> ## Documentation Index > Fetch the complete documentation index at: https://docs.gcore.com/llms.txt > Use this file to discover all available pages before exploring further. # Create advanced rule ## OpenAPI ````yaml /api-reference/services_docs_mintlify_enriched/waap_api.yaml post /waap/v1/domains/{domain_id}/advanced-rules openapi: 3.1.0 info: title: Gcore OpenAPI – WAAP API description: >- This OpenAPI is an aggregated OpenAPI specification that unifies all Gcore products into a single file. It covers Cloud, CDN, DNS, WAAP, DDoS Protection, Object Storage, Streaming, and FastEdge services. contact: email: support@gcore.com version: bc9130169b96 servers: - url: https://api.gcore.com security: - APIKey: [] tags: - name: API Discovery - name: Advanced Rules - name: Analytics - name: Custom Page Sets - name: Custom Rules - name: Domains - name: Filter Templates - name: Firewall Rules - name: IP Reputation - name: IP Spotlight - name: Network Organizations - name: Policies - name: Policy Overrides - name: Pre-billing - name: Security Insights - name: Tags - name: WAAP Service paths: /waap/v1/domains/{domain_id}/advanced-rules: post: tags: - Advanced Rules summary: Create advanced rule operationId: create_advanced_rule_v1_domains__domain_id__advanced_rules_post parameters: - name: domain_id in: path required: true schema: type: integer exclusiveMinimum: 0 description: The domain ID title: Domain Id description: The domain ID requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AdvancedRule' responses: '201': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/AdvancedRuleResponse' '400': content: application/problem+json: schema: $ref: '#/components/schemas/APIError' example: type: http-bad-request title: Bad Request status: 400 detail: 'Invalid domain name: ''''''''' description: Bad Request '401': description: Unauthorized content: application/problem+json: example: detail: Auth token is missing or invalid '403': description: Quota limit exceeded content: application/problem+json: example: title: Quota limit exceeded type: quota-check-limit-exceeded status: 403 detail: >- You have reached the maximum limit allowed for your current plan. Please upgrade your plan to add more. '404': description: Resource not found content: application/problem+json: example: title: Resource not found type: quota-check-no-resource status: 404 detail: >- The quota resource requested does not exist. Cannot enable WAAP for this domain. Please reach out to our support team. '422': content: application/problem+json: schema: $ref: '#/components/schemas/APICompositeError' example: type: request-validation-failed title: Request validation error. status: 422 detail: One or more fields have validation errors. errors: - loc: - body - name detail: Input should be a valid string - loc: - body - date detail: Field required - loc: - query - limit detail: Field required description: Unprocessable Entity '500': content: application/problem+json: schema: $ref: '#/components/schemas/APIError' example: type: internal-server-error title: Internal server error. status: 500 detail: >- An unexpected condition was encountered which prevented the server from fulfilling the request. description: Internal Server Error x-codeSamples: - lang: Python source: |- import os from gcore import Gcore client = Gcore( api_key=os.environ.get("GCORE_API_KEY"), # This is the default and can be omitted ) waap_advanced_rule = client.waap.domains.advanced_rules.create( domain_id=1, action={}, enabled=True, name="Block foobar bot", source="request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session']", ) print(waap_advanced_rule.id) - lang: Go source: "package main\n\nimport (\n\t\"context\"\n\t\"fmt\"\n\n\t\"github.com/G-Core/gcore-go\"\n\t\"github.com/G-Core/gcore-go/option\"\n\t\"github.com/G-Core/gcore-go/waap\"\n)\n\nfunc main() {\n\tclient := gcore.NewClient(\n\t\toption.WithAPIKey(\"My API Key\"),\n\t)\n\twaapAdvancedRule, err := client.Waap.Domains.AdvancedRules.New(\n\t\tcontext.TODO(),\n\t\t1,\n\t\twaap.DomainAdvancedRuleNewParams{\n\t\t\tAction: waap.DomainAdvancedRuleNewParamsAction{},\n\t\t\tEnabled: true,\n\t\t\tName: \"Block foobar bot\",\n\t\t\tSource: \"request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session']\",\n\t\t},\n\t)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\tfmt.Printf(\"%+v\\n\", waapAdvancedRule.ID)\n}\n" components: schemas: AdvancedRule: properties: name: type: string maxLength: 100 minLength: 1 pattern: ^[A-Za-z0-9\s.:'";<>?&|\\_-]+$ title: Name description: The name assigned to the rule example: Block foobar bot examples: - Block foobar bot description: type: string maxLength: 100 title: Description description: A human-readable description. default: '' enabled: type: boolean title: Enabled description: Whether or not the rule is enabled action: $ref: '#/components/schemas/CustomerRuleAction' description: >- The action that the rule takes when triggered. Only one action can be set per rule. source: type: string minLength: 1 title: Source description: >- A CEL syntax expression that contains the rule's conditions. Allowed objects are: request, whois, session, response, tags, `user_defined_tags`, `user_agent`, `client_data`. More info can be found here: https://gcore.com/docs/waap/waap-rules/advanced-rules example: >- request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session'] examples: - >- request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session'] phase: anyOf: - type: string enum: - access - header_filter - body_filter - type: 'null' title: Phase description: >- The WAAP request/response phase for applying the rule. Default is "access". The "access" phase is responsible for modifying the request before it is sent to the origin server. The "header_filter" phase is responsible for modifying the HTTP headers of a response before they are sent back to the client. The "body_filter" phase is responsible for modifying the body of a response before it is sent back to the client. default: access type: object required: - name - enabled - action - source title: AdvancedRule description: A request to create a new advanced rule AdvancedRuleResponse: properties: name: type: string maxLength: 100 minLength: 1 pattern: ^[A-Za-z0-9\s.:'";<>?