ModifySecurityPolicy
1. API Description
Domain name for API request: teo.intl.tencentcloudapi.com.
This API is used to modify the web and bot security configurations.
A maximum of 20 requests can be initiated per second for this API.
We recommend you to use API Explorer
Try it
API Explorer provides a range of capabilities, including online call, signature authentication, SDK code generation, and API quick search. It enables you to view the request, response, and auto-generated examples.
2. Input Parameters
The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.
| Parameter Name | Required | Type | Description |
|---|---|---|---|
| Action | Yes | String | Common Params. The value used for this API: ModifySecurityPolicy. |
| Version | Yes | String | Common Params. The value used for this API: 2022-09-01. |
| Region | No | String | Common Params. This parameter is not required. |
| ZoneId | Yes | String | Zone ID. |
| SecurityConfig | Yes | SecurityConfig | Security policy configuration. |
| SecurityPolicy | No | SecurityPolicy | Security policy configuration. recommend using for Web exception rules, custom policies, rate rules, managed rules, and Bot management configuration. supports configuring security policies with expression grammar. |
| Entity | No | String | SecurityPolicy type, the following parameter values can be used for query: ZoneDefaultPolicy: used to specify a query for site-level policies;Template: used to specify a query for policy templates. the TemplateId parameter needs to be specified simultaneously;Host: used to specify a query for domain-level policies (note: when using Host to specify a domain name service policy, only domain name services or policy templates that have been applied domain-level policies are supported). |
| Host | No | String | Specify the domain name. When the Entity parameter value is set to Host, use the domain-level policy specified by this parameter to query the domain configuration. For example, use www.example.com to configure the domain-level policy for that domain name. |
| TemplateId | No | String | Specify the policy template ID. Use this parameter to specify the ID of the policy Template to query the Template configuration when the Entity parameter value is set to Template. |
3. Output Parameters
| Parameter Name | Type | Description |
|---|---|---|
| RequestId | String | The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem. |
4. Example
Example1 Modifying a Domain Name Policy
This example shows you how to modify the domain policy for a.eotest.com under the eotest.com site.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "Host",
"Host": "a.eotest.com",
"SecurityConfig": {},
"SecurityPolicy": {
"ExceptionRules": {
"Rules": [
{
"Id": "1492837231",
"Name": "ExampleSkipModule",
"Condition": "${http.request.uri.path} in ['/api/v3/test','/api/v3/submit'] and ${http.request.method} in ['POST']",
"SkipScope": "WebSecurityModules",
"WebSecurityModulesForException": [
"websec-mod-custom-rules",
"websec-mod-rate-limiting"
],
"Enabled": "On"
},
{
"Id": "1492837231",
"Name": "SampleSkipManagedRule",
"Condition": "${http.request.uri.path} in ['/api/v3/test','/api/v3/submit'] and ${http.request.method} in ['POST']",
"SkipScope": "ManagedRules",
"SkipOption": "SkipOnAllRequestFields",
"ManagedRulesForException": [
"4401215074",
"4368124487"
],
"Enabled": "On"
},
{
"Id": "1492837231",
"Name": "SampleSkipManagedRule",
"Condition": "${http.request.uri.path} in ['/api/v3/test','/api/v3/submit'] and ${http.request.method} in ['POST']",
"SkipScope": "ManagedRules",
"SkipOption": "SkipOnAllRequestFields",
