{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-azure-cdn/json-schema/microsoft-azure-cdn-cdn-web-application-firewall-policy-schema.json",
  "title": "CdnWebApplicationFirewallPolicy",
  "description": "Defines web application firewall policy for Azure CDN.",
  "x-generated": "2026-11-05",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/_superseded/microsoft-azure-cdn-cdnwebapplicationfirewallpolicies-api-openapi.yml#/components/schemas/CdnWebApplicationFirewallPolicy",
  "type": "object",
  "properties": {
    "properties": {
      "$ref": "#/$defs/CdnWebApplicationFirewallPolicyProperties",
      "description": "Properties of the web application firewall policy.",
      "x-ms-client-flatten": true
    },
    "etag": {
      "type": "string",
      "description": "Gets a unique read-only string that changes whenever the resource is updated."
    },
    "sku": {
      "$ref": "#/$defs/Sku",
      "description": "The pricing tier (defines a CDN provider, feature list and rate) of the CdnWebApplicationFirewallPolicy."
    }
  },
  "required": [
    "sku"
  ],
  "allOf": [
    {
      "$ref": "../../../../../../common-types/resource-management/v6/types.json#/definitions/TrackedResource"
    }
  ],
  "$defs": {
    "ActionType": {
      "type": "string",
      "description": "Defines the action to take on rule match.",
      "enum": [
        "Allow",
        "Block",
        "Log",
        "Redirect"
      ],
      "x-ms-enum": {
        "name": "ActionType",
        "modelAsString": true,
        "values": [
          {
            "name": "Allow",
            "value": "Allow"
          },
          {
            "name": "Block",
            "value": "Block"
          },
          {
            "name": "Log",
            "value": "Log"
          },
          {
            "name": "Redirect",
            "value": "Redirect"
          }
        ]
      }
    },
    "CdnEndpoint": {
      "type": "object",
      "description": "Defines the ARM Resource ID for the linked endpoints",
      "properties": {
        "id": {
          "type": "string",
          "description": "ARM Resource ID string."
        }
      }
    },
    "CdnWebApplicationFirewallPolicyProperties": {
      "type": "object",
      "description": "Defines CDN web application firewall policy properties.",
      "properties": {
        "policySettings": {
          "$ref": "#/$defs/policySettings",
          "description": "Describes  policySettings for policy"
        },
        "rateLimitRules": {
          "$ref": "#/$defs/RateLimitRuleList",
          "description": "Describes rate limit rules inside the policy."
        },
        "customRules": {
          "$ref": "#/$defs/CustomRuleList",
          "description": "Describes custom rules inside the policy."
        },
        "managedRules": {
          "$ref": "#/$defs/ManagedRuleSetList",
          "description": "Describes managed rules inside the policy."
        },
        "endpointLinks": {
          "type": "array",
          "description": "Describes Azure CDN endpoints associated with this Web Application Firewall policy.",
          "items": {
            "$ref": "#/$defs/CdnEndpoint"
          },
          "readOnly": true
        },
        "extendedProperties": {
          "type": "object",
          "description": "Key-Value pair representing additional properties for Web Application Firewall policy.",
          "additionalProperties": {
            "type": "string"
          }
        },
        "provisioningState": {
          "$ref": "#/$defs/ProvisioningState",
          "description": "Provisioning state of the WebApplicationFirewallPolicy.",
          "readOnly": true
        },
        "resourceState": {
          "$ref": "#/$defs/PolicyResourceState",
          "description": "Resource status of the policy.",
          "readOnly": true
        }
      }
    },
    "CustomRule": {
      "type": "object",
      "description": "Defines the common attributes for a custom rule that can be included in a waf policy",
      "properties": {
        "name": {
          "type": "string",
          "description": "Defines the name of the custom rule"
        },
        "enabledState": {
          "$ref": "#/$defs/CustomRuleEnabledState",
          "description": "Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified."
