The API schema defines which API requests are valid based on several request properties like target endpoint, path or query variable format, and HTTP method.
Schema Validation compares incoming requests with an uploaded OpenAPI schema. The uploaded schema supplies expected request structure for a Schema Profile.
After the uploaded profile becomes available, Cloudflare generates an always-on detection. Use cf.schema_validation.uploaded.violated to analyze and mitigate violations.
The detection does not mitigate traffic by itself. Review results in Profile Analysis before enforcing the profile with Custom Rules.
Schema Validation 2.0 is the current version. For previous-version reference, refer to Configure Classic Schema Validation.
Endpoints must exist as operations in Web Assets > Operations. Uploading through the dashboard adds schema operations automatically.
When using the API or Terraform, add schema operations separately. For automation details, refer to API configuration or Terraform.
-
In the Cloudflare dashboard, go to the Web Assets page.
Go to Web assets ↗ -
Go to the Schema validation tab.
-
Select Add validation.
-
Upload an OpenAPI schema file.
-
Select Add schema and endpoints.
Changes may take several minutes, depending on the operation count.
-
In the Cloudflare dashboard, go to the Web Assets page.
Go to Web assets ↗ -
Go to the Schema validation tab.
-
Select Schema settings.
-
Filter by API abuse.
-
Under Schema validation > Active schemas, review uploaded schemas.
-
From the schema overflow menu, download or delete the schema.
Deleting an uploaded schema stops its profile evaluation. Associated operations remain in the Web Assets inventory.
A fallthrough rule matches requests that do not match known operations. Use this WAF Custom Rule to protect against unidentified endpoints.