> ## Documentation Index > Fetch the complete documentation index at: https://gcore.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Advanced rule objects and attributes The following table contains all available objects and attributes you can use in your advanced rules. | Object | Attribute | Arguments | Type | Description | | ------------ | --------------------------- | ------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------- | | client\_data | | | Container | | | | fingerprint | | Dict | Client fingerprint object | | response | | | Container | Container for response context | | | headers | | Dict | A dictionary of the response headers. Header names are case-insensitive; header values are case-sensitive. | | | status | | Var | Status code from the origin (integer) | | request | | | Container | Container for request context | | | rate\_limit | | Function | Returns true if the rate limit is exceeded | | | | content\_type | String | A string with a maximum of 30 characters, case-insensitive (optional) | | | | interval | Integer | An integer between 1 and +inf | | | | ip\_list | List | A list of 0-10 items: a string representing an IP address (IPv4 or IPv6) | | | | method\_list | List | A list of 0-9 items of: an HTTP method | | | | requests | Integer | An integer between 20 and +inf | | | | scope | Choice | One of the following values: IP or cluster | | | | status\_list | List | A list of 0-20 items: an integer between 100 and 999 | | | | url | URL | A valid URL | | | ip\_in\_range | | Function | Returns true if the client IP is contained within the given range | | | | from\_ip | IP | A string representing an IP address (IPv4 or IPv6) | | | | to\_ip | IP | A string representing an IP address (IPv4 or IPv6) | | | headers | | Dict | A dictionary of the request headers. Header names are case-insensitive; header values are case-sensitive. | | | ip | | Var | A string representing the client IP | | | ja3 | | Var | JA3 [TLS fingerprint](/waap/threat-intelligence/tls-fingerprinting) of the client (32-character hex string) | | | ja4 | | Var | JA4 [TLS fingerprint](/waap/threat-intelligence/tls-fingerprinting) of the client (prefix\_hex12\_hex12 format) | | | is\_ajax | | Function | Returns true if the request type is AJAX | | | is\_api | | Function | Returns true if the request is an API call | | | is\_static | | Function | Returns true if the request type is STATIC | | | method | | Var | HTTP method (uppercase) | | | origin\_ip | | Var | A string representing the client origin IP | | | path | | Var | Path of the URL (case-sensitive) | | | query\_params | | Var | Query params (case-sensitive) | | | upload\_file\_content\_type | | Var | Content type of the uploaded file (case-insensitive, e.g., image/PNG) | | | upload\_file\_extension | | Var | File extension of the uploaded file (case-insensitive, e.g., PNG) | | | uri | | Var | A full URI string (case-sensitive) | | | url | | Var | A full URL string (case-sensitive) | | | all | | Function | Returns true if all the given tags exist | | | any | | Function | Returns true if one or more of the given tags exist | | | exists | | Function | Returns true if the given tag exists | | | tag | | String | A string with a maximum of 30 characters | | | tag\_list | | List | A list of 1-10 items of a string with max 30 characters | | user\_agent | | | Container | The User-Agent header parsed into segments; all attribute values are lowercase, so write conditions using lowercase strings. | | | client | | Var | Client name (lowercase). For example, chrome, firefox. | | | client\_type | | Var | Client type. For example, major, lib. | | | client\_version | | Var | Client version. For example, 47.1.23. | | | client\_version\_float | | Var | Client version, major.minor part. For example, 47.1. | | | cpu | | Var | CPU brand (lowercase). For example, intel. | | | device | | Var | Device brand (lowercase). For example, iphone, playstation. | | | device\_type | | Var | Device type. For example, mobile, console. | | | engine | | Var | Engine type (lowercase). For example, gecko, applewebkit. | | | os | | Var | Client's OS (lowercase). For example, linux, windows 8. | | whois | | | Container | Container for WHOIS data of the client IP | | | country | | Var | Country code (uppercase) | | | org | | Var | Organization name (case-insensitive) | | | owner\_type | | Var | Owner type (case-insensitive) | ## Operators for Dict-type attributes Attributes of type `Dict` (`client_data.fingerprint`, `request.headers`, and `response.headers`) support a different set of operators than `Var`-type attributes. The following three operators are available for all Dict-type attributes: | Operator | Description | | -------------- | -------------------------------------------------------------------------------- | | key exists | Evaluates to `true` when the specified key is present in the dictionary. | | key not exists | Evaluates to `true` when the specified key is absent from the dictionary. | | value equals | Evaluates to `true` when the value for the specified key matches a given string. | **Examples** * **key exists** – match requests that include an `Authorization` header: ``` "Authorization" in request.headers ``` * **key not exists** – match requests that do not include a `User-Agent` header: ``` "User-Agent" not in request.headers ``` * **value equals** – match responses where the `Content-Type` header equals `application/json`: ``` response.headers["Content-Type"] == "application/json" ```