        },
        "priority": {
          "type": "integer",
          "format": "int32",
          "description": "Defines in what order this rule be evaluated in the overall list of custom rules",
          "minimum": 0,
          "maximum": 1000
        },
        "matchConditions": {
          "type": "array",
          "description": "List of match conditions.",
          "items": {
            "$ref": "#/$defs/MatchCondition"
          },
          "x-ms-identifiers": []
        },
        "action": {
          "$ref": "#/$defs/ActionType",
          "description": "Describes what action to be applied when rule matches"
        }
      },
      "required": [
        "name",
        "priority",
        "matchConditions",
        "action"
      ]
    },
    "CustomRuleEnabledState": {
      "type": "string",
      "description": "Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "CustomRuleEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled"
          }
        ]
      }
    },
    "CustomRuleList": {
      "type": "object",
      "description": "Defines contents of custom rules",
      "properties": {
        "rules": {
          "type": "array",
          "description": "List of rules",
          "items": {
            "$ref": "#/$defs/CustomRule"
          },
          "x-ms-identifiers": [
            "name"
          ]
        }
      }
    },
    "ManagedRuleEnabledState": {
      "type": "string",
      "description": "Describes if the managed rule is in enabled or disabled state.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "ManagedRuleEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled"
          }
        ]
      }
    },
    "ManagedRuleGroupOverride": {
      "type": "object",
      "description": "Defines a managed rule group override setting.",
      "properties": {
        "ruleGroupName": {
          "type": "string",
          "description": "Describes the managed rule group within the rule set to override"
        },
        "rules": {
          "type": "array",
          "description": "List of rules that will be enabled. If none specified, all rules in the group will be disabled.",
          "items": {
            "$ref": "#/$defs/ManagedRuleOverride"
          },
          "x-ms-identifiers": [
            "ruleId"
          ]
        }
      },
      "required": [
        "ruleGroupName"
      ]
    },
    "ManagedRuleOverride": {
      "type": "object",
      "description": "Defines a managed rule group override setting.",
      "properties": {
        "ruleId": {
          "type": "string",
          "description": "Identifier for the managed rule."
        },
        "enabledState": {
          "$ref": "#/$defs/ManagedRuleEnabledState",
          "description": "Describes if the managed rule is in enabled or disabled state. Defaults to Disabled if not specified."
        },
        "action": {
          "$ref": "#/$defs/ActionType",
          "description": "Describes the override action to be applied when rule matches."
        }
      },
      "required": [
        "ruleId"
      ]
    },
    "ManagedRuleSet": {
      "type": "object",
      "description": "Defines a managed rule set.",
      "properties": {
        "ruleSetType": {
          "type": "string",
          "description": "Defines the rule set type to use."
        },
        "ruleSetVersion": {
          "type": "string",
          "description": "Defines the version of the rule set to use."
        },
        "anomalyScore": {
          "type": "integer",
          "format": "int32",
          "description": "Verizon only : If the rule set supports anomaly detection mode, this describes the threshold for blocking requests.",
          "minimum": 0,
          "maximum": 20
        },
        "ruleGroupOverrides": {
          "type": "array",
          "description": "Defines the rule overrides to apply to the rule set.",
          "items": {
            "$ref": "#/$defs/ManagedRuleGroupOverride"
          },
          "x-ms-identifiers": [
            "ruleGroupName"
          ]
        }
      },
      "required": [
        "ruleSetType",
        "ruleSetVersion"
      ]
    },
    "ManagedRuleSetList": {
      "type": "object",
      "description": "Defines the list of managed rule sets for the policy.",
      "properties": {
        "managedRuleSets": {
          "type": "array",
          "description": "List of rule sets.",
          "items": {
            "$ref": "#/$defs/ManagedRuleSet"
          },
          "x-ms-identifiers": [
            "ruleSetType",
            "ruleSetVersion"
          ]
        }
      }
    },
    "MatchCondition": {
      "type": "object",
      "description": "Define match conditions",
      "properties": {
        "matchVariable": {
          "$ref": "#/$defs/WafMatchVariable",
          "description": "Match variable to compare against."
        },
        "selector": {
          "type": "string",
          "description": "Selector can used to match a specific key for QueryString, Cookies, RequestHeader or PostArgs."
        },
        "operator": {
          "$ref": "#/$defs/Operator",
          "description": "Describes operator to be matched"
        },
        "negateCondition": {
          "type": "boolean",
          "description": "Describes if the result of this condition should be negated."
