tencent cloud

All product documents
Tencent Cloud EdgeOne
DocumentationTencent Cloud EdgeOneAPI DocumentationSecurity Configuration APIsModifySecurityPolicy
ModifySecurityPolicy
Download PDF
Last updated: 2025-03-21 14:27:23
ModifySecurityPolicy
Last updated: 2025-03-21 14:27:23
Download PDF

1. API Description

Domain name for API request: teo.intl.tencentcloudapi.com.

This API is used to modify the web and bot security configurations.

A maximum of 20 requests can be initiated per second for this API.

We recommend you to use API Explorer
Try it
API Explorer provides a range of capabilities, including online call, signature authentication, SDK code generation, and API quick search. It enables you to view the request, response, and auto-generated examples.

2. Input Parameters

The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.

Parameter Name Required Type Description
Action Yes String Common Params. The value used for this API: ModifySecurityPolicy.
Version Yes String Common Params. The value used for this API: 2022-09-01.
Region No String Common Params. This parameter is not required.
ZoneId Yes String Zone ID.
SecurityConfig Yes SecurityConfig Security policy configuration.
  • When the CustomRule in the SecurityPolicy parameter is set, the AclConfg and IpTableConfg in the SecurityConfig parameter will be ignored;
  • when the ManagedRule in the SecurityPolicy parameter is set, the WafConfig in the SecurityConfig parameter will be ignored.
  • For custom rules and managed rule policy configuration, using SecurityPolicy parameter to configure settings is recommended.
    		•
    SecurityPolicy No SecurityPolicy Security policy configuration. The parameter is recommended to use for custom policies and managed rule configurations of web protection, it supports configuring security policies with expression grammar.
    Entity No String SecurityPolicy type, the following parameter values can be used for query:
  • ZoneDefaultPolicy: used to specify a query for site-level policies;
  • Template: used to specify a query for policy templates. the TemplateId parameter needs to be specified simultaneously;
  • Host: used to specify a query for domain-level policies (note: when using Host to specify a domain name service policy, only domain name services or policy templates that have been applied domain-level policies are supported).
    		•
    Host No String Specify the domain name. When the Entity parameter value is set to Host, use the domain-level policy specified by this parameter to query the domain configuration. For example, use www.example.com to configure the domain-level policy for that domain name.
    TemplateId No String Specify the policy template ID. Use this parameter to specify the ID of the policy Template to query the Template configuration when the Entity parameter value is set to Template.

    3. Output Parameters

    Parameter Name Type Description
    RequestId String The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem.

    4. Example

    Example1 Modify Domain Name Policy

    Modify the domain name policy for a.eotest.com under the eotest.com site

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "Host",
    "Host": "a.eotest.com",
    "SecurityConfig": {},
    "SecurityPolicy": {
        "CustomRules": {
            "Rules": [
                {
                    "Id": "1492837231",
                    "Name": "SampleBasicACLRule",
                    "Condition": "${http.request.ip} in ['1.1.1.1', '10.10.10.0/24', ${security.ip_group['123'@'zone-2xsnpvkhdjes']} ]",
                    "Action": {
                        "Name": "Deny"
                    },
                    "Priority": 10,
                    "Enabled": "on"
                }
            ]
        },
        "ManagedRules": {
            "Enabled": "on",
            "AutoUpdate": {
                "AutoUpdateToLatestVersion": "off",
                "RulesetVersion": "2023-12-21T12:00:32Z"
            },
            "SemanticAnalysis": "on",
            "DetectionOnly": "on",
            "ManagedRuleGroups": [
                {
                    "GroupId": "wafmanagedrulegroup-vulnerability-scanners",
                    "SensitivityLevel": "wafmanagedrule-sensitivity-level-extreme",
                    "Action": {
                        "Name": "Monitor"
                    }
                }
            ]
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-777c481da684"
    }
}

    Example2 Modify Template Policy

    Modify the template policy of temp-00iel413 under the eotest.com site

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "Template",
    "TemplateId": "temp-00iel413",
    "SecurityConfig": {},
    "SecurityPolicy": {
        "CustomRules": {
            "Rules": [
                {
                    "Id": "1492837231",
                    "Name": "SampleBasicACLRule",
                    "Condition": "${http.request.ip} in ['1.1.1.1', '10.10.10.0/24', ${security.ip_group['123'@'zone-2xsnpvkhdjes']} ]",
                    "Action": {
                        "Name": "Deny"
                    },
                    "Priority": 10,
                    "Enabled": "on"
                }
            ]
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-777c481da684"
    }
}

