Adding Custom WAF Rules for Your Org

G8KEPR lets you extend the managed Web Application Firewall (WAF) with rules specific to your organization, so you can block, log, or challenge traffic that matches patterns unique to your APIs. Custom rules run alongside the built-in ruleset and are scoped to your org only.

Before you begin

• ▸You need an Admin or Owner role, or a custom role granted API Security permissions, for your organization.
• ▸Custom rules apply to all API traffic protected by G8KEPR for your org.
• ▸New and updated rules take effect once you save them.

Add a custom rule

1. 1.Go to API Security → WAF in the dashboard.
2. 2.Select Custom Rules, then Add rule.
3. 3.Give the rule a clear name and description so teammates understand its intent.
4. 4.Define the match condition (for example, a path pattern, header, method, or request signature).
5. 5.Choose an action: block, log, or challenge.
6. 6.Save. The rule activates for your org once saved.

Choose an action

• ▸`block` — Reject the matching request and return an error to the client. Use for traffic you're confident is malicious or disallowed.
• ▸`log` — Allow the request but record the match. Ideal for testing a new rule before enforcing it.
• ▸`challenge` — Require the client to pass a verification step before the request proceeds. Use to slow suspected abuse without hard-blocking legitimate users.

Load rules in bulk

You can define multiple rules and load them together, which is useful for keeping rules in version control. The example below shows the general shape of a rule set; the import screen lists the exact fields it accepts and validates your file before anything goes live.

{
  "rules": [
    {
      "name": "block-legacy-admin-path",
      "match": { "path": "/internal/admin/*" },
      "action": "block"
    },
    {
      "name": "challenge-high-rate-export",
      "match": { "path": "/v1/export", "method": "POST" },
      "action": "challenge"
    }
  ]
}

Upload the file from Custom Rules → Import, review the parsed rules, and confirm.

Review and adjust

• ▸Check the WAF activity view in the dashboard to see which rules fired and what action was taken.
• ▸Edit or disable any rule at any time; changes apply once saved.

For related settings, see API Security overview.