        },
        "matchValue": {
          "type": "array",
          "description": "List of possible match values.",
          "items": {
            "type": "string"
          }
        },
        "transforms": {
          "type": "array",
          "description": "List of transforms.",
          "items": {
            "$ref": "#/$defs/TransformType"
          }
        }
      },
      "required": [
        "matchVariable",
        "operator",
        "matchValue"
      ]
    },
    "Operator": {
      "type": "string",
      "description": "Describes operator to be matched",
      "enum": [
        "Any",
        "IPMatch",
        "GeoMatch",
        "Equal",
        "Contains",
        "LessThan",
        "GreaterThan",
        "LessThanOrEqual",
        "GreaterThanOrEqual",
        "BeginsWith",
        "EndsWith",
        "RegEx"
      ],
      "x-ms-enum": {
        "name": "Operator",
        "modelAsString": true,
        "values": [
          {
            "name": "Any",
            "value": "Any"
          },
          {
            "name": "IPMatch",
            "value": "IPMatch"
          },
          {
            "name": "GeoMatch",
            "value": "GeoMatch"
          },
          {
            "name": "Equal",
            "value": "Equal"
          },
          {
            "name": "Contains",
            "value": "Contains"
          },
          {
            "name": "LessThan",
            "value": "LessThan"
          },
          {
            "name": "GreaterThan",
            "value": "GreaterThan"
          },
          {
            "name": "LessThanOrEqual",
            "value": "LessThanOrEqual"
          },
          {
            "name": "GreaterThanOrEqual",
            "value": "GreaterThanOrEqual"
          },
          {
            "name": "BeginsWith",
            "value": "BeginsWith"
          },
          {
            "name": "EndsWith",
            "value": "EndsWith"
          },
          {
            "name": "RegEx",
            "value": "RegEx"
          }
        ]
      }
    },
    "PolicyEnabledState": {
      "type": "string",
      "description": "Describes if the policy is in enabled or disabled state. Defaults to Enabled if not specified.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "PolicyEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled"
          }
        ]
      }
    },
    "PolicyMode": {
      "type": "string",
      "description": "Describes if it is in detection mode or prevention mode at policy level.",
      "enum": [
        "Prevention",
        "Detection"
      ],
      "x-ms-enum": {
        "name": "PolicyMode",
        "modelAsString": true,
        "values": [
          {
            "name": "Prevention",
            "value": "Prevention"
          },
          {
            "name": "Detection",
            "value": "Detection"
          }
        ]
      }
    },
    "PolicyResourceState": {
      "type": "string",
      "description": "Resource status of the policy.",
      "enum": [
        "Creating",
        "Enabling",
        "Enabled",
        "Disabling",
        "Disabled",
        "Deleting"
      ],
      "x-ms-enum": {
        "name": "PolicyResourceState",
        "modelAsString": true,
        "values": [
          {
            "name": "Creating",
            "value": "Creating"
          },
          {
            "name": "Enabling",
            "value": "Enabling"
          },
          {
            "name": "Enabled",
            "value": "Enabled"
          },
          {
            "name": "Disabling",
            "value": "Disabling"
          },
          {
            "name": "Disabled",
            "value": "Disabled"
          },
          {
            "name": "Deleting",
            "value": "Deleting"
          }
        ]
      }
    },
    "PolicySettingsDefaultCustomBlockResponseStatusCode": {
      "type": "number",
