Docs

Web Application Firewall

Call method

Request structure

The call to the Console OpenAPI interface is completed by sending requests to the specified service address, which must meet the signature information and the specific interface business information. The OpenAPI request mainly consists of the request URL, request header, and request body.

Background information

Request method

Details of the request method can be found in the specific requirements of each interface, choose to initiate requests using GET or POST methods.

Communication protocol

Supports request communication through HTTP and HTTPS, it is recommended to use the more secure HTTPS method to send API requests.

Character encoding

Requests and return results are encoded using the UTF-8 character set.

Regional information

When you call the API, the Region information needs to be consistent with the ID of the region where the instance is located. The corresponding relationship is shown in the table below.

Region	ID
North China 2 (Beijing)	cn-beijing
East China 2 (Shanghai)	cn-shanghai
South China 1 (Guangzhou)	cn-guangzhou
Southeast Asia (Johor)	ap-southeast-1

Request composition

Request URL

You can invoke the Web Application Firewall's API by sending HTTP or HTTPS requests. The URL for initiating API requests consists of multiple parameters and has a fixed request structure. Both the request and the return results are encoded using the UTF-8 character set. \nThe format sample of the HTTPS request URL is as follows:

POST https://{Host}?Action={Action name}&Version={Registered version}

POST indicates the request method supported by the console's OpenAPI.

Host specifies the service access address (Endpoint), and the current access address is waf.volcengineapi.com.

Action={Action name} specifies the API to be invoked.

Version={Registered version} specifies the version of the API to be invoked.

Request Header

The request header (Header) needs to specify Content-Type and request authentication information as public parameters, used to identify the user and the interface signature. Unless necessary, these parameters will not be explained again in each individual interface document, but every request must carry these parameters to initiate the request properly. Among them, Content-Type specifies the structured format of the request message body, and the Content-Type of the web application firewall is fixed as application/json If the value of Content-Type is not specified during the request, the default is application/json format. Please refer to public parameters for a detailed list and description of parameters. The format of the request header is as follows:

X-Date: 20230711T035055Z​
Authorization: HMAC-SHA256 Credential=AKLTNGU0OGEyMT***/20230711/cn-beijing/waf/request, SignedHeaders=content-type;x-content-sha256;x-date, Signature=da4fac562d00f41ad8***​

X-Date refers to the time used for signing, using UTC time, accurate to the second. The format is YYYYMMDD'T'HHMMSS'Z', for example: 20230711T035055Z.

Authorization refers to the authorization information. The format is HMAC-SHA256 Credential={AccessKeyId}/{ShortDate}/{Region}/{Service}/request, SignedHeaders={SignedHeaders}, Signature={Signature}

AccessKeyId (String): The Access Key ID of the account making the request. For example: AKLTNGU0OGEyMT***.

ShortDate (String): The short date requested, using UTC time, accurate to the day. Formatted as YYYYMMDD, for example: 20230711.

Region (String): The geographical region requested, for example: cn-beijing.

tip

Region information needs to be consistent with the ID of the region where the instance is located. For specifics, please refer to region information.

Service (String): The service being requested. The service name of the Web Application Firewall is waf.

SignedHeaders (String): Headers participating in the signature, separated by semicolons. For example content-type;x-content-sha256;x-date.

Signature (String): The computed signature. The example is da4fac562d00f41ad8***.

Request Body

The request body, i.e., the request message body, mainly transmits business-related request parameters. If the parameters in the request message body support Chinese, then Chinese characters must be UTF-8 encoded. \nEach interface has different content in the request message body, and not every interface requires a request message body (i.e., the message body can be empty). When calling the interface, please refer to the specific API interface documentation to construct the request message body. \nFor example, here is the sample format of the request body for retrieving attack source information:

{​
  "Host": "example.volcwaf001.com",​
  "StartTime": 1695767322,​
  "EndTime": 1697185065,​
  "AnalysisKey": "Country",​
  "Plugins": [​
    "web_policy"​
  ]​
}​

Initiate request

You can use curl, Postman, or write code directly to send requests to call the API. \nFor example, here is the sample request for retrieving protection overview information:

POST https://waf.volcengineapi.com/?Action=QueryProtectionOverviewLb&Version=2023-12-25​
X-Date: 20230711T035055Z​
Authorization: HMAC-SHA256 Credential=AKLTNGU0OGEyMT***/20230711/cn-beijing/waf/request, SignedHeaders=content-type;x-content-sha256;x-date, Signature=da4fac562d00f41ad8***​
​
{​
  "Host": "example.volcwaf001.com",​
  "StartTime": 1695767322,​
  "EndTime": 1697185065,​
  "AnalysisKey": "Country",​
  "Plugins": [​
    "web_policy"​
  ]​
}​

Last updated: 2025.06.30 16:24:58