizations — find the organization that owns an address range, from Whois
Responses shown to the client
- Custom page sets — replace the page returned for a block; a page type left unset keeps the default
- Filter templates — save a filter the current user can apply again
- Pre-billing — read consumption as a total and split by account