--- title: Update Fraud Detection Settings --- [Skip to content](#%5Ftop) [API Reference](https://developers.cloudflare.com/api/typescript) [Fraud](https://developers.cloudflare.com/api/typescript/resources/fraud) Copy Markdown Open in **Claude** Open in **ChatGPT** Open in **Cursor** --- **Copy Markdown** **View as Markdown** # Update Fraud Detection Settings client.fraud.update(FraudUpdateParams { zone\_id, authentication\_settings, user\_profiles, username\_expressions } params, RequestOptionsoptions?): [FraudSettings](https://developers.cloudflare.com/api/typescript/resources/fraud#%28resource%29%20fraud%20%3E%20%28model%29%20fraud%5Fsettings%20%3E%20%28schema%29) { authentication\_settings, user\_profiles, username\_expressions } PUT/zones/{zone\_id}/fraud\_detection/settings Update Fraud Detection settings for a zone. Notes on `username_expressions` behavior: * If omitted or set to null, expressions are not modified. * If provided as an empty array `[]`, all expressions will be cleared. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` API Email + API Key The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**`X-Auth-Email: user@example.com` The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**`X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194` ##### Accepted Permissions (at least one required) `Fraud Detection Write` ##### ParametersExpand Collapse params: FraudUpdateParams { zone\_id, authentication\_settings, user\_profiles, username\_expressions } zone\_id: string Path param: Identifier. maxLength32 authentication\_settings?: [AuthenticationSettings](https://developers.cloudflare.com/api/typescript/resources/fraud/methods/update#%28resource%29%20fraud%20%3E%20%28method%29%20update%20%3E%20%28params%29%20default%20%3E%20%28param%29%20authentication%5Fsettings%20%3E%20%28schema%29) Body param: Configuration for classifying login authentication outcomes based on the origin response. Requires `user_profiles` to be enabled. * Success and failure criteria are independently updatable — sending only `success_criteria`leaves failure codes untouched, and vice versa. * Omit `authentication_settings` entirely to leave both unchanged. * Status codes must not overlap between success and failure criteria. failure\_criteria?: FailureCriteria { kind, status\_codes } Criterion for identifying failed login responses. kind: "status\_code" The type of criterion. Currently only `status_code` is supported. status\_codes?: Array HTTP status codes to match against the origin response. * Maximum of 10 codes per criterion. * Each code must be a valid HTTP status code (100-599). * Codes are deduplicated and sorted on save. * Omit to leave unchanged on update. * Provide an empty array `[]` to clear codes on update. success\_criteria?: SuccessCriteria { kind, status\_codes } Criterion for identifying successful login responses. kind: "status\_code" The type of criterion. Currently only `status_code` is supported. status\_codes?: Array HTTP status codes to match against the origin response. * Maximum of 10 codes per criterion. * Each code must be a valid HTTP status code (100-599). * Codes are deduplicated and sorted on save. * Omit to leave unchanged on update. * Provide an empty array `[]` to clear codes on update. user\_profiles?: "enabled" | "disabled" Body param: Whether Fraud User Profiles is enabled for the zone. One of the following: "enabled" "disabled" username\_expressions?: Array Body param: List of expressions to detect usernames in write HTTP requests. * Maximum of 10 expressions. * Omit or set to null to leave unchanged on update. * Provide an empty array `[]` to clear all expressions on update. * Invalid expressions will result in a 10400 Bad Request with details in the `messages` array. ##### ReturnsExpand Collapse FraudSettings { authentication\_settings, user\_profiles, username\_expressions } authentication\_settings?: AuthenticationSettings { failure\_criteria, success\_criteria } Configuration for classifying login authentication outcomes based on the origin response. Requires `user_profiles` to be enabled. * Success and failure criteria are independently updatable — sending only `success_criteria`leaves failure codes untouched, and vice versa. * Omit `authentication_settings` entirely to leave both unchanged. * Status codes must not overlap between success and failure criteria. failure\_criteria?: FailureCriteria { kind, status\_codes } Criterion for identifying failed login responses. kind: "status\_code" The type of criterion. Currently only `status_code` is supported. status\_codes?: Array HTTP status codes to match against the origin response. * Maximum of 10 codes per criterion. * Each code must be a valid HTTP status code (100-599). * Codes are deduplicated and sorted on save. * Omit to leave unchanged on update. * Provide an empty array `[]` to clear codes on update. success\_criteria?: SuccessCriteria { kind, status\_codes } Criterion for identifying successful login responses. kind: "status\_code" The type of criterion. Currently only `status_code` is supported. status\_codes?: Array HTTP status codes to match against the origin response. * Maximum of 10 codes per criterion. * Each code must be a valid HTTP status code (100-599). * Codes are deduplicated and sorted on save. * Omit to leave unchanged on update. * Provide an empty array `[]` to clear codes on update. user\_profiles?: "enabled" | "disabled" Whether Fraud User Profiles is enabled for the zone. One of the following: "enabled" "disabled" username\_expressions?: Array List of expressions to detect usernames in write HTTP requests. * Maximum of 10 expressions. * Omit or set to null to leave unchanged on update. * Provide an empty array `[]` to clear all expressions on update. * Invalid expressions will result in a 10400 Bad Request with details in the `messages` array. ### Update Fraud Detection Settings TypeScript HTTPHTTP TypeScriptTypeScript PythonPython GoGo TerraformTerraform ``` import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); const fraudSettings = await client.fraud.update({ zone_id: '023e105f4ecef8ad9ca31a8372d0c353', username_expressions: [], }); console.log(fraudSettings.authentication_settings); ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "authentication_settings": { "failure_criteria": { "kind": "status_code", "status_codes": [ 200, 201 ] }, "success_criteria": { "kind": "status_code", "status_codes": [ 200, 201 ] } }, "user_profiles": "disabled", "username_expressions": [ "http.request.body.form[\"username\"][0]", "lookup_json_string(http.request.body.raw, \"username\")" ] } } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "authentication_settings": { "failure_criteria": { "kind": "status_code", "status_codes": [ 200, 201 ] }, "success_criteria": { "kind": "status_code", "status_codes": [ 200, 201 ] } }, "user_profiles": "disabled", "username_expressions": [ "http.request.body.form[\"username\"][0]", "lookup_json_string(http.request.body.raw, \"username\")" ] } } ```