Docs

Web Application Firewall

Call method

Public parameters

This article introduces the public parameters that must be passed when calling the API. Public parameters generally include OpenAPI version and authentication information. This part of the parameters will not be repeated in the specific API interface documentation. Please carry this part of the parameters when requesting the API, otherwise the request will not pass the legality verification. Signature parameters can be in Query or in Header, but Action and Version must be in Query.

Action and Version

Parameter	Data type	Required	Description	Sample value
Action	String	Yes	The name of the interface. Consistent with the actual business interface name.	CreateBlockRule
Version	String	Yes	The version of the interface. The OpenAPI versions provided by the Web Application Firewall are 2020-12-09, 2022-12-09, and 2023-12-25. Please refer to the detailed description of the corresponding interface for specifics.	2023-12-25

Header signature parameters

Parameter	Data type	Required	Note
X-Expires	Integer	No	The effective time of the signature, in seconds. If not filled, the default value is 900.
X-Date	String	Yes	Use UTC time, accurate to seconds. Format is YYYYMMDD'T'HHMMSS'Z', for example: 20201103T104027Z.
Authorization	String	Yes	HMAC-SHA256 Credential={AccessKeyId}/{ShortDate}/{Region}/{Service}/request, SignedHeaders={SignedHeaders}, Signature={Signature}<br>Where: AccessKeyId (String): The Access Key ID of the account initiating the request. For example: AKLTNGU0OGEyMT*. ShortDate (String): Short time requested, using UTC time, accurate to the day. Please use the format: YYYYMMDD, for example: 20230201. Region (String): The requested region, for example: cn-beijing. The requested region must match the region where the purchased instance is located. The corresponding relationship can refer to region information. Service (String): Requested service. The product associated with the OpenAPI provided by the Web Application Firewall is waf. SignedHeaders (String): Headers participating in signing, separated by semicolons. Signature (String): The computed signature. For example: da4fac562d00f41ad8*
X-Security-Token	String	No	Refers to the SessionToken in the temporary security credential issued by the Security Token Service (STS). This parameter is not required when using a long-term key.

Query signature parameters

Parameter	Data type	Required	Note
X-Expires	Integer	No	Signature valid time, in seconds, defaults to 900 when not filled out.
X-Date	String	Yes	Use UTC time, accurate to seconds. Format is YYYYMMDD'T'HHMMSS'Z', for example: 20201103T104027Z.
X-Algorithm	String	Yes	Fixed value: HMAC-SHA256.
X-Credential	String	Yes	Authentication information, consisting of {AccessKeyId}/{ShortDate}/{Region}/{Service}/request. Among them: AccessKeyId (String): The Access Key ID of the account initiating the request. ShortDate (String): The short date of the request, using UTC time, accurate to the day. Please use the format: YYYYMMDD, for example: 20180201. Region (String): The requested region, for example: cn-beijing. Service (String): The requested service.
X-SignedHeaders	String	Yes	The Headers involved in the signature, separated by semicolons.
X-Signature	String	Yes	Computed signature.

Last updated: 2025.06.30 16:24:58