{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/microsoft-azure-front-door/json-schema/microsoft-azure-front-door-web-application-firewall-policy-schema.json",
  "title": "WebApplicationFirewallPolicy",
  "description": "Defines web application firewall policy.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/microsoft-azure-front-door-webapplicationfirewallpolicies-api-openapi.yml#/components/schemas/WebApplicationFirewallPolicy",
  "type": "object",
  "properties": {
    "properties": {
      "$ref": "#/$defs/WebApplicationFirewallPolicyProperties",
      "description": "Properties of the web application firewall policy.",
      "x-ms-client-flatten": true
    },
    "etag": {
      "type": "string",
      "description": "Gets a unique read-only string that changes whenever the resource is updated."
    },
    "sku": {
      "$ref": "#/$defs/Sku",
      "description": "The pricing tier of web application firewall policy. Defaults to Classic_AzureFrontDoor if not specified."
    }
  },
  "allOf": [
    {
      "$ref": "#/$defs/Resource"
    }
  ],
  "$defs": {
    "ActionType": {
      "type": "string",
      "description": "Defines the action to take on rule match.",
      "enum": [
        "Allow",
        "Block",
        "Log",
        "Redirect",
        "AnomalyScoring",
        "JSChallenge",
        "CAPTCHA"
      ],
      "x-ms-enum": {
        "name": "ActionType",
        "modelAsString": true,
        "values": [
          {
            "name": "Allow",
            "value": "Allow",
            "description": "Allow"
          },
          {
            "name": "Block",
            "value": "Block",
            "description": "Block"
          },
          {
            "name": "Log",
            "value": "Log",
            "description": "Log"
          },
          {
            "name": "Redirect",
            "value": "Redirect",
            "description": "Redirect"
          },
          {
            "name": "AnomalyScoring",
            "value": "AnomalyScoring",
            "description": "AnomalyScoring"
          },
          {
            "name": "JSChallenge",
            "value": "JSChallenge",
            "description": "JSChallenge"
          },
          {
            "name": "CAPTCHA",
            "value": "CAPTCHA",
            "description": "CAPTCHA"
          }
        ]
      }
    },
    "CustomRule": {
      "type": "object",
      "description": "Defines contents of a web application rule",
      "properties": {
        "name": {
          "type": "string",
          "description": "Describes the name of the rule.",
          "maxLength": 128
        },
        "priority": {
          "type": "integer",
          "format": "int32",
          "description": "Describes priority of the rule. Rules with a lower value will be evaluated before rules with a higher value."
        },
        "enabledState": {
          "$ref": "#/$defs/CustomRuleEnabledState",
          "description": "Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified."
        },
        "ruleType": {
          "$ref": "#/$defs/RuleType",
          "description": "Describes type of rule."
        },
        "rateLimitDurationInMinutes": {
          "type": "integer",
          "format": "int32",
          "description": "Time window for resetting the rate limit count. Default is 1 minute.",
          "minimum": 0,
          "maximum": 5
        },
        "rateLimitThreshold": {
          "type": "integer",
          "format": "int32",
          "description": "Number of allowed requests per client within the time window.",
          "minimum": 0
        },
        "groupBy": {
          "type": "array",
          "description": "Describes the list of variables to group the rate limit requests",
          "items": {
            "$ref": "#/$defs/GroupByVariable"
          },
          "x-ms-identifiers": []
        },
        "matchConditions": {
          "type": "array",
          "description": "List of match conditions.",
          "items": {
            "$ref": "#/$defs/MatchCondition"
          }
        },
        "action": {
          "$ref": "#/$defs/ActionType",
          "description": "Describes what action to be applied when rule matches."
