Put Firewall Configuration | Vercel REST API

APIs & SDKs

Put Firewall Configuration

PUThttps://api.vercel.com/v1/security/firewall/config

Set the firewall configuration to provided rules and settings. Creates or overwrite the existing firewall configuration.

https://api.vercel.com/v1/security/firewall/config

const response = await fetch('https://api.vercel.com/v1/security/firewall/config?projectId=string&teamId=string&slug=string', {
  method: 'PUT',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "firewallEnabled": "true",
    "managedRules": "value",
    "crs": {
      "sd": {
        "active": "true",
        "action": "deny"
      },
      "ma": {
        "active": "true",
        "action": "deny"
      },
      "lfi": {
        "active": "true",
        "action": "deny"
      },
      "rfi": {
        "active": "true",
        "action": "deny"
      },
      "rce": {
        "active": "true",
        "action": "deny"
      },
      "php": {
        "active": "true",
        "action": "deny"
      },
      "gen": {
        "active": "true",
        "action": "deny"
      },
      "xss": {
        "active": "true",
        "action": "deny"
      },
      "sqli": {
        "active": "true",
        "action": "deny"
      },
      "sf": {
        "active": "true",
        "action": "deny"
      },
      "java": {
        "active": "true",
        "action": "deny"
      }
    },
    "rules": [
      {
        "id": "icfg_1234567890",
        "name": "Example Name",
        "description": "string",
        "active": "true",
        "conditionGroup": [
          {
            "conditions": [
              {
                "type": "host",
                "op": "re",
                "neg": "true",
                "key": "string",
                "value": "string"
              }
            ]
          }
        ],
        "action": {
          "mitigate": {
            "action": "log",
            "rateLimit": {
              "algo": "fixed_window",
              "window": "123",
              "limit": "123",
              "keys": [],
              "action": "log"
            },
            "redirect": {
              "location": "string",
              "permanent": "true"
            },
            "actionDuration": "string",
            "bypassSystem": "true",
            "logHeaders": "string"
          }
        },
        "valid": "true",
        "validationErrors": []
      }
    ],
    "rulesets": [
      {
        "id": "icfg_1234567890",
        "name": "Example Name",
        "description": "string",
        "active": "true",
        "conditionGroup": [
          {
            "conditions": [
              {
                "type": "host",
                "op": "re",
                "neg": "true",
                "key": "string",
                "value": "string"
              }
            ]
          }
        ],
        "action": {
          "mitigate": {
            "action": "deny"
          }
        },
        "valid": "true",
        "validationErrors": []
      }
    ],
    "ips": [
      {
        "id": "icfg_1234567890",
        "hostname": "Example Name",
        "ip": "string",
        "notes": "string",
        "action": "deny"
      }
    ],
    "botIdEnabled": "true",
    "logHeaders": "string"
  }),
});

const data = await response.json();
console.log(data);

Response

{
  "active": {
    "botIdEnabled": "false",
    "changes": [
      "value"
    ],
    "conditions": [
      {
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name"
      }
    ],
    "crs": {
      "gen": {
        "action": "deny",
        "active": "false"
      },
      "java": {
        "action": "deny",
        "active": "false"
      },
      "lfi": {
        "action": "deny",
        "active": "false"
      },
      "ma": {
        "action": "deny",
        "active": "false"
      },
      "php": {
        "action": "deny",
        "active": "false"
      },
      "rce": {
        "action": "deny",
        "active": "false"
      },
      "rfi": {
        "action": "deny",
        "active": "false"
      },
      "sd": {
        "action": "deny",
        "active": "false"
      },
      "sf": {
        "action": "deny",
        "active": "false"
      },
      "sqli": {
        "action": "deny",
        "active": "false"
      },
      "xss": {
        "action": "deny",
        "active": "false"
      }
    },
    "firewallEnabled": "false",
    "id": "icfg_1234567890",
    "ips": [
      {
        "action": "bypass",
        "hostname": "Example Name",
        "id": "icfg_1234567890",
        "ip": "string",
        "notes": "string"
      }
    ],
    "logHeaders": [],
    "managedRules": {
      "ai_bots": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "bot_protection": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "owasp": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "traffic_sources": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "vercel_ruleset": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      }
    },
    "ownerId": "example_id",
    "projectKey": "string",
    "rules": [
      {
        "action": {
          "mitigate": {
            "action": "allow",
            "actionDuration": "string",
            "bypassSystem": "false",
            "logHeaders": [],
            "rateLimit": {
              "action": "challenge",
              "algo": "fixed_window",
              "keys": [],
              "limit": "123",
              "window": "123"
            },
            "redirect": {
              "location": "string",
              "permanent": "false"
            }
          }
        },
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name",
        "valid": "true",
        "validationErrors": "value"
      }
    ],
    "rulesets": [
      {
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name",
        "action": {
          "mitigate": {
            "action": "allow",
            "actionDuration": "string",
            "bypassSystem": "false",
            "logHeaders": [],
            "rateLimit": {
              "action": "challenge",
              "algo": "fixed_window",
              "keys": [],
              "limit": "123",
              "window": "123"
            },
            "redirect": {
              "location": "string",
              "permanent": "false"
            }
          }
        }
      }
    ],
    "updatedAt": "string",
    "version": "123"
  }
}

