> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WAAP

> WAAP domains, policies, rules, discovery, and analytics.

Protect a domain, decide what happens to a request, and inspect the clients that reached it.

The base URL is `https://api.gcore.com/waap`.

## Domains

Protection is configured on a domain. Account-level status is a separate call.

* [Domains](/api-reference/waap/domains/list-domains) — add a site and set how its traffic is handled
* [WAAP service](/api-reference/waap/waap-service/get-waap-service-details) — see whether protection is active on the account and read usage over time

## Request handling

A policy turns a rule set on for a domain. A firewall, custom, or advanced rule adds a match of its own, and an override exempts something the policy would otherwise catch.

* [Policies](/api-reference/waap/policies/list-domain-policies) — turn a rule set on for a domain and change that policy's settings
* [Policy overrides](/api-reference/waap/policy-overrides/retrieve-policy-overrides) — exempt a target, including an OWASP Top Threats rule, from the policy
* [Firewall rules](/api-reference/waap/firewall-rules/list-account-firewall-rules) — match traffic on one domain, or with a rule shared by the account
* [Custom rules](/api-reference/waap/custom-rules/retrieve-a-domainss-custom-rules) — match a request and set the action for that domain
* [Advanced rules](/api-reference/waap/advanced-rules/retrieve-advanced-rules) — match on the fields the descriptor allows, beyond a custom rule
* [Tags](/api-reference/waap/tags/retrieve-tags-available-for-use-in-waap-rule-conditions-sorted-by-name) — drop a named bundle of policy checks into a rule

## Traffic and clients

These calls only read traffic and client data. They do not change the policy.

* [API discovery](/api-reference/waap/api-discovery/retrieve-a-list-of-api-paths) — list paths the domain has served, group them, and scan an uploaded API description
* [Analytics](/api-reference/waap/analytics/get-security-events) — read traffic, the request log, security events, and DDoS series
* [Security insights](/api-reference/waap/security-insights/retrieve-a-list-of-insights) — read findings for a domain, and silence a finding
* [IP Spotlight](/api-reference/waap/ip-spotlight/retrieve-comprehensive-ip-address-data) — see what one address did: attacks, URLs, user agents, and sessions
* [IP reputation](/api-reference/waap/ip-reputation/get-a-ip-tags) — read the tags stored for an address, split by the domain it hit
* [Network organizations](/api-reference/waap/network-organizations/retrieve-a-list-of-network-organizations) — find the organization that owns an address range, from Whois

## Responses shown to the client

* [Custom page sets](/api-reference/waap/custom-page-sets/retrieve-custom-page-sets-available-for-use) — replace the page returned for a block; a page type left unset keeps the default
* [Filter templates](/api-reference/waap/filter-templates/list-filter-templates-for-the-current-user) — save a filter the current user can apply again
* [Pre-billing](/api-reference/waap/pre-billing/get-aggregated-billable-consumption-by-metric) — read consumption as a total and split by account