        }
      },
      "required": [
        "priority",
        "ruleType",
        "matchConditions",
        "action"
      ]
    },
    "CustomRuleEnabledState": {
      "type": "string",
      "description": "Describes if the custom rule is in enabled or disabled state. Defaults to Enabled if not specified.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "CustomRuleEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          }
        ]
      }
    },
    "CustomRuleList": {
      "type": "object",
      "description": "Defines contents of custom rules",
      "properties": {
        "rules": {
          "type": "array",
          "description": "List of rules",
          "items": {
            "$ref": "#/$defs/CustomRule"
          }
        }
      }
    },
    "ExceptionMatchVariable": {
      "type": "string",
      "description": "The variable to be evaluated for excluding the request.",
      "enum": [
        "RequestUri",
        "SocketAddr",
        "RequestHeaderNames"
      ],
      "x-ms-enum": {
        "name": "ExceptionMatchVariable",
        "modelAsString": true,
        "values": [
          {
            "name": "RequestUri",
            "value": "RequestUri",
            "description": "Request Uri Exception Match Variable"
          },
          {
            "name": "SocketAddr",
            "value": "SocketAddr",
            "description": "Socket Address Exception Match Variable"
          },
          {
            "name": "RequestHeaderNames",
            "value": "RequestHeaderNames",
            "description": "Request Header Names Exception Match Variable"
          }
        ]
      }
    },
    "ExceptionSelectorMatchOperator": {
      "type": "string",
      "description": "Comparison operator to apply to the selector when specifying which elements in the collection this exception applies to..",
      "enum": [
        "Equals"
      ],
      "x-ms-enum": {
        "name": "ExceptionSelectorMatchOperator",
        "modelAsString": true,
        "values": [
          {
            "name": "Equals",
            "value": "Equals",
            "description": "Equals Selector Match Operator"
          }
        ]
      }
    },
    "ExceptionValueMatchOperator": {
      "type": "string",
      "description": "Comparison operator to apply to the value to be matched..",
      "enum": [
        "Equals",
        "Contains",
        "StartsWith",
        "EndsWith",
        "EqualsAny",
        "IPMatch"
      ],
      "x-ms-enum": {
        "name": "ExceptionValueMatchOperator",
        "modelAsString": true,
        "values": [
          {
            "name": "Equals",
            "value": "Equals",
            "description": "Equals Exception Value Match Operator"
          },
          {
            "name": "Contains",
            "value": "Contains",
            "description": "Contains Exception Value Match Operator"
          },
          {
            "name": "StartsWith",
            "value": "StartsWith",
            "description": "StartsWith Exception Value Match Operator"
          },
          {
            "name": "EndsWith",
            "value": "EndsWith",
            "description": "EndsWith Exception Value Match Operator"
          },
          {
            "name": "EqualsAny",
            "value": "EqualsAny",
            "description": "EqualsAny Exception Value Match Operator"
          },
          {
            "name": "IPMatch",
            "value": "IPMatch",
            "description": "IPMatch Exception Value Match Operator"
          }
        ]
      }
    },
    "FrontendEndpointLink": {
      "type": "object",
      "description": "Defines the Resource ID for a Frontend Endpoint.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID."
        }
      }
    },
    "GroupByVariable": {
      "type": "object",
      "description": "Describes the variables available to group the rate limit requests",
      "properties": {
        "variableName": {
          "$ref": "#/$defs/VariableName",
          "description": "Describes the supported variable for group by"
        }
      },
      "required": [
        "variableName"
      ]
    },
    "ManagedRuleEnabledState": {
      "type": "string",
      "description": "Describes if the managed rule is in enabled or disabled state.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "ManagedRuleEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          }
        ]
      }
    },
    "ManagedRuleExclusion": {
      "type": "object",
      "description": "Exclude variables from managed rule evaluation.",
      "properties": {
        "matchVariable": {
          "$ref": "#/$defs/ManagedRuleExclusionMatchVariable",
          "description": "The variable type to be excluded."
        },
        "selectorMatchOperator": {
          "$ref": "#/$defs/ManagedRuleExclusionSelectorMatchOperator",
          "description": "Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to."
        },
        "selector": {
          "type": "string",
          "description": "Selector value for which elements in the collection this exclusion applies to."
        }
      },
      "required": [
        "matchVariable",
        "selectorMatchOperator",
        "selector"
      ]
    },
    "ManagedRuleExclusionMatchVariable": {
      "type": "string",
      "description": "The variable type to be excluded.",
      "enum": [
        "RequestHeaderNames",
        "RequestCookieNames",
        "QueryStringArgNames",
        "RequestBodyPostArgNames",
        "RequestBodyJsonArgNames"
      ],
      "x-ms-enum": {
        "name": "ManagedRuleExclusionMatchVariable",
        "modelAsString": true,
        "values": [
          {
            "name": "RequestHeaderNames",
            "value": "RequestHeaderNames",
            "description": "RequestHeaderNames"
          },
          {
            "name": "RequestCookieNames",
            "value": "RequestCookieNames",
            "description": "RequestCookieNames"
          },
          {
            "name": "QueryStringArgNames",
            "value": "QueryStringArgNames",
            "description": "QueryStringArgNames"
          },
          {
            "name": "RequestBodyPostArgNames",
            "value": "RequestBodyPostArgNames",
            "description": "RequestBodyPostArgNames"
          },
          {
            "name": "RequestBodyJsonArgNames",
            "value": "RequestBodyJsonArgNames",
            "description": "RequestBodyJsonArgNames"
          }
        ]
      }
    },
    "ManagedRuleExclusionSelectorMatchOperator": {
      "type": "string",
      "description": "Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to.",
      "enum": [
        "Equals",
        "Contains",
        "StartsWith",
        "EndsWith",
        "EqualsAny"
      ],
      "x-ms-enum": {
        "name": "ManagedRuleExclusionSelectorMatchOperator",
        "modelAsString": true,
        "values": [
          {
            "name": "Equals",
            "value": "Equals",
            "description": "Equals"
          },
          {
            "name": "Contains",
            "value": "Contains",
            "description": "Contains"
          },
          {
            "name": "StartsWith",
            "value": "StartsWith",
            "description": "StartsWith"
          },
          {
            "name": "EndsWith",
            "value": "EndsWith",
            "description": "EndsWith"
          },
          {
            "name": "EqualsAny",
            "value": "EqualsAny",
            "description": "EqualsAny"
          }
        ]
      }
    },
    "ManagedRuleGroupOverride": {
      "type": "object",
      "description": "Defines a managed rule group override setting.",
      "properties": {
        "ruleGroupName": {
          "type": "string",
          "description": "Describes the managed rule group to override."