Authentication

AuthorizationbearerToken

Default authentication mechanism

Query parameters

projectIdstringRequired

teamIdstringOptional

The Team identifier to perform the request on behalf of.

slugstringOptional

The Team slug to perform the request on behalf of.

Body

application/json

firewallEnabledbooleanRequired

managedRulesobjectOptional

crsobjectOptional

Custom Ruleset

rulesarrayOptional

rulesetsobjectOptional2 variants

ipsarrayOptional

botIdEnabledbooleanOptional

logHeadersobjectOptional2 variants

Response

200Success

activeobjectRequired

Errors

400One of the provided values in the request body is invalid. One of the provided values in the request query is invalid.

401The request is not authorized.

402Error

403You do not have permission to access this resource.

404Error

410Error

500Error

Cross-link map: Put Firewall Configuration (/docs/rest-api/security/put-firewall-configuration)

From the Vercel docs graph (built 2026-10-10T05:32:43.016Z), spanning vercel.com docs + KB, nextjs.org, ai-sdk.dev, and other Vercel documentation sites. Full graph as JSON: https://vercel.com/docs/graph.json

Semantically closest pages

Read Firewall Configuration — GET /v1/security/firewall/config/{configVersion} — Retrieve the specified firewall configuration for a project. The depl
Returns activated WAF config — GET /v1/security/firewall/config — Lists WAF configs for a project
Retrieve a list of projects — GET /v10/projects — Allows to retrieve the list of projects of the authenticated user or team. The list will be paginate
Update a sandbox — PATCH /v2/sandboxes/{name} — Updates the configuration of a sandbox. Only the provided fields will be modified; omitted
Update Firewall Configuration — PATCH /v1/security/firewall/config — Process updates to modify the existing firewall config for a project

This page links to (1)

Vercel REST API Reference — Interact programmatically with your Vercel account using the SDK or direct HTTP requests.

Pages that link here (1)

By site: vercel-docs (1)

Vercel REST API Reference — Interact programmatically with your Vercel account using the SDK or direct HTTP requests.

