Skip to content
Start here

Create an account or zone ruleset rule

rulesets.rules.create(strruleset_id, RuleCreateParams**kwargs) -> RuleCreateResponse
POST/{accounts_or_zones}/{account_or_zone_id}/rulesets/{ruleset_id}/rules

Adds a new rule to an account or zone ruleset. The rule will be added to the end of the existing list of rules in the ruleset by default.

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Mass URL Redirects WriteMagic Firewall WriteL4 DDoS Managed Ruleset WriteTransform Rules WriteSelect Configuration WriteAccount WAF WriteAccount Rulesets WriteLogs Write
ParametersExpand Collapse
ruleset_id: str

The unique ID of the ruleset.

account_id: Optional[str]

The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.

zone_id: Optional[str]

The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

dry_run: Optional[bool]

Validates the request without persisting changes when set to true. Responses that normally return 200 return result: null; endpoints that normally return 204 continue to return 204.

id: Optional[str]

The unique ID of the rule.

action: Optional[Literal["block"]]

The action to perform when the rule matches.

action_parameters: Optional[BlockRuleActionParameters]

The parameters configuring the rule’s action.

response: Optional[BlockRuleActionParametersResponse]

The response to show when the block is applied.

content: str

The content to return.

minLength1
content_type: str

The type of the content to return.

minLength1
status_code: int

The status code to return.

maximum499
minimum400
description: Optional[str]

An informative description of the rule.

enabled: Optional[bool]

Whether the rule should be executed.

exposed_credential_check: Optional[BlockRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
expression: Optional[str]

The expression defining which traffic will match the rule.

minLength1
logging: Optional[LoggingParam]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

position: Optional[BlockRulePosition]

An object configuring where the rule will be placed.

One of the following:
class BlockRulePositionBeforePosition:

An object configuring where the rule will be placed.

before: Optional[str]

The ID of another rule to place the rule before. An empty value causes the rule to be placed at the top.

class BlockRulePositionAfterPosition:

An object configuring where the rule will be placed.

after: Optional[str]

The ID of another rule to place the rule after. An empty value causes the rule to be placed at the bottom.

class BlockRulePositionIndexPosition:

An object configuring where the rule will be placed.

index: Optional[int]

An index at which to place the rule, where index 1 is the first rule.

minimum1
ratelimit: Optional[BlockRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: Sequence[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
ref: Optional[str]

The reference of the rule (the rule’s ID by default).

minLength1
ReturnsExpand Collapse
One of the following:
class Ruleset:

A ruleset object.

id: str

The unique ID of the ruleset.

kind: Kind

The kind of the ruleset.

One of the following:
"managed"
"custom"
"root"
"zone"
last_updated: datetime

The timestamp of when the ruleset was last modified.

formatdate-time
name: str

The human-readable name of the ruleset.

minLength1
phase: Phase

The phase of the ruleset.

One of the following:
"ddos_l4"
"ddos_l7"
"http_config_settings"
"http_custom_errors"
"http_log_custom_fields"
"http_ratelimit"
"http_request_cache_settings"
"http_request_dynamic_redirect"
"http_request_firewall_custom"
"http_request_firewall_managed"
"http_request_late_transform"
"http_request_origin"
"http_request_redirect"
"http_request_sanitize"
"http_request_sbfm"
"http_request_transform"
"http_response_cache_settings"
"http_response_compression"
"http_response_firewall_managed"
"http_response_headers_transform"
"magic_transit"
"magic_transit_ids_managed"
"magic_transit_managed"
"magic_transit_ratelimit"
rules: List[RulesetRule]

The list of rules in the ruleset.

One of the following:
class RulesetRuleBlockRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleChallengeRule:
id: str

The unique ID of the rule.

action: Literal["challenge"]

The action to perform when the rule matches.

enabled: bool

Whether the rule should be executed.

expression: str

The expression defining which traffic will match the rule.

minLength1
last_updated: datetime

The timestamp of when the rule was last modified.

formatdate-time
ref: str

The reference of the rule (the rule’s ID by default).

minLength1
version: str

The version of the rule.

action_parameters: Optional[object]

The parameters configuring the rule’s action.

categories: Optional[List[str]]

The categories of the rule.

description: Optional[str]

An informative description of the rule.

exposed_credential_check: Optional[RulesetRuleChallengeRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
logging: Optional[Logging]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

ratelimit: Optional[RulesetRuleChallengeRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: List[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
class RulesetRuleResponseCompressionRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleDDoSDynamicRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleExecuteRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleForceConnectionCloseRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleJavaScriptChallengeRule:
id: str