        },
        "exclusions": {
          "type": "array",
          "description": "Describes the exclusions that are applied to all rules in the group.",
          "items": {
            "$ref": "#/$defs/ManagedRuleExclusion"
          }
        },
        "rules": {
          "type": "array",
          "description": "List of rules that will be disabled. If none specified, all rules in the group will be disabled.",
          "items": {
            "$ref": "#/$defs/ManagedRuleOverride"
          }
        }
      },
      "required": [
        "ruleGroupName"
      ]
    },
    "ManagedRuleOverride": {
      "type": "object",
      "description": "Defines a managed rule group override setting.",
      "properties": {
        "ruleId": {
          "type": "string",
          "description": "Identifier for the managed rule."
        },
        "enabledState": {
          "$ref": "#/$defs/ManagedRuleEnabledState",
          "description": "Describes if the managed rule is in enabled or disabled state. Defaults to Disabled if not specified."
        },
        "action": {
          "$ref": "#/$defs/ActionType",
          "description": "Describes the override action to be applied when rule matches."
        },
        "sensitivity": {
          "$ref": "#/$defs/SensitivityType",
          "description": "Describes the override sensitivity to be applied when rule matches."
        },
        "exclusions": {
          "type": "array",
          "description": "Describes the exclusions that are applied to this specific rule.",
          "items": {
            "$ref": "#/$defs/ManagedRuleExclusion"
          }
        }
      },
      "required": [
        "ruleId"
      ]
    },
    "ManagedRuleSet": {
      "type": "object",
      "description": "Defines a managed rule set.",
      "properties": {
        "ruleSetType": {
          "type": "string",
          "description": "Defines the rule set type to use."
        },
        "ruleSetVersion": {
          "type": "string",
          "description": "Defines the version of the rule set to use."
        },
        "ruleSetAction": {
          "$ref": "#/$defs/ManagedRuleSetActionType",
          "title": "ruleSetAction",
          "description": "Defines the rule set action."
        },
        "exclusions": {
          "type": "array",
          "description": "Describes the exclusions that are applied to all rules in the set.",
          "items": {
            "$ref": "#/$defs/ManagedRuleExclusion"
          }
        },
        "ruleGroupOverrides": {
          "type": "array",
          "description": "Defines the rule group overrides to apply to the rule set.",
          "items": {
            "$ref": "#/$defs/ManagedRuleGroupOverride"
          }
        }
      },
      "required": [
        "ruleSetType",
        "ruleSetVersion"
      ]
    },
    "ManagedRuleSetActionType": {
      "type": "string",
      "description": "Defines the action to take when a managed rule set score threshold is met.",
      "enum": [
        "Block",
        "Log",
        "Redirect"
      ],
      "x-ms-enum": {
        "name": "ManagedRuleSetActionType",
        "modelAsString": true,
        "values": [
          {
            "name": "Block",
            "value": "Block",
            "description": "Block"
          },
          {
            "name": "Log",
            "value": "Log",
            "description": "Log"
          },
          {
            "name": "Redirect",
            "value": "Redirect",
            "description": "Redirect"
          }
        ]
      }
    },
    "ManagedRuleSetException": {
      "type": "object",
      "description": "Excludes whole requests from managed rule evaluation according to match conditions.",
      "properties": {
        "matchVariable": {
          "$ref": "#/$defs/ExceptionMatchVariable",
          "description": "The variable to be evaluated for excluding the request."
        },
        "selectorMatchOperator": {
          "$ref": "#/$defs/ExceptionSelectorMatchOperator",
          "description": "Comparison operator to apply to the selector when specifying which elements\nin the collection this exception applies to."