      "description": "If the action type is block, this field defines the default customer overridable http response status code.",
      "enum": [
        200,
        403,
        405,
        406,
        429
      ],
      "x-ms-enum": {
        "name": "PolicySettingsDefaultCustomBlockResponseStatusCode",
        "modelAsString": true,
        "values": [
          {
            "name": "200",
            "value": 200
          },
          {
            "name": "403",
            "value": 403
          },
          {
            "name": "405",
            "value": 405
          },
          {
            "name": "406",
            "value": 406
          },
          {
            "name": "429",
            "value": 429
          }
        ]
      }
    },
    "ProvisioningState": {
      "type": "string",
      "description": "Provisioning state of the WebApplicationFirewallPolicy.",
      "enum": [
        "Creating",
        "Succeeded",
        "Failed"
      ],
      "x-ms-enum": {
        "name": "ProvisioningState",
        "modelAsString": true,
        "values": [
          {
            "name": "Creating",
            "value": "Creating"
          },
          {
            "name": "Succeeded",
            "value": "Succeeded"
          },
          {
            "name": "Failed",
            "value": "Failed"
          }
        ]
      }
    },
    "RateLimitRule": {
      "type": "object",
      "description": "Defines a rate limiting rule that can be included in a waf policy",
      "properties": {
        "rateLimitThreshold": {
          "type": "integer",
          "format": "int32",
          "description": "Defines rate limit threshold.",
          "minimum": 0
        },
        "rateLimitDurationInMinutes": {
          "type": "integer",
          "format": "int32",
          "description": "Defines rate limit duration. Default is 1 minute.",
          "minimum": 0,
          "maximum": 60
        }
      },
      "required": [
        "rateLimitThreshold",
        "rateLimitDurationInMinutes"
      ],
      "allOf": [
        {
          "$ref": "#/$defs/CustomRule"
        }
      ]
    },
    "RateLimitRuleList": {
      "type": "object",
      "description": "Defines contents of rate limit rules",
      "properties": {
        "rules": {
          "type": "array",
          "description": "List of rules",
          "items": {
            "$ref": "#/$defs/RateLimitRule"
          },
          "x-ms-identifiers": [
            "name"
          ]
        }
      }
    },
    "Sku": {
      "type": "object",
      "description": "Standard_Verizon = The SKU name for a Standard Verizon CDN profile.\nPremium_Verizon = The SKU name for a Premium Verizon CDN profile.\nCustom_Verizon = The SKU name for a Custom Verizon CDN profile.\nStandard_Akamai = The SKU name for an Akamai CDN profile.\nStandard_ChinaCdn = The SKU name for a China CDN profile for VOD, Web and download scenarios using GB based billing model.\nStandard_Microsoft = The SKU name for a Standard Microsoft CDN profile.\nStandard_AzureFrontDoor =  The SKU name for an Azure Front Door Standard profile.\nPremium_AzureFrontDoor = The SKU name for an Azure Front Door Premium profile.\nStandard_955BandWidth_ChinaCdn = The SKU name for a China CDN profile for VOD, Web and download scenarios using 95-5 peak bandwidth billing model.\nStandard_AvgBandWidth_ChinaCdn = The SKU name for a China CDN profile for VOD, Web and download scenarios using monthly average peak bandwidth billing model.\nStandardPlus_ChinaCdn = The SKU name for a China CDN profile for live-streaming using GB based billing model.\nStandardPlus_955BandWidth_ChinaCdn = The SKU name for a China CDN live-streaming profile using 95-5 peak bandwidth billing model.\nStandardPlus_AvgBandWidth_ChinaCdn = The SKU name for a China CDN live-streaming profile using monthly average peak bandwidth billing model.",
      "properties": {
        "name": {
          "$ref": "#/$defs/SkuName",
          "description": "Name of the pricing tier."