    Example3 Modify Site-Level Policy

    Modify the site-level policy of eotest.com

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "ZoneDefaultPolicy",
    "SecurityConfig": {},
    "SecurityPolicy": {
        "ManagedRules": {
            "Enabled": "on",
            "AutoUpdate": {
                "AutoUpdateToLatestVersion": "off",
                "RulesetVersion": "2023-12-21T12:00:32Z"
            },
            "SemanticAnalysis": "on",
            "DetectionOnly": "on",
            "ManagedRuleGroups": [
                {
                    "GroupId": "wafmanagedrulegroup-vulnerability-scanners",
                    "SensitivityLevel": "wafmanagedrule-sensitivity-level-extreme",
                    "Action": {
                        "Name": "Monitor"
                    }
                }
            ]
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-777c481da684"
    }
}

    Example4 Modify Security Configuration

    This example shows you how to modify the layer-7 security configuration for the a.eotest.com domain name.

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "a.eotest.com",
    "SecurityConfig": {
        "WafConfig": {
            "Switch": "on",
            "WafRule": {
                "Switch": "on",
                "ObserveRuleIDs": [],
                "BlockRuleIDs": [
                    162502146
                ]
            },
            "Mode": "block",
            "Level": "loose"
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-2e6c481dae23"
    }
}

    Example5 Scenarios for Modifying Exception Rules in Security Configuration and Whitelisting Fields

    In WAF protection, if there is a scenario (such as an HTTP request with the path /skipwaf) in your business that requires whitelisting some fields (such as all keys in the HTTP Header) to skip WAF security protection, you can use the following configuration.

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "*.eotest.com",
    "SecurityConfig": {
        "ExceptConfig": {
            "Switch": "on",
            "ExceptUserRules": [
                {
                    "Action": "skip",
                    "ExceptUserRuleConditions": [
                        {
                            "MatchContent": "/skipwaf",
                            "MatchFrom": "cgi",
                            "Operator": "equal"
                        }
                    ],
                    "ExceptUserRuleScope": {
                        "Type": "partial",
                        "PartialModules": [
                            {
                                "Module": "waf",
                                "Include": [
                                    106247778
                                ]
                            }
                        ],
                        "SkipConditions": [
                            {
                                "MatchContent": [],
                                "MatchFrom": [],
                                "Selector": "keys",
                                "Type": "header_fields"
                            }
                        ]
                    },
                    "RuleID": 0,
                    "RuleName": "first_webshell",
                    "RulePriority": 0,
                    "RuleStatus": "on",
                    "UpdateTime": "2022-09-22T03:00:10Z"
                }
            ]
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-2e6c481dae44"
    }
}

    Example6 Modifying Exception Rules in Security Configuration and Whitelisting Header Specifying key Field Scenarios

    In WAF protection, if there is a scenario in your business (such as an HTTP request with the path /skipwaf) where you need to whitelist certain fields (such as the Value corresponding to YourSkipHeader in the HTTP Header) to skip WAF security protection, you can use the following configuration.

    Input Example

    POST / HTTP/1.1
Host: teo.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: ModifySecurityPolicy
<Common request parameters>

{
    "ZoneId": "zone-fa89j239a",
    "Entity": "*.eotest.com",
    "SecurityConfig": {
        "ExceptConfig": {
            "Switch": "on",
            "ExceptUserRules": [
                {
                    "Action": "skip",
                    "ExceptUserRuleConditions": [
                        {
                            "MatchContent": "/skipwaf",
                            "MatchFrom": "cgi",
                            "Operator": "equal"
                        }
                    ],
                    "ExceptUserRuleScope": {
                        "Type": "partial",
                        "PartialModules": [
                            {
                                "Module": "waf",
                                "Include": [
                                    106247778
                                ]
                            }
                        ],
                        "SkipConditions": [
                            {
                                "MatchContent": [],
                                "MatchFrom": [
                                    "YourSkipHeader"
                                ],
                                "MatchFromType": "equal",
                                "Selector": "values",
                                "Type": "header_fields"
                            }
                        ]
                    },
                    "RuleID": 0,
                    "RuleName": "first_webshell",
                    "RulePriority": 0,
                    "RuleStatus": "on",
                    "UpdateTime": "2022-09-22T03:00:10Z"
                }
            ]
        }
    }
}

    Output Example

    {
    "Response": {
        "RequestId": "08b32010-ab25-42a4-b923-2e6c481dae66"
    }
}

    5. Developer Resources

    SDK

    TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.

    Command Line Interface

    6. Error