https://api.vercel.com/v1/security/firewall/config

const response = await fetch('https://api.vercel.com/v1/security/firewall/config?projectId=string&teamId=string&slug=string', {
  method: 'PUT',
  headers: {
    'Authorization': 'Bearer YOUR_ACCESS_TOKEN',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "firewallEnabled": "true",
    "managedRules": "value",
    "crs": {
      "sd": {
        "active": "true",
        "action": "deny"
      },
      "ma": {
        "active": "true",
        "action": "deny"
      },
      "lfi": {
        "active": "true",
        "action": "deny"
      },
      "rfi": {
        "active": "true",
        "action": "deny"
      },
      "rce": {
        "active": "true",
        "action": "deny"
      },
      "php": {
        "active": "true",
        "action": "deny"
      },
      "gen": {
        "active": "true",
        "action": "deny"
      },
      "xss": {
        "active": "true",
        "action": "deny"
      },
      "sqli": {
        "active": "true",
        "action": "deny"
      },
      "sf": {
        "active": "true",
        "action": "deny"
      },
      "java": {
        "active": "true",
        "action": "deny"
      }
    },
    "rules": [
      {
        "id": "icfg_1234567890",
        "name": "Example Name",
        "description": "string",
        "active": "true",
        "conditionGroup": [
          {
            "conditions": [
              {
                "type": "host",
                "op": "re",
                "neg": "true",
                "key": "string",
                "value": "string"
              }
            ]
          }
        ],
        "action": {
          "mitigate": {
            "action": "log",
            "rateLimit": {
              "algo": "fixed_window",
              "window": "123",
              "limit": "123",
              "keys": [],
              "action": "log"
            },
            "redirect": {
              "location": "string",
              "permanent": "true"
            },
            "actionDuration": "string",
            "bypassSystem": "true",
            "logHeaders": "string"
          }
        },
        "valid": "true",
        "validationErrors": []
      }
    ],
    "rulesets": [
      {
        "id": "icfg_1234567890",
        "name": "Example Name",
        "description": "string",
        "active": "true",
        "conditionGroup": [
          {
            "conditions": [
              {
                "type": "host",
                "op": "re",
                "neg": "true",
                "key": "string",
                "value": "string"
              }
            ]
          }
        ],
        "action": {
          "mitigate": {
            "action": "deny"
          }
        },
        "valid": "true",
        "validationErrors": []
      }
    ],
    "ips": [
      {
        "id": "icfg_1234567890",
        "hostname": "Example Name",
        "ip": "string",
        "notes": "string",
        "action": "deny"
      }
    ],
    "botIdEnabled": "true",
    "logHeaders": "string"
  }),
});

const data = await response.json();
console.log(data);

Response

{
  "active": {
    "botIdEnabled": "false",
    "changes": [
      "value"
    ],
    "conditions": [
      {
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name"
      }
    ],
    "crs": {
      "gen": {
        "action": "deny",
        "active": "false"
      },
      "java": {
        "action": "deny",
        "active": "false"
      },
      "lfi": {
        "action": "deny",
        "active": "false"
      },
      "ma": {
        "action": "deny",
        "active": "false"
      },
      "php": {
        "action": "deny",
        "active": "false"
      },
      "rce": {
        "action": "deny",
        "active": "false"
      },
      "rfi": {
        "action": "deny",
        "active": "false"
      },
      "sd": {
        "action": "deny",
        "active": "false"
      },
      "sf": {
        "action": "deny",
        "active": "false"
      },
      "sqli": {
        "action": "deny",
        "active": "false"
      },
      "xss": {
        "action": "deny",
        "active": "false"
      }
    },
    "firewallEnabled": "false",
    "id": "icfg_1234567890",
    "ips": [
      {
        "action": "bypass",
        "hostname": "Example Name",
        "id": "icfg_1234567890",
        "ip": "string",
        "notes": "string"
      }
    ],
    "logHeaders": [],
    "managedRules": {
      "ai_bots": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "bot_protection": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "owasp": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "traffic_sources": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      },
      "vercel_ruleset": {
        "action": "challenge",
        "active": "false",
        "updatedAt": "string",
        "userId": "example_id",
        "username": "string"
      }
    },
    "ownerId": "example_id",
    "projectKey": "string",
    "rules": [
      {
        "action": {
          "mitigate": {
            "action": "allow",
            "actionDuration": "string",
            "bypassSystem": "false",
            "logHeaders": [],
            "rateLimit": {
              "action": "challenge",
              "algo": "fixed_window",
              "keys": [],
              "limit": "123",
              "window": "123"
            },
            "redirect": {
              "location": "string",
              "permanent": "false"
            }
          }
        },
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name",
        "valid": "true",
        "validationErrors": "value"
      }
    ],
    "rulesets": [
      {
        "active": "false",
        "conditionGroup": [
          {
            "conditions": [
              {
                "key": "string",
                "neg": "false",
                "op": "eq",
                "type": "bot_category",
                "value": "string"
              }
            ]
          }
        ],
        "description": "string",
        "id": "icfg_1234567890",
        "name": "Example Name",
        "action": {
          "mitigate": {
            "action": "allow",
            "actionDuration": "string",
            "bypassSystem": "false",
            "logHeaders": [],
            "rateLimit": {
              "action": "challenge",
              "algo": "fixed_window",
              "keys": [],
              "limit": "123",
              "window": "123"
            },
            "redirect": {
              "location": "string",
              "permanent": "false"
            }
          }
        }
      }
    ],
    "updatedAt": "string",
    "version": "123"
  }
}

OpenAPI Specification