/cloudflare-deploy

Patterns & Use Cases

Protect API with Schema + JWT

# 1. Upload OpenAPI schema
POST /zones/{zone_id}/api_gateway/user_schemas

# 2. Configure JWT validation
POST /zones/{zone_id}/api_gateway/token_validation
{
  "name": "Auth0",
  "location": {"header": "Authorization"},
  "jwks": "{...}"
}

# 3. Create JWT rule
POST /zones/{zone_id}/api_gateway/jwt_validation_rules

# 4. Set schema validation action
PUT /zones/{zone_id}/api_gateway/settings/schema_validation
{"validation_default_mitigation_action": "block"}

Progressive Rollout

1. Log mode: Observe false positives
   - Schema: Action = Log
   - JWT: Action = Log

2. Block subset: Protect critical endpoints
   - Change specific endpoint actions to Block
   - Monitor firewall events

3. Full enforcement: Block all violations
   - Change default action to Block
   - Handle fallthrough with custom rule

BOLA Detection

Enumeration Detection

Detects sequential resource access (e.g., /users/1, /users/2, /users/3).

// Block BOLA enumeration attempts
(cf.api_gateway.cf-risk-bola-enumeration and http.host eq "api.example.com")
// Action: Block or Challenge

Parameter Pollution

Detects duplicate/excessive parameters in requests.

// Block parameter pollution
(cf.api_gateway.cf-risk-bola-pollution and http.host eq "api.example.com")
// Action: Block

Combined BOLA Protection

// Comprehensive BOLA rule
(cf.api_gateway.cf-risk-bola-enumeration or cf.api_gateway.cf-risk-bola-pollution)
and http.host eq "api.example.com"
// Action: Block

Authentication Posture

Detect Missing Auth

// Log endpoints lacking authentication
(cf.api_gateway.cf-risk-missing-auth and http.host eq "api.example.com")
// Action: Log (for audit)

Detect Mixed Auth

// Alert on inconsistent auth patterns
(cf.api_gateway.cf-risk-mixed-auth and http.host eq "api.example.com")
// Action: Log (review required)

Fallthrough Detection (Shadow APIs)

// WAF Custom Rule
(cf.api_gateway.fallthrough_triggered and http.host eq "api.example.com")
// Action: Log (discover unknown) or Block (strict)

Rate Limiting by User

// Rate Limiting Rule (modern syntax)
(http.host eq "api.example.com" and
 is_jwt_valid(http.request.jwt.payload["{config_id}"][0]))

// Rate: 100 req/60s
// Counting expression: lookup_json_string(http.request.jwt.payload["{config_id}"][0], "sub")

Volumetric Abuse Response

// Detect abnormal traffic spikes
(cf.api_gateway.volumetric_abuse_detected and http.host eq "api.example.com")
// Action: Challenge or Rate Limit

// Combined with rate limiting
(cf.api_gateway.volumetric_abuse_detected or
 cf.threat_score gt 50) and http.host eq "api.example.com"
// Action: JS Challenge

GraphQL Protection

// Block oversized queries
(http.request.uri.path eq "/graphql" and
 cf.api_gateway.graphql_query_size gt 100000)
// Action: Block

// Block deep nested queries
(http.request.uri.path eq "/graphql" and
 cf.api_gateway.graphql_query_depth gt 10)
// Action: Block

Architecture Patterns

Public API: Discovery + Schema Validation 2.0 + JWT + Rate Limiting + Bot Management
Partner API: mTLS + Schema Validation + Sequence Mitigation
Internal API: Discovery + Schema Learning + Auth Posture

OWASP API Security Top 10 Mapping (2026)

Monitoring

Security Events: Security > Events → Filter: Action = block, Service = API Shield
Firewall Analytics: Analytics > Security → Filter by cf.api_gateway.* fields
Logpush fields: APIGatewayAuthIDPresent, APIGatewayRequestViolatesSchema, APIGatewayFallthroughDetected, JWTValidationResult

Availability (2026)

Enterprise limits: 10K operations (contact for higher). Preview access available for non-contract evaluation.

See Also

• configuration.md - Setup all features before creating rules
• api.md - Firewall field reference and API endpoints
• gotchas.md - Common issues and limits