The unique ID of the rule.

action: Literal["js_challenge"]

The action to perform when the rule matches.

enabled: bool

Whether the rule should be executed.

expression: str

The expression defining which traffic will match the rule.

minLength1
last_updated: datetime

The timestamp of when the rule was last modified.

formatdate-time
ref: str

The reference of the rule (the rule’s ID by default).

minLength1
version: str

The version of the rule.

action_parameters: Optional[object]

The parameters configuring the rule’s action.

categories: Optional[List[str]]

The categories of the rule.

description: Optional[str]

An informative description of the rule.

exposed_credential_check: Optional[RulesetRuleJavaScriptChallengeRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
logging: Optional[Logging]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

ratelimit: Optional[RulesetRuleJavaScriptChallengeRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: List[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
class RulesetRuleLogRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleLogCustomFieldRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleManagedChallengeRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleRedirectRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleRewriteRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleRouteRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleScoreRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleServeErrorRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleSetCacheControlRule:
id: str

The unique ID of the rule.

action: Literal["set_cache_control"]

The action to perform when the rule matches.

enabled: bool
expression: str

The expression defining which traffic will match the rule.

minLength1
last_updated: datetime

The timestamp of when the rule was last modified.

formatdate-time
ref: str

The reference of the rule (the rule’s ID by default).

minLength1
version: str

The version of the rule.

action_parameters: Optional[RulesetRuleSetCacheControlRuleActionParameters]

The parameters configuring the rule’s action.

immutable: Optional[RulesetRuleSetCacheControlRuleActionParametersImmutable]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersImmutableSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersImmutableRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

max_age: Optional[RulesetRuleSetCacheControlRuleActionParametersMaxAge]

A cache-control directive configuration that accepts a duration value in seconds.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersMaxAgeSetDirective:

Set the directive with a duration value in seconds.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
value: int

The duration value in seconds for the directive.

minimum0
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersMaxAgeRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

must_revalidate: Optional[RulesetRuleSetCacheControlRuleActionParametersMustRevalidate]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersMustRevalidateSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersMustRevalidateRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

must_understand: Optional[RulesetRuleSetCacheControlRuleActionParametersMustUnderstand]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersMustUnderstandSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersMustUnderstandRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

no_cache: Optional[RulesetRuleSetCacheControlRuleActionParametersNoCache]

A cache-control directive configuration that accepts optional qualifiers (header names).

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersNoCacheSetDirective:

Set the directive with optional qualifiers.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

qualifiers: Optional[List[str]]

Optional list of header names to qualify the directive (e.g., for “private” or “no-cache” directives).

class RulesetRuleSetCacheControlRuleActionParametersNoCacheRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

no_store: Optional[RulesetRuleSetCacheControlRuleActionParametersNoStore]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersNoStoreSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersNoStoreRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

no_transform: Optional[RulesetRuleSetCacheControlRuleActionParametersNoTransform]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersNoTransformSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersNoTransformRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

private: Optional[RulesetRuleSetCacheControlRuleActionParametersPrivate]

A cache-control directive configuration that accepts optional qualifiers (header names).

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersPrivateSetDirective:

Set the directive with optional qualifiers.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

qualifiers: Optional[List[str]]

Optional list of header names to qualify the directive (e.g., for “private” or “no-cache” directives).

class RulesetRuleSetCacheControlRuleActionParametersPrivateRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

proxy_revalidate: Optional[RulesetRuleSetCacheControlRuleActionParametersProxyRevalidate]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersProxyRevalidateSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersProxyRevalidateRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

public: Optional[RulesetRuleSetCacheControlRuleActionParametersPublic]

A cache-control directive configuration.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersPublicSetDirective:

Set the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersPublicRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

s_maxage: Optional[RulesetRuleSetCacheControlRuleActionParametersSMaxage]

A cache-control directive configuration that accepts a duration value in seconds.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersSMaxageSetDirective:

Set the directive with a duration value in seconds.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
value: int

The duration value in seconds for the directive.

minimum0
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersSMaxageRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

stale_if_error: Optional[RulesetRuleSetCacheControlRuleActionParametersStaleIfError]

A cache-control directive configuration that accepts a duration value in seconds.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersStaleIfErrorSetDirective:

Set the directive with a duration value in seconds.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
value: int

The duration value in seconds for the directive.

minimum0
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersStaleIfErrorRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

stale_while_revalidate: Optional[RulesetRuleSetCacheControlRuleActionParametersStaleWhileRevalidate]

A cache-control directive configuration that accepts a duration value in seconds.