&|\\_-]+$ title: Name description: The name assigned to the rule example: Block foobar bot examples: - Block foobar bot description: type: string maxLength: 100 title: Description description: A human-readable description. default: '' enabled: type: boolean title: Enabled description: Whether or not the rule is enabled action: $ref: '#/components/schemas/CustomerRuleAction' description: >- The action that the rule takes when triggered. Only one action can be set per rule. source: type: string minLength: 1 title: Source description: >- A CEL syntax expression that contains the rule's conditions. Allowed objects are: request, whois, session, response, tags, `user_defined_tags`, `user_agent`, `client_data`. More info can be found here: https://gcore.com/docs/waap/waap-rules/advanced-rules example: >- request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session'] examples: - >- request.rate_limit([], '.*events', 5, 200, [], [], '', 'ip') and not ('mb-web-ui' in request.headers['Cookie'] or 'mb-mobile-ios' in request.headers['Cookie'] or 'session-token' in request.headers['Cookie']) and not request.headers['session'] phase: anyOf: - type: string enum: - access - header_filter - body_filter - type: 'null' title: Phase description: >- The WAAP request/response phase for applying the rule. Default is "access". The "access" phase is responsible for modifying the request before it is sent to the origin server. The "header_filter" phase is responsible for modifying the HTTP headers of a response before they are sent back to the client. The "body_filter" phase is responsible for modifying the body of a response before it is sent back to the client. default: access id: type: integer title: Id description: The unique identifier for the rule type: object required: - name - enabled - action - source - id title: AdvancedRuleResponse description: An advanced WAAP rule applied to a domain APIError: properties: type: type: string title: Type description: A URI identifier that categorizes the type of error. title: type: string title: Title description: A brief, human-readable title for the error. status: type: integer title: Status description: The HTTP status code applicable to this error. detail: anyOf: - type: string - type: 'null' title: Detail description: A detailed human-readable explanation of the error. type: object required: - type - title - status - detail title: APIError APICompositeError: properties: type: type: string title: Type description: A URI identifier that categorizes the type of error. title: type: string title: Title description: A brief, human-readable title for the error. status: type: integer title: Status description: The HTTP status code applicable to this error. detail: anyOf: - type: string - type: 'null' title: Detail description: A detailed human-readable explanation of the error. errors: items: $ref: '#/components/schemas/APIFieldError' type: array title: Errors description: A list of detailed errors for individual fields. type: object required: - type - title - status - detail - errors title: APICompositeError CustomerRuleAction: properties: allow: $ref: '#/components/schemas/RuleAllowAction' block: $ref: '#/components/schemas/RuleBlockAction' captcha: $ref: '#/components/schemas/RuleCaptchaAction' handshake: $ref: '#/components/schemas/RuleHandshakeAction' monitor: $ref: '#/components/schemas/RuleMonitorAction' tag: $ref: '#/components/schemas/RuleTagAction' additionalProperties: false type: object title: CustomerRuleAction description: The action that a WAAP rule takes when triggered. APIFieldError: properties: loc: anyOf: - items: anyOf: - type: integer - type: string type: array - {} title: Loc description: The location of the field or a character number causing the error. detail: type: string title: Detail description: A human-readable message describing the error. type: object required: - loc - detail title: APIFieldError RuleAllowAction: properties: {} additionalProperties: true type: object title: RuleAllowAction description: The WAAP allows the request RuleBlockAction: properties: status_code: $ref: '#/components/schemas/RuleBlockStatusCode' description: >- An HTTP status code that the WAAP returns if a rule blocks a request. default: 403 action_duration: type: string maxLength: 10 minLength: 1 pattern: ^[1-9][0-9]*[smhd]?$ title: Action Duration description: >- How long a rule's block action will apply to subsequent requests. Can be specified in seconds or by using a numeral followed by 's', 'm', 'h', or 'd' to represent time format (seconds, minutes, hours, or days). Empty time intervals are not allowed. If not specified, the action is applied only to the request that triggers the rule. example: 12h examples: - 12h - 60s - '30' additionalProperties: false type: object title: RuleBlockAction description: >- WAAP block action behavior could be configured with response status code and action duration. RuleCaptchaAction: properties: {} additionalProperties: true type: object title: RuleCaptchaAction description: The WAAP presents the user with a captcha RuleHandshakeAction: properties: {} additionalProperties: true type: object title: RuleHandshakeAction description: The WAAP performs automatic browser validation RuleMonitorAction: properties: {} additionalProperties: true type: object title: RuleMonitorAction description: The WAAP monitors the request but takes no action RuleTagAction: properties: tags: items: type: string type: array maxItems: 5 minItems: 1 title: Tags description: The list of user defined tags to tag the request with type: object required: - tags title: RuleTagAction description: WAAP tag action gets a list of tags to tag the request scope with RuleBlockStatusCode: type: integer enum: - 403 - 405 - 418 - 429 title: RuleBlockStatusCode description: Designates the HTTP status code to deliver when a request is blocked. securitySchemes: APIKey: description: >- API key for authentication. Make sure to include the word `apikey`, followed by a single space and then your token. Example: `apikey 1234_abcdef` type: apiKey in: header name: Authorization ````