---
title: firewall-management
product: vercel
url: /docs/rest-api/sdk/examples/firewall-management
canonical_url: "https://vercel.com/docs/rest-api/sdk/examples/firewall-management"
last_updated: 2026-07-20
type: reference
prerequisites:
  []
related:
  []
summary: Learn about firewall-management on Vercel.
install_vercel_plugin: npx plugins add vercel/vercel-plugin
---

# Vercel WAF Management

## Add custom rules

In this example, you create a new custom rule to protect your application against SQL injection threats.

```typescript
import { Vercel } from '@vercel/sdk';

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function insertCustomRule() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "rules.insert",
      id: null,
      value: {
        active: true,
        name: "Block SQL Injection Attempts",
        description: "Block requests with SQL injection patterns in query parameters",
        conditionGroup: [
          {
            conditions: [
              {
                op: "inc",
                type: "query",
                value: "SELECT",
              },
            ],
          },
        ],
        action: {
          mitigate: {
            action: "deny",
            rateLimit: null,
            redirect: null,
            actionDuration: null,
          },
        },
      },
    },
  });
}

insertCustomRule();
```

## Modify existing rules

In this example, you update an existing custom rule's configuration. This is useful when you need to programmatically adjust conditions, actions, or status of an existing rule.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function updateExistingRule() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "rules.update",
      id: "existing-rule-id",
      value: {
        active: true,
        name: "Updated Rule Name",
        description: "Updated rule description",
        conditionGroup: [
          {
            conditions: [
              {
                op: "pre",
                type: "path",
                value: "/admin",
              },
            ],
          },
        ],
        action: {
          mitigate: {
            action: "challenge",
            rateLimit: null,
            redirect: null,
            actionDuration: null,
          },
        },
      },
    },
  });
}

updateExistingRule();
```

## Delete custom rules

In this example, you delete an existing custom rule.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function deleteRule() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "rules.remove",
      id: "rule-to-delete-id",
      value: null,
    },
  });
}

deleteRule();
```

## Change rule priority

This applies when you have more than one custom rule. By default, priority is determined by the order rules are added. You can change this in the dashboard or with the SDK.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function reorderRules() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "rules.priority",
      id: "rule-to-update-priority-id",
      value: 1,
    },
  });
}

reorderRules();
```

## Custom system bypass rule

WAF system bypass rules allow specific IP addresses or CIDRs to bypass system-level mitigations such as DDoS Mitigation. For more complex filters, you can use the REST API directly. This example creates a custom rule to allow mobile applications to bypass system-level mitigations.

> Bypassing system-level mitigations with the API is currently in beta. Contact support if you would like to use it.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: "<YOUR_BEARER_TOKEN_HERE>",
});

async function run() {
  const result = await vercel.security.updateFirewallConfig({
    projectId: "<your_project_id>",
    teamId: "team_1a2b3c4d5e6f7g8h9i0j1k2l",
    requestBody: {
      action: "rules.insert",
      id: null,
      value: {
        name: "Mobile App Bypass Security Rule",
        description: "Custom system bypass rule targeting mobile applications",
        active: true,
        conditionGroup: [
          {
            conditions: [
              {
                type: "user_agent",
                op: "re",
                neg: false,
                value: "Mobile|Android|iPhone|iPad"
              }
            ]
          }
        ],
        action: {
          mitigate: {
            action: "bypass",
            bypassSystem: true
          }
        }
      }
    },
  });

  console.log(result);
}

run();
```

## Update an OWASP rule

In this example, you update a specific rule from the OWASP ruleset in your project using crs.update. You specify the rule to update by using its name in the id field.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function updateOwaspRule() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "crs.update",
      id: "xss", // eg. "sd", "max", "lfi", "rfi", "rce", "php", "gen", "xss", "sqli", "sf", "java"
      value: {
        active: true,
        action: "log", // e.g. "deny" | "log"
      },
    },
  });
}

updateOwaspRule();
```

## Disable all OWASP rules

This example disables all OWASP rules for the project. It is a shortcut equivalent to setting every OWASP rule to active = false.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function disableOWASPRules() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "crs.disable",
      id: null,
      value: null,
    },
  });
}

disableOWASPRules();
```

## Update a managed ruleset

Use managedRules.update with the ruleset name as id to enable/disable the ruleset and update the firewall action for that managed ruleset for the project.

```typescript
import { Vercel } from "@vercel/sdk";

const vercel = new Vercel({
  bearerToken: process.env.VERCEL_TOKEN,
});

async function updateManagedRuleset() {
  await vercel.security.updateFirewallConfig({
    projectId: "your-project-id",
    teamId: "your-team-id",
    requestBody: {
      action: "managedRules.update",
      id: "bot_protection", // eg. "owasp", "bot_protection", "ai_bots", "bot_filter"
      value: {
        active: true,
        action: "log", // e.g. "deny" | "log" | "challenge"
      },
    },
  });
}

updateManagedRuleset();
```

---

[View full sitemap](/docs/sitemap)