"ManagedRuleGroupsForException": [
"wafgroup-sql-injection-attacks"
],
"Enabled": "On"
},
{
"Id": "1492837231",
"Name": "SampleSkipManagedRuleForField",
"Condition": "${http.request.uri.path} in ['/api/v3/test','/api/v3/submit'] and ${http.request.method} in ['POST']",
"SkipScope": "ManagedRules",
"ManagedRulesForException": [
"4401215074",
"4368124487"
],
"SkipOption": "SkipOnSpecifiedRequestFields",
"RequestFieldsForException": [
{
"Scope": "cookie",
"Condition": "",
"TargetField": "key"
},
{
"Scope": "cookie",
"Condition": "${key} in ['session-id']",
"TargetField": "value"
},
{
"Scope": "cookie",
"Condition": "${key} in ['account-id'] and ${value} like ['prefix-*']",
"TargetField": "value"
},
{
"Scope": "header",
"Condition": "",
"TargetField": "key"
},
{
"Scope": "header",
"Condition": "${key} in ['x-trace-id']",
"TargetField": "value"
},
{
"Scope": "header",
"Condition": "${key} like ['x-auth-*'] and ${value} like ['Bearer *']",
"TargetField": "value"
},
{
"Scope": "uri.query",
"Condition": "",
"TargetField": "key"
},
{
"Scope": "uri.query",
"Condition": "${key} in ['action']",
"TargetField": "value"
},
{
"Scope": "uri.query",
"Condition": "${key} in ['action'] and ${value} in ['upload', 'delete']",
"TargetField": "value"
},
{
"Scope": "uri",
"Condition": "",
"TargetField": "query"
},
{
"Scope": "uri",
"Condition": "",
"TargetField": "path"
},
{
"Scope": "uri",
"Condition": "",
"TargetField": "fullpath"
},
{
"Scope": "body.json",
"Condition": "",
"TargetField": "key"
},
{
"Scope": "body.json",
"Condition": "${key} in ['user.id']",
"TargetField": "value"
},
{
"Scope": "body.json",
"Condition": "${key} in ['user.id'] and ${value} in ['1234', '5678']",
"TargetField": "value"
},
{
"Scope": "body",
"Condition": "",
"TargetField": "fullbody"
},
{
"Scope": "body",
"Condition": "",
"TargetField": "multipart"
}
],
"Enabled": "On"
}
]
},
"CustomRules": {
"Rules": [
{
"Id": "1492837231",
"Name": "SampleBasicACLRule",
"Condition": "${http.request.ip} in ['1.1.1.1', '10.10.10.0/24', ${security.ip_group['123'@'zone-2xsnpvkhdjes']} ]",
"Action": {
"Name": "Deny"
},
"Priority": 10,
"Enabled": "on"
}
]
},
"HttpDDoSProtection": {
"AdaptiveFrequencyControl": {
"Enabled": "on",
"Sensitivity": "Loose",
"Action": {
"Name": "Monitor"
}
},
"ClientFiltering": {
"Enabled": "on",
"Action": {
"Name": "Monitor"
}
},
"BandwidthAbuseDefense": {
"Enabled": "on",
"Action": {
"Name": "Monitor"
}
},
"SlowAttackDefense": {
"Enabled": "on",
"Action": {
"Name": "Monitor"
},
"MinimalRequestBodyTransferRate": {
"Enabled": "on",
"MinimalAvgTransferRateThreshold": "50bps",
"CountingPeriod": "60s"
},
"RequestBodyTransferTimeout": {
"Enabled": "on",
"IdleTimeout": "5s"
}
}
},
"RateLimitingRules": {
"Rules": [
{
"Enabled": "on",
"Name": "SampleHttpDdosRule",
"Condition": "${http.request.uri.path} in ['/api/v3/test','/api/v3/submit']",
"CountBy": [
"http.request.ip",
"http.request.cookies['UserSession']"
],
"MaxRequestThreshold": 1000,
"CountingPeriod": "2m",
"ActionDuration": "20h",
"Action": {
"Name": "ManagedChallenge"
},
"Id": "2181399690",
"Priority": 100
}
]
},
"ManagedRules": {
"Enabled": "on",
"AutoUpdate": {
"AutoUpdateToLatestVersion": "off",
"RulesetVersion": "2023-12-21T12:00:32Z"
},
"SemanticAnalysis": "on",
"DetectionOnly": "on",
"ManagedRuleGroups": [
{
"GroupId": "wafmanagedrulegroup-vulnerability-scanners",
"SensitivityLevel": "wafmanagedrule-sensitivity-level-extreme",
"Action": {
"Name": "Monitor"
}
}
],
"FrequentScanningProtection": {
"Enabled": "on",
"Action": {
"Name": "Deny"
},
"CountBy": "http.request.ip",
"BlockThreshold": 100,
"CountingPeriod": "10s",
"ActionDuration": "60s"