        }
      }
    },
    "SkuName": {
      "type": "string",
      "description": "Name of the pricing tier.",
      "enum": [
        "Standard_Verizon",
        "Premium_Verizon",
        "Custom_Verizon",
        "Standard_Akamai",
        "Standard_ChinaCdn",
        "Standard_Microsoft",
        "Standard_AzureFrontDoor",
        "Premium_AzureFrontDoor",
        "Standard_955BandWidth_ChinaCdn",
        "Standard_AvgBandWidth_ChinaCdn",
        "StandardPlus_ChinaCdn",
        "StandardPlus_955BandWidth_ChinaCdn",
        "StandardPlus_AvgBandWidth_ChinaCdn"
      ],
      "x-ms-enum": {
        "name": "SkuName",
        "modelAsString": true,
        "values": [
          {
            "name": "Standard_Verizon",
            "value": "Standard_Verizon"
          },
          {
            "name": "Premium_Verizon",
            "value": "Premium_Verizon"
          },
          {
            "name": "Custom_Verizon",
            "value": "Custom_Verizon"
          },
          {
            "name": "Standard_Akamai",
            "value": "Standard_Akamai"
          },
          {
            "name": "Standard_ChinaCdn",
            "value": "Standard_ChinaCdn"
          },
          {
            "name": "Standard_Microsoft",
            "value": "Standard_Microsoft"
          },
          {
            "name": "Standard_AzureFrontDoor",
            "value": "Standard_AzureFrontDoor"
          },
          {
            "name": "Premium_AzureFrontDoor",
            "value": "Premium_AzureFrontDoor"
          },
          {
            "name": "Standard_955BandWidth_ChinaCdn",
            "value": "Standard_955BandWidth_ChinaCdn"
          },
          {
            "name": "Standard_AvgBandWidth_ChinaCdn",
            "value": "Standard_AvgBandWidth_ChinaCdn"
          },
          {
            "name": "StandardPlus_ChinaCdn",
            "value": "StandardPlus_ChinaCdn"
          },
          {
            "name": "StandardPlus_955BandWidth_ChinaCdn",
            "value": "StandardPlus_955BandWidth_ChinaCdn"
          },
          {
            "name": "StandardPlus_AvgBandWidth_ChinaCdn",
            "value": "StandardPlus_AvgBandWidth_ChinaCdn"
          }
        ]
      }
    },
    "TransformType": {
      "type": "string",
      "description": "Describes what transforms were applied before matching.",
      "enum": [
        "Lowercase",
        "Uppercase",
        "Trim",
        "UrlDecode",
        "UrlEncode",
        "RemoveNulls"
      ],
      "x-ms-enum": {
        "name": "TransformType",
        "modelAsString": true,
        "values": [
          {
            "name": "Lowercase",
            "value": "Lowercase"
          },
          {
            "name": "Uppercase",
            "value": "Uppercase"
          },
          {
            "name": "Trim",
            "value": "Trim"
          },
          {
            "name": "UrlDecode",
            "value": "UrlDecode"
          },
          {
            "name": "UrlEncode",
            "value": "UrlEncode"
          },
          {
            "name": "RemoveNulls",
            "value": "RemoveNulls"
          }
        ]
      }
    },
    "WafMatchVariable": {
      "type": "string",
      "description": "Match variable to compare against.",
      "enum": [
        "RemoteAddr",
        "SocketAddr",
        "RequestMethod",
        "RequestHeader",
        "RequestUri",
        "QueryString",
        "RequestBody",
        "Cookies",
        "PostArgs"
      ],
      "x-ms-enum": {
        "name": "WafMatchVariable",
        "modelAsString": true,
        "values": [
          {
            "name": "RemoteAddr",
            "value": "RemoteAddr"
          },
          {
            "name": "SocketAddr",
            "value": "SocketAddr"
          },
          {
            "name": "RequestMethod",
            "value": "RequestMethod"
          },
          {
            "name": "RequestHeader",
            "value": "RequestHeader"
          },
          {
            "name": "RequestUri",
            "value": "RequestUri"
          },
          {
            "name": "QueryString",
            "value": "QueryString"
          },
          {
            "name": "RequestBody",
            "value": "RequestBody"
          },
          {
            "name": "Cookies",
            "value": "Cookies"
          },
          {
            "name": "PostArgs",
            "value": "PostArgs"
          }
        ]
      }
    },
    "policySettings": {
      "type": "object",
      "description": "Defines contents of a web application firewall global configuration",
      "properties": {
        "enabledState": {
          "$ref": "#/$defs/PolicyEnabledState",
          "description": "describes if the policy is in enabled state or disabled state"
        },
        "mode": {
          "$ref": "#/$defs/PolicyMode",
          "description": "Describes if it is in detection mode or prevention mode at policy level."
        },
        "defaultRedirectUrl": {
          "type": "string",
          "description": "If action type is redirect, this field represents the default redirect URL for the client."
        },
        "defaultCustomBlockResponseStatusCode": {
          "$ref": "#/$defs/PolicySettingsDefaultCustomBlockResponseStatusCode",
          "description": "If the action type is block, this field defines the default customer overridable http response status code."
        },
        "defaultCustomBlockResponseBody": {
          "type": "string",
          "description": "If the action type is block, customer can override the response body. The body must be specified in base64 encoding.",
          "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$"
        }
      }
    }
  }
}