        },
        "selector": {
          "type": "string",
          "description": "When matchVariable is a collection, operator used to specify which elements\nin the collection this exception applies to.\nCurrently supported only for RequestHeaderNames."
        },
        "valueMatchOperator": {
          "$ref": "#/$defs/ExceptionValueMatchOperator",
          "description": "Comparison operator to apply to the value to be matched."
        },
        "matchValues": {
          "type": "array",
          "description": "List of values to be matched with.",
          "items": {
            "type": "string"
          }
        },
        "scopes": {
          "type": "array",
          "description": "Scope(s) of the exception.",
          "items": {
            "$ref": "#/$defs/ManagedRuleSetScope"
          },
          "x-ms-identifiers": [
            "ruleSetType",
            "ruleSetVersion"
          ]
        }
      },
      "required": [
        "matchVariable",
        "valueMatchOperator",
        "matchValues",
        "scopes"
      ]
    },
    "ManagedRuleSetExceptionList": {
      "type": "object",
      "description": "Defines the list of exceptions for the managed rule sets.",
      "properties": {
        "exceptions": {
          "type": "array",
          "description": "List of exceptions.",
          "items": {
            "$ref": "#/$defs/ManagedRuleSetException"
          }
        }
      }
    },
    "ManagedRuleSetList": {
      "type": "object",
      "description": "Defines the list of managed rule sets for the policy.",
      "properties": {
        "managedRuleSets": {
          "type": "array",
          "description": "List of rule sets.",
          "items": {
            "$ref": "#/$defs/ManagedRuleSet"
          }
        },
        "exceptionsList": {
          "$ref": "#/$defs/ManagedRuleSetExceptionList",
          "description": "List of exceptions applied on the managed rule sets."
        }
      }
    },
    "ManagedRuleSetScope": {
      "type": "object",
      "description": "Defines the scope of the managed rules.",
      "properties": {
        "ruleSetType": {
          "type": "string",
          "description": "Defines the rule set type.\nExamples: DefaultRuleSet, Microsoft_DefaultRuleSet,\nMicrosoft_BotManagerRuleSet, Microsoft_HTTPDDoSRuleSet, BotProtection"
        },
        "ruleSetVersion": {
          "type": "string",
          "description": "Defines the version of the rule set."
        },
        "ruleGroupScopes": {
          "type": "array",
          "description": "List of rule group scopes.",
          "items": {
            "$ref": "#/$defs/RuleGroupScope"
          },
          "x-ms-identifiers": [
            "ruleGroupName"
          ]
        }
      },
      "required": [
        "ruleSetType",
        "ruleSetVersion"
      ]
    },
    "MatchCondition": {
      "type": "object",
      "description": "Define a match condition.",
      "properties": {
        "matchVariable": {
          "$ref": "#/$defs/MatchVariable",
          "description": "Request variable to compare with."
        },
        "selector": {
          "type": "string",
          "description": "Match against a specific key from the QueryString, PostArgs, RequestHeader or Cookies variables. Default is null."
        },
        "operator": {
          "$ref": "#/$defs/Operator",
          "description": "Comparison type to use for matching with the variable value."
        },
        "negateCondition": {
          "type": "boolean",
          "description": "Describes if the result of this condition should be negated."
        },
        "matchValue": {
          "type": "array",
          "description": "List of possible match values.",
          "items": {
            "type": "string"
          }
        },
        "transforms": {
          "type": "array",
          "description": "List of transforms.",
          "items": {
            "$ref": "#/$defs/TransformType"
          }
        }
      },
      "required": [
        "matchVariable",
        "operator",
        "matchValue"
      ]
    },
    "MatchVariable": {
      "type": "string",
      "description": "Request variable to compare with.",
      "enum": [
        "RemoteAddr",
        "RequestMethod",
        "QueryString",
        "PostArgs",
        "RequestUri",
        "RequestHeader",
        "RequestBody",
        "Cookies",
        "SocketAddr",
        "JA4"
      ],
      "x-ms-enum": {
        "name": "MatchVariable",
        "modelAsString": true,
        "values": [
          {
            "name": "RemoteAddr",
            "value": "RemoteAddr",
            "description": "RemoteAddr"
          },
          {
            "name": "RequestMethod",
            "value": "RequestMethod",
            "description": "RequestMethod"
          },
          {
            "name": "QueryString",
            "value": "QueryString",
            "description": "QueryString"
          },
          {
            "name": "PostArgs",
            "value": "PostArgs",
            "description": "PostArgs"
          },
          {
            "name": "RequestUri",
            "value": "RequestUri",
            "description": "RequestUri"
          },
          {
            "name": "RequestHeader",
            "value": "RequestHeader",
            "description": "RequestHeader"
          },
          {
            "name": "RequestBody",
            "value": "RequestBody",
            "description": "RequestBody"
          },
          {
            "name": "Cookies",
            "value": "Cookies",
            "description": "Cookies"
          },
          {
            "name": "SocketAddr",