}
},
"BotManagement": {
"Enabled": "on",
"CustomRules": {
"Rules": [
{
"Name": "Bot Custom Rule##1"
"Condition": "${http.request.bot.search_engine_bot_id} in ['1843332521']",
"Enabled": "on",
"Action": [
{
"SecurityAction": {
"Name": "Deny"
},
"Weight": 20
},
{
"SecurityAction": {
"Name": "Monitor"
},
"Weight": 80
}
],
"Priority": 30
},
{
"Name": "Bot Custom Rule ##2"
"Condition": "${http.request.bot.user_agent_feature_id} in ['1843332521'] and ${http.request.bot.client_reputation_name} in ['cyber-attack@low']",
"Enabled": "on",
"Action": [
{
"SecurityAction": {
"ChallengeActionParameters": {
"ChallengeOption": "JSChallenge"
},
"Name": "Challenge"
},
"Weight": 70
},
{
"SecurityAction": {
"Name": "Monitor"
},
"Weight": 30
}
],
"Priority": 40
}
]
},
"BasicBotSettings": {
"SourceIDC": {
"BaseAction": {
"Name": "Deny"
},
"BotManagementActionOverrides": [
{
"Action": {
"Name": "Allow"
},
"Ids": [
"8868370050",
"8868370049"
]
},
{
"Action": {
"Name": "Disabled"
},
"Ids": [
"8868370054",
"8868370055"
]
}
]
},
"SearchEngineBots": {
"BaseAction": {
"ChallengeActionParameters": {
"ChallengeOption": "JSChallenge"
},
"Name": "Challenge"
},
"BotManagementActionOverrides": [
{
"Action": {
"Name": "Allow"
},
"Ids": [
"9126905505",
"9126905506"
]
},
{
"Action": {
"Name": "Disabled"
},
"Ids": [
"9126905514",
"9126905515"
]
}
]
},
"KnownBotCategories": {
"BaseAction": {
"Name": "Disabled"
},
"BotManagementActionOverrides": [
{
"Action": {
"Name": "Allow"
},
"Ids": [
"9395241960"
]
},
{
"Action": {
"Name": "Monitor"
},
"Ids": [
"9395241965",
"9395241966"
]
}
]
},
"IPReputation": {
"Enabled": "on",
"IPReputationGroup": {
"BaseAction": {
"Name": "Deny"
},
"BotManagementActionOverrides": [
{
"Ids": [
"IPREP_WEB_AND_DDOS_ATTACKERS_LOW",
"IPREP_PROXIES_AND_ANONYMIZERS_HIGH",
"IPREP_WEB_SCRAPERS_AND_TRAFFIC_BOTS_MID"
],
"Action": {
"Name": "Disabled"
}
},
{
"Ids": [
"IPREP_WEB_AND_DDOS_ATTACKERS_HIGH",
"IPREP_ATO_ATTACKERS_MID",
"IPREP_WEB_SCRAPERS_AND_TRAFFIC_BOTS_LOW"
],
"Action": {
"ChallengeActionParameters": {
"ChallengeOption": "ManagedChallenge"
},
"Name": "Challenge"
}
}
]
}
},
"BotIntelligence": {
"Enabled": "on",
"BotRatings": {
"HighRiskBotRequestsAction": {
"Name": "Deny"
},
"LikelyBotRequestsAction": {
"Name": "Monitor"
},
"HumanRequestsAction": {
"Name": "Allow"
},
"VerifiedBotRequestsAction": {
"ChallengeActionParameters": {
"ChallengeOption": "JSChallenge"
},
"Name": "Challenge"
}
}
}
},
"BrowserImpersonationDetection": {
"Rules": [
{
"Id": "2181409112",
"Name": "Bot Proactive Feature Recognition##1"
"Condition": "${http.request.method} in ['POST']",
"Enabled": "on",
"Action": {
"BotSessionValidation": {
"MaxNewSessionTriggerConfig": {
"MaxNewSessionCountInterval": "10s",
"MaxNewSessionCountThreshold": 300
},
"IssueNewBotSessionCookie": "on",
"SessionExpiredAction": {
"DenyActionParameters": {
"Stall": "on"
},
"Name": "Deny"
},
"SessionInvalidAction": {
"AllowActionParameters": {
"MinDelayTime": "5s"
},
"Name": "Allow"
},
"SessionRateControl": {
"Enabled": "on",
"HighRateSessionAction": {
"Name": "Deny"
},
"LowRateSessionAction": {
"Name": "Allow",
"AllowActionParameters": {
"MaxDelayTime": "5s"
}
},
"MidRateSessionAction": {
"Name": "Monitor"
}
}
},
"ClientBehaviorDetection": {
"BotClientAction": {
"Name": "Allow",
"AllowActionParameters": {
"MinDelayTime": "5s"
}
},
"ChallengeNotFinishedAction": {
"Name": "Deny"
},
"ChallengeTimeoutAction": {
"Name": "Monitor"
},
"CryptoChallengeDelayBefore": "500ms",
"CryptoChallengeIntensity": "medium",
"MaxChallengeCountInterval": "10s",
"MaxChallengeCountThreshold": 1000
}
}
},
{
"Id": "2181409113",