One of the following:
class RulesetRuleSetCacheControlRuleActionParametersStaleWhileRevalidateSetDirective:

Set the directive with a duration value in seconds.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
value: int

The duration value in seconds for the directive.

minimum0
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

class RulesetRuleSetCacheControlRuleActionParametersStaleWhileRevalidateRemoveDirective:

Remove the directive.

operation: Literal["set", "remove"]

The operation to perform on the cache-control directive.

One of the following:
"set"
"remove"
cloudflare_only: Optional[bool]

Whether the directive should only be applied to the Cloudflare CDN cache.

categories: Optional[List[str]]

The categories of the rule.

description: Optional[str]

An informative description of the rule.

exposed_credential_check: Optional[RulesetRuleSetCacheControlRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
logging: Optional[Logging]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

ratelimit: Optional[RulesetRuleSetCacheControlRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: List[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
class RulesetRuleSetCacheSettingsRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleSetCacheTagsRule:
id: str

The unique ID of the rule.

action: Literal["set_cache_tags"]

The action to perform when the rule matches.

enabled: bool
expression: str

The expression defining which traffic will match the rule.

minLength1
last_updated: datetime

The timestamp of when the rule was last modified.

formatdate-time
ref: str

The reference of the rule (the rule’s ID by default).

minLength1
version: str

The version of the rule.

action_parameters: Optional[RulesetRuleSetCacheTagsRuleActionParameters]

The parameters configuring the rule’s action.

One of the following:
class RulesetRuleSetCacheTagsRuleActionParametersAddCacheTagsValues:

Add cache tags using a list of values.

operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
values: List[str]

A list of cache tag values.

class RulesetRuleSetCacheTagsRuleActionParametersAddCacheTagsExpression:

Add cache tags using an expression.

expression: str

An expression that evaluates to an array of cache tag values.

minLength1
operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
class RulesetRuleSetCacheTagsRuleActionParametersRemoveCacheTagsValues:

Remove cache tags using a list of values.

operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
values: List[str]

A list of cache tag values.

class RulesetRuleSetCacheTagsRuleActionParametersRemoveCacheTagsExpression:

Remove cache tags using an expression.

expression: str

An expression that evaluates to an array of cache tag values.

minLength1
operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
class RulesetRuleSetCacheTagsRuleActionParametersSetCacheTagsValues:

Set cache tags using a list of values.

operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
values: List[str]

A list of cache tag values.

class RulesetRuleSetCacheTagsRuleActionParametersSetCacheTagsExpression:

Set cache tags using an expression.

expression: str

An expression that evaluates to an array of cache tag values.

minLength1
operation: Literal["add", "remove", "set"]

The operation to perform on the cache tags.

One of the following:
"add"
"remove"
"set"
categories: Optional[List[str]]

The categories of the rule.

description: Optional[str]

An informative description of the rule.

exposed_credential_check: Optional[RulesetRuleSetCacheTagsRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
logging: Optional[Logging]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

ratelimit: Optional[RulesetRuleSetCacheTagsRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: List[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
class RulesetRuleSetConfigurationRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleSkipRule:
id: str
action: str
enabled: bool
expression: str
ref: str
class RulesetRuleTransformResponseHTMLRule:
id: str

The unique ID of the rule.

action: Literal["transform_response_html"]

The action to perform when the rule matches.

enabled: bool
expression: str

The expression defining which traffic will match the rule.

minLength1
last_updated: datetime

The timestamp of when the rule was last modified.

formatdate-time
ref: str

The reference of the rule (the rule’s ID by default).

minLength1
version: str

The version of the rule.

action_parameters: Optional[RulesetRuleTransformResponseHTMLRuleActionParameters]

The parameters configuring the rule’s action.

categories: Optional[List[str]]

The categories of the rule.

description: Optional[str]

An informative description of the rule.

exposed_credential_check: Optional[RulesetRuleTransformResponseHTMLRuleExposedCredentialCheck]

Configuration for exposed credential checking.

password_expression: str

An expression that selects the password used in the credentials check.

minLength1
username_expression: str

An expression that selects the user ID used in the credentials check.

minLength1
logging: Optional[Logging]

An object configuring the rule’s logging behavior.

enabled: bool

Whether to generate a log when the rule matches.

ratelimit: Optional[RulesetRuleTransformResponseHTMLRuleRatelimit]

An object configuring the rule’s rate limit behavior.

characteristics: List[str]

Characteristics of the request on which the rate limit counter will be incremented.