            "value": "SocketAddr",
            "description": "SocketAddr"
          },
          {
            "name": "JA4",
            "value": "JA4",
            "description": "JA4 Match Variable"
          }
        ]
      }
    },
    "Operator": {
      "type": "string",
      "description": "Comparison type to use for matching with the variable value.",
      "enum": [
        "Any",
        "IPMatch",
        "GeoMatch",
        "Equal",
        "Contains",
        "LessThan",
        "GreaterThan",
        "LessThanOrEqual",
        "GreaterThanOrEqual",
        "BeginsWith",
        "EndsWith",
        "RegEx",
        "ServiceTagMatch",
        "AsnMatch",
        "ClientFingerprint"
      ],
      "x-ms-enum": {
        "name": "Operator",
        "modelAsString": true,
        "values": [
          {
            "name": "Any",
            "value": "Any",
            "description": "Any"
          },
          {
            "name": "IPMatch",
            "value": "IPMatch",
            "description": "IPMatch"
          },
          {
            "name": "GeoMatch",
            "value": "GeoMatch",
            "description": "GeoMatch"
          },
          {
            "name": "Equal",
            "value": "Equal",
            "description": "Equal"
          },
          {
            "name": "Contains",
            "value": "Contains",
            "description": "Contains"
          },
          {
            "name": "LessThan",
            "value": "LessThan",
            "description": "LessThan"
          },
          {
            "name": "GreaterThan",
            "value": "GreaterThan",
            "description": "GreaterThan"
          },
          {
            "name": "LessThanOrEqual",
            "value": "LessThanOrEqual",
            "description": "LessThanOrEqual"
          },
          {
            "name": "GreaterThanOrEqual",
            "value": "GreaterThanOrEqual",
            "description": "GreaterThanOrEqual"
          },
          {
            "name": "BeginsWith",
            "value": "BeginsWith",
            "description": "BeginsWith"
          },
          {
            "name": "EndsWith",
            "value": "EndsWith",
            "description": "EndsWith"
          },
          {
            "name": "RegEx",
            "value": "RegEx",
            "description": "RegEx"
          },
          {
            "name": "ServiceTagMatch",
            "value": "ServiceTagMatch",
            "description": "ServiceTagMatch"
          },
          {
            "name": "AsnMatch",
            "value": "AsnMatch",
            "description": "Autonomous System Number Match Operator"
          },
          {
            "name": "ClientFingerprint",
            "value": "ClientFingerprint",
            "description": "Client Finger print Operator"
          }
        ]
      }
    },
    "PolicyEnabledState": {
      "type": "string",
      "description": "Describes if the policy is in enabled or disabled state. Defaults to Enabled if not specified.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "PolicyEnabledState",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          }
        ]
      }
    },
    "PolicyMode": {
      "type": "string",
      "description": "Describes if it is in detection mode or prevention mode at policy level.",
      "enum": [
        "Prevention",
        "Detection"
      ],
      "x-ms-enum": {
        "name": "PolicyMode",
        "modelAsString": true,
        "values": [
          {
            "name": "Prevention",
            "value": "Prevention",
            "description": "Prevention"
          },
          {
            "name": "Detection",
            "value": "Detection",
            "description": "Detection"
          }
        ]
      }
    },
    "PolicyRequestBodyCheck": {
      "type": "string",
      "description": "Describes if policy managed rules will inspect the request body content.",
      "enum": [
        "Disabled",
        "Enabled"
      ],
      "x-ms-enum": {
        "name": "PolicyRequestBodyCheck",
        "modelAsString": true,
        "values": [
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          },
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          }
        ]
      }
    },
    "PolicyResourceState": {
      "type": "string",
      "description": "Resource status of the policy.",
      "enum": [
        "Creating",
        "Enabling",
        "Enabled",
        "Disabling",
        "Disabled",
        "Deleting"
      ],
      "x-ms-enum": {
        "name": "PolicyResourceState",
        "modelAsString": true,
        "values": [
          {
            "name": "Creating",
            "value": "Creating",
            "description": "Creating"
          },
          {
            "name": "Enabling",
            "value": "Enabling",
            "description": "Enabling"
          },
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          },
          {
            "name": "Disabling",
            "value": "Disabling",
            "description": "Disabling"
          },
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          },
          {
            "name": "Deleting",
            "value": "Deleting",
            "description": "Deleting"
          }
        ]
      }
    },
    "PolicySettings": {
      "type": "object",
      "description": "Defines top-level WebApplicationFirewallPolicy configuration settings.",
      "properties": {
        "enabledState": {
          "$ref": "#/$defs/PolicyEnabledState",
          "description": "Describes if the policy is in enabled or disabled state. Defaults to Enabled if not specified."