"Name": "Bot Proactive Feature Recognition##2"
"Condition": "${http.request.uri.path} match ['zzz']",
"Enabled": "on",
"Action": {
"BotSessionValidation": {
"IssueNewBotSessionCookie": "off",
"SessionExpiredAction": {
"DenyActionParameters": {
"Stall": "on"
},
"Name": "Deny"
},
"SessionInvalidAction": {
"AllowActionParameters": {
"MaxDelayTime": "5s"
},
"Name": "Allow"
},
"SessionRateControl": {
"Enabled": "off"
}
}
}
}
]
}
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-777c481da684"
}
}
Example2 Modifying Template Policy
This example shows you how to modify the policy for the temp-00iel413 Template under the eotest.com site.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "Template",
"TemplateId": "temp-00iel413",
"SecurityConfig": {},
"SecurityPolicy": {
"CustomRules": {
"Rules": [
{
"Id": "1492837231",
"Name": "SampleBasicACLRule",
"Condition": "${http.request.ip} in ['1.1.1.1', '10.10.10.0/24', ${security.ip_group['123'@'zone-2xsnpvkhdjes']} ]",
"Action": {
"Name": "Deny"
},
"Priority": 10,
"Enabled": "on"
}
]
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-777c481da684"
}
}
Example3 Modifying Site-Level Policy
This example shows you how to modify the site-level policy for eotest.com.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "ZoneDefaultPolicy",
"SecurityConfig": {},
"SecurityPolicy": {
"ManagedRules": {
"Enabled": "on",
"AutoUpdate": {
"AutoUpdateToLatestVersion": "off",
"RulesetVersion": "2023-12-21T12:00:32Z"
},
"SemanticAnalysis": "on",
"DetectionOnly": "on",
"ManagedRuleGroups": [
{
"GroupId": "wafmanagedrulegroup-vulnerability-scanners",
"SensitivityLevel": "wafmanagedrule-sensitivity-level-extreme",
"Action": {
"Name": "Monitor"
}
}
]
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-777c481da684"
}
}
Example4 Modifying Security Configuration
This example shows you how to modify the layer-7 security configuration for the domain name a.eotest.com.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "a.eotest.com",
"SecurityConfig": {
"WafConfig": {
"Switch": "on",
"WafRule": {
"Switch": "on",
"ObserveRuleIDs": [],
"BlockRuleIDs": [
162502146
]
},
"Mode": "block",
"Level": "loose"
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-2e6c481dae23"
}
}
Example5 Modifying Exception Rules in Security Configuration and Whitelisting Fields
This example shows you how to skip WAF protection by whitelisting certain fields (such as all keys in the HTTP Header) for specific scenarios (such as HTTP requests with the path /skipwaf) using the following configuration.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "*.eotest.com",
"SecurityConfig": {
"ExceptConfig": {
"Switch": "on",
"ExceptUserRules": [
{
"Action": "skip",
"ExceptUserRuleConditions": [
{
"MatchContent": "/skipwaf",
"MatchFrom": "cgi",
"Operator": "equal"
}
],
"ExceptUserRuleScope": {
"Type": "partial",
"PartialModules": [
{
"Module": "waf",
"Include": [
106247778
]
}
],
"SkipConditions": [
{
"MatchContent": [],
"MatchFrom": [],
"Selector": "keys",
"Type": "header_fields"
}
]
},
"RuleID": 0,
"RuleName": "first_webshell",
"RulePriority": 0,
"RuleStatus": "on",
"UpdateTime": "2022-09-22T03:00:10Z"
}
]
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-2e6c481dae44"
}
}
Example6 Modifying Exception Rules in Security Configuration and Whitelisting Specified key Fields in Header Scenarios
This example shows you how to use the following configuration to skip WAF security protection by whitelisting certain fields (such as the Value corresponding to YourSkipHeader in the HTTP Header) for a specific scenario (such as HTTP requests with the path /skipwaf) in WAF protection.