period: int

Period in seconds over which the counter is being incremented.

minimum0
counting_expression: Optional[str]

An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.

minLength1
mitigation_timeout: Optional[int]

Period of time in seconds after which the action will be disabled following its first execution.

requests_per_period: Optional[int]

The threshold of requests per period after which the action will be executed for the first time.

minimum1
requests_to_origin: Optional[bool]

Whether counting is only performed when an origin is reached.

score_per_period: Optional[int]

The score threshold per period for which the action will be executed the first time.

score_response_header_name: Optional[str]

A response header name provided by the origin, which contains the score to increment rate limit counter with.

minLength1
version: str

The version of the ruleset.

description: Optional[str]

An informative description of the ruleset.

Optional[object]

Returned when dry_run is true.

Create an account or zone ruleset rule

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
rule = client.rulesets.rules.create(
    ruleset_id="2f2feab2026849078ba485f918791bdc",
    account_id="account_id",
)
print(rule)
{
  "errors": [
    {
      "message": "something bad happened",
      "code": 10000,
      "source": {
        "pointer": "/rules/0/action"
      }
    }
  ],
  "messages": [
    {
      "message": "something bad happened",
      "code": 10000,
      "source": {
        "pointer": "/rules/0/action"
      }
    }
  ],
  "result": {
    "id": "2f2feab2026849078ba485f918791bdc",
    "kind": "root",
    "last_updated": "2000-01-01T00:00:00Z",
    "name": "My ruleset",
    "phase": "http_request_firewall_custom",
    "rules": [
      {
        "last_updated": "2000-01-01T00:00:00Z",
        "version": "1",
        "id": "id",
        "action": "action",
        "action_parameters": {
          "response": {
            "content": "{\n  \"success\": false,\n  \"error\": \"you have been blocked\"\n}",
            "content_type": "application/json",
            "status_code": 400
          }
        },
        "categories": [
          "directory-traversal"
        ],
        "description": "Block the request.",
        "enabled": true,
        "exposed_credential_check": {
          "password_expression": "url_decode(http.request.body.form[\\\"password\\\"][0])",
          "username_expression": "url_decode(http.request.body.form[\\\"username\\\"][0])"
        },
        "expression": "expression",
        "logging": {
          "enabled": true
        },
        "ratelimit": {
          "characteristics": [
            "cf.colo.id"
          ],
          "period": 60,
          "counting_expression": "http.request.body.raw eq \"abcd\"",
          "mitigation_timeout": 600,
          "requests_per_period": 1000,
          "requests_to_origin": true,
          "score_per_period": 400,
          "score_response_header_name": "my-score"
        },
        "ref": "ref"
      }
    ],
    "version": "1",
    "description": "A description for my ruleset."
  },
  "success": true
}
Returns Examples
{
  "errors": [
    {
      "message": "something bad happened",
      "code": 10000,
      "source": {
        "pointer": "/rules/0/action"
      }
    }
  ],
  "messages": [
    {
      "message": "something bad happened",
      "code": 10000,
      "source": {
        "pointer": "/rules/0/action"
      }
    }
  ],
  "result": {
    "id": "2f2feab2026849078ba485f918791bdc",
    "kind": "root",
    "last_updated": "2000-01-01T00:00:00Z",
    "name": "My ruleset",
    "phase": "http_request_firewall_custom",
    "rules": [
      {
        "last_updated": "2000-01-01T00:00:00Z",
        "version": "1",
        "id": "id",
        "action": "action",
        "action_parameters": {
          "response": {
            "content": "{\n  \"success\": false,\n  \"error\": \"you have been blocked\"\n}",
            "content_type": "application/json",
            "status_code": 400
          }
        },
        "categories": [
          "directory-traversal"
        ],
        "description": "Block the request.",
        "enabled": true,
        "exposed_credential_check": {
          "password_expression": "url_decode(http.request.body.form[\\\"password\\\"][0])",
          "username_expression": "url_decode(http.request.body.form[\\\"username\\\"][0])"
        },
        "expression": "expression",
        "logging": {
          "enabled": true
        },
        "ratelimit": {
          "characteristics": [
            "cf.colo.id"
          ],
          "period": 60,
          "counting_expression": "http.request.body.raw eq \"abcd\"",
          "mitigation_timeout": 600,
          "requests_per_period": 1000,
          "requests_to_origin": true,
          "score_per_period": 400,
          "score_response_header_name": "my-score"
        },
        "ref": "ref"
      }
    ],
    "version": "1",
    "description": "A description for my ruleset."
  },
  "success": true
}