        },
        "mode": {
          "$ref": "#/$defs/PolicyMode",
          "description": "Describes if it is in detection mode or prevention mode at policy level."
        },
        "redirectUrl": {
          "type": "string",
          "description": "If action type is redirect, this field represents redirect URL for the client."
        },
        "customBlockResponseStatusCode": {
          "type": "integer",
          "format": "int32",
          "description": "If the action type is block, customer can override the response status code."
        },
        "customBlockResponseBody": {
          "type": "string",
          "description": "If the action type is block, customer can override the response body. The body must be specified in base64 encoding.",
          "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$"
        },
        "requestBodyCheck": {
          "$ref": "#/$defs/PolicyRequestBodyCheck",
          "description": "Describes if policy managed rules will inspect the request body content."
        },
        "javascriptChallengeExpirationInMinutes": {
          "type": "integer",
          "format": "int32",
          "description": "Defines the JavaScript challenge cookie validity lifetime in minutes. This setting is only applicable to Premium_AzureFrontDoor. Value must be an integer between 5 and 1440 with the default value being 30.",
          "minimum": 5,
          "maximum": 1440
        },
        "captchaExpirationInMinutes": {
          "type": "integer",
          "format": "int32",
          "description": "Defines the Captcha cookie validity lifetime in minutes. This setting is only applicable to Premium_AzureFrontDoor. Value must be an integer between 5 and 1440 with the default value being 30.",
          "minimum": 5,
          "maximum": 1440
        },
        "logScrubbing": {
          "$ref": "#/$defs/PolicySettingsLogScrubbing",
          "description": "Defines rules that scrub sensitive fields in the Web Application Firewall logs.",
          "x-ms-client-flatten": true
        }
      }
    },
    "PolicySettingsLogScrubbing": {
      "type": "object",
      "description": "Defines rules that scrub sensitive fields in the Web Application Firewall logs.",
      "properties": {
        "state": {
          "$ref": "#/$defs/WebApplicationFirewallScrubbingState",
          "description": "State of the log scrubbing config. Default value is Enabled."
        },
        "scrubbingRules": {
          "type": "array",
          "description": "List of log scrubbing rules applied to the Web Application Firewall logs.",
          "items": {
            "$ref": "#/$defs/WebApplicationFirewallScrubbingRules"
          },
          "x-ms-identifiers": []
        }
      }
    },
    "Resource": {
      "type": "object",
      "description": "Common resource representation.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID.",
          "readOnly": true
        },
        "name": {
          "type": "string",
          "description": "Resource name.",
          "readOnly": true
        },
        "type": {
          "type": "string",
          "description": "Resource type.",
          "readOnly": true
        },
        "location": {
          "type": "string",
          "description": "Resource location."
        },
        "tags": {
          "type": "object",
          "description": "Resource tags.",
          "additionalProperties": {
            "type": "string"
          }
        }
      },
      "x-ms-azure-resource": true
    },
    "RoutingRuleLink": {
      "type": "object",
      "description": "Defines the Resource ID for a Routing Rule.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID."
        }
      }
    },
    "RuleGroupScope": {
      "type": "object",
      "description": "Defines the scope of the rule group.",
      "properties": {
        "ruleGroupName": {
          "type": "string",
          "description": "Defines the rule group name."
        },
        "ruleScopes": {
          "type": "array",
          "description": "List of rule scopes.",
          "items": {
            "$ref": "#/$defs/RuleScope"
          },
          "x-ms-identifiers": [
            "ruleId"
          ]
        }
      },
      "required": [
        "ruleGroupName"
      ]
    },
    "RuleScope": {
      "type": "object",
      "description": "Defines the scope of the rule.",
      "properties": {
        "ruleId": {
          "type": "string",
          "description": "Defines the rule id."