Input Example
POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>
{
"ZoneId": "zone-fa89j239a",
"Entity": "*.eotest.com",
"SecurityConfig": {
"ExceptConfig": {
"Switch": "on",
"ExceptUserRules": [
{
"Action": "skip",
"ExceptUserRuleConditions": [
{
"MatchContent": "/skipwaf",
"MatchFrom": "cgi",
"Operator": "equal"
}
],
"ExceptUserRuleScope": {
"Type": "partial",
"PartialModules": [
{
"Module": "waf",
"Include": [
106247778
]
}
],
"SkipConditions": [
{
"MatchContent": [],
"MatchFrom": [
"YourSkipHeader"
],
"MatchFromType": "equal",
"Selector": "values",
"Type": "header_fields"
}
]
},
"RuleID": 0,
"RuleName": "first_webshell",
"RulePriority": 0,
"RuleStatus": "on",
"UpdateTime": "2022-09-22T03:00:10Z"
}
]
}
}
}
Output Example
{
"Response": {
"RequestId": "08b32010-ab25-42a4-b923-2e6c481dae66"
}
}
5. Developer Resources
SDK
TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.
- Tencent Cloud SDK 3.0 for Python
- Tencent Cloud SDK 3.0 for Java
- Tencent Cloud SDK 3.0 for PHP
- Tencent Cloud SDK 3.0 for Go
- Tencent Cloud SDK 3.0 for Node.js
- Tencent Cloud SDK 3.0 for .NET
- Tencent Cloud SDK 3.0 for C++
Command Line Interface
6. Error Code
The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.
| Error Code | Description |
|---|---|
| InternalError.ConfigLocked | The configuration is locked. Please unlock and try again. |
| InternalError.ProxyServer | An unknown error occurred in the backend server. |
| InternalError.RouteError | The backend routing address is incorrect. |
| InvalidParameter.Security | Invalid parameter. |
| LimitExceeded.Security | Limit exceeded |
| OperationDenied | Operation denied. |
| ResourceInUse | The resource is occupied. |
| UnauthorizedOperation.CamUnauthorized | CAM is not authorized. |
| UnauthorizedOperation.NoPermission | The sub-account is not authorized for the operation. Please get permissions first. |
| UnauthorizedOperation.Unknown | An unknown error occurred in the backend server. |
| UnsupportedOperation | Unsupported operation. |
- 1. API Description
- 2. Input Parameters
- 3. Output Parameters
- 4. Example
- Example1 Modifying a Domain Name Policy
- Example2 Modifying Template Policy
- Example3 Modifying Site-Level Policy
- Example4 Modifying Security Configuration
- Example5 Modifying Exception Rules in Security Configuration and Whitelisting Fields
- Example6 Modifying Exception Rules in Security Configuration and Whitelisting Specified key Fields in Header Scenarios
- 5. Developer Resources
- SDK
- Command Line Interface
- 6. Error Code