        }
      },
      "required": [
        "ruleId"
      ]
    },
    "RuleType": {
      "type": "string",
      "description": "Describes type of rule.",
      "enum": [
        "MatchRule",
        "RateLimitRule"
      ],
      "x-ms-enum": {
        "name": "RuleType",
        "modelAsString": true,
        "values": [
          {
            "name": "MatchRule",
            "value": "MatchRule",
            "description": "MatchRule"
          },
          {
            "name": "RateLimitRule",
            "value": "RateLimitRule",
            "description": "RateLimitRule"
          }
        ]
      }
    },
    "ScrubbingRuleEntryMatchVariable": {
      "type": "string",
      "description": "The variable to be scrubbed from the logs.",
      "enum": [
        "RequestIPAddress",
        "RequestUri",
        "QueryStringArgNames",
        "RequestHeaderNames",
        "RequestCookieNames",
        "RequestBodyPostArgNames",
        "RequestBodyJsonArgNames"
      ],
      "x-ms-enum": {
        "name": "ScrubbingRuleEntryMatchVariable",
        "modelAsString": true,
        "values": [
          {
            "name": "RequestIPAddress",
            "value": "RequestIPAddress",
            "description": "RequestIPAddress"
          },
          {
            "name": "RequestUri",
            "value": "RequestUri",
            "description": "RequestUri"
          },
          {
            "name": "QueryStringArgNames",
            "value": "QueryStringArgNames",
            "description": "QueryStringArgNames"
          },
          {
            "name": "RequestHeaderNames",
            "value": "RequestHeaderNames",
            "description": "RequestHeaderNames"
          },
          {
            "name": "RequestCookieNames",
            "value": "RequestCookieNames",
            "description": "RequestCookieNames"
          },
          {
            "name": "RequestBodyPostArgNames",
            "value": "RequestBodyPostArgNames",
            "description": "RequestBodyPostArgNames"
          },
          {
            "name": "RequestBodyJsonArgNames",
            "value": "RequestBodyJsonArgNames",
            "description": "RequestBodyJsonArgNames"
          }
        ]
      }
    },
    "SecurityPolicyLink": {
      "type": "object",
      "description": "Defines the Resource ID for a Security Policy.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Resource ID."
        }
      }
    },
    "SensitivityType": {
      "type": "string",
      "description": "Defines the sensitivity for the rule.",
      "enum": [
        "Low",
        "Medium",
        "High"
      ],
      "x-ms-enum": {
        "name": "SensitivityType",
        "modelAsString": true,
        "values": [
          {
            "name": "Low",
            "value": "Low",
            "description": "Low Sensitivity - triggers the rule by larger spikes in traffic"
          },
          {
            "name": "Medium",
            "value": "Medium",
            "description": "Medium Sensitivity - triggers the rule by moderate spikes in traffic"
          },
          {
            "name": "High",
            "value": "High",
            "description": "High Sensitivity - triggers the rule by smaller spikes in traffic"
          }
        ]
      }
    },
    "Sku": {
      "type": "object",
      "description": "The pricing tier of the web application firewall policy.",
      "properties": {
        "name": {
          "$ref": "#/$defs/SkuName",
          "description": "Name of the pricing tier."
        }
      }
    },
    "SkuName": {
      "type": "string",
      "description": "Name of the pricing tier.",
      "enum": [
        "Classic_AzureFrontDoor",
        "Standard_AzureFrontDoor",
        "Premium_AzureFrontDoor"
      ],
      "x-ms-enum": {
        "name": "SkuName",
        "modelAsString": true,
        "values": [
          {
            "name": "Classic_AzureFrontDoor",
            "value": "Classic_AzureFrontDoor",
            "description": "Classic_AzureFrontDoor"
          },
          {
            "name": "Standard_AzureFrontDoor",
            "value": "Standard_AzureFrontDoor",
            "description": "Standard_AzureFrontDoor"
          },
          {
            "name": "Premium_AzureFrontDoor",
            "value": "Premium_AzureFrontDoor",
            "description": "Premium_AzureFrontDoor"
          }
        ]
      }
    },
    "TransformType": {
      "type": "string",
      "description": "Describes what transforms applied before matching.",
      "enum": [
        "Lowercase",
        "Uppercase",
        "Trim",
        "UrlDecode",
        "UrlEncode",
        "RemoveNulls"
      ],
      "x-ms-enum": {
        "name": "TransformType",
        "modelAsString": true,
        "values": [
          {
            "name": "Lowercase",
            "value": "Lowercase",
            "description": "Lowercase"
          },
          {
            "name": "Uppercase",
            "value": "Uppercase",
            "description": "Uppercase"
          },
          {
            "name": "Trim",
            "value": "Trim",
            "description": "Trim"
          },
          {
            "name": "UrlDecode",
            "value": "UrlDecode",
            "description": "UrlDecode"
          },
          {
            "name": "UrlEncode",
            "value": "UrlEncode",
            "description": "UrlEncode"
          },
          {
            "name": "RemoveNulls",
            "value": "RemoveNulls",
            "description": "RemoveNulls"
          }
        ]
      }
    },
    "VariableName": {
      "type": "string",
      "description": "Describes the supported variable for group by",
      "enum": [
        "SocketAddr",
        "GeoLocation",
        "None",
        "Asn",
        "Ja4"
      ],
      "x-ms-enum": {
        "name": "VariableName",
        "modelAsString": true,
        "values": [
          {
            "name": "SocketAddr",
            "value": "SocketAddr",
            "description": "SocketAddr"
          },
          {
            "name": "GeoLocation",
            "value": "GeoLocation",
            "description": "GeoLocation"
          },
          {
            "name": "None",
            "value": "None",
            "description": "None"
          },
          {
            "name": "Asn",
            "value": "Asn",
            "description": "Autonomous System Number"
          },
          {
            "name": "Ja4",
            "value": "Ja4",
            "description": "JA4 TLS fingerprint"
          }
        ]
      }
    },
    "WebApplicationFirewallPolicyProperties": {
      "type": "object",
      "description": "Defines web application firewall policy properties.",
      "properties": {
        "policySettings": {
          "$ref": "#/$defs/PolicySettings",
          "description": "Describes settings for the policy."
        },
        "customRules": {
          "$ref": "#/$defs/CustomRuleList",
          "description": "Describes custom rules inside the policy."
        },
        "managedRules": {
          "$ref": "#/$defs/ManagedRuleSetList",
          "description": "Describes managed rules inside the policy."
        },
        "frontendEndpointLinks": {
          "type": "array",
          "description": "Describes Frontend Endpoints associated with this Web Application Firewall policy.",
          "items": {
            "$ref": "#/$defs/FrontendEndpointLink"
          },
          "readOnly": true
        },
        "routingRuleLinks": {
          "type": "array",
          "description": "Describes Routing Rules associated with this Web Application Firewall policy.",
          "items": {
            "$ref": "#/$defs/RoutingRuleLink"
          },
          "readOnly": true
        },
        "securityPolicyLinks": {
          "type": "array",
          "description": "Describes Security Policy associated with this Web Application Firewall policy.",
          "items": {
            "$ref": "#/$defs/SecurityPolicyLink"
          },
          "readOnly": true
        },
        "provisioningState": {
          "type": "string",
          "description": "Provisioning state of the policy.",
          "readOnly": true
        },
        "resourceState": {
          "$ref": "#/$defs/PolicyResourceState",
          "title": "Resource status of the policy.",
          "description": "Resource status of the policy.",
          "readOnly": true
        }
      }
    },
    "WebApplicationFirewallScrubbingRules": {
      "type": "object",
      "description": "Defines the contents of the log scrubbing rules.",
      "properties": {
        "matchVariable": {
          "$ref": "#/$defs/ScrubbingRuleEntryMatchVariable",
          "description": "The variable to be scrubbed from the logs."
        },
        "selectorMatchOperator": {
          "$ref": "#/$defs/scrubbingRuleEntryMatchOperator",
          "description": "When matchVariable is a collection, operate on the selector to specify which elements in the collection this rule applies to."
        },
        "selector": {
          "type": "string",
          "description": "When matchVariable is a collection, operator used to specify which elements in the collection this rule applies to."
        },
        "state": {
          "$ref": "#/$defs/scrubbingRuleEntryState",
          "description": "Defines the state of a log scrubbing rule. Default value is enabled."
        }
      },
      "required": [
        "matchVariable",
        "selectorMatchOperator"
      ]
    },
    "WebApplicationFirewallScrubbingState": {
      "type": "string",
      "description": "State of the log scrubbing config. Default value is Enabled.",
      "enum": [
        "Enabled",
        "Disabled"
      ],
      "x-ms-enum": {
        "name": "WebApplicationFirewallScrubbingState",
        "modelAsString": true,
        "values": [
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          },
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          }
        ]
      }
    },
    "scrubbingRuleEntryMatchOperator": {
      "type": "string",
      "description": "When matchVariable is a collection, operate on the selector to specify which elements in the collection this rule applies to.",
      "enum": [
        "EqualsAny",
        "Equals"
      ],
      "x-ms-enum": {
        "name": "scrubbingRuleEntryMatchOperator",
        "modelAsString": true,
        "values": [
          {
            "name": "EqualsAny",
            "value": "EqualsAny",
            "description": "EqualsAny"
          },
          {
            "name": "Equals",
            "value": "Equals",
            "description": "Equals"
          }
        ]
      }
    },
    "scrubbingRuleEntryState": {
      "type": "string",
      "description": "Defines the state of a log scrubbing rule. Default value is enabled.",
      "enum": [
        "Enabled",
        "Disabled"
      ],
      "x-ms-enum": {
        "name": "scrubbingRuleEntryState",
        "modelAsString": true,
        "values": [
          {
            "name": "Enabled",
            "value": "Enabled",
            "description": "Enabled"
          },
          {
            "name": "Disabled",
            "value": "Disabled",
            "description": "Disabled"
          }
        ]
      }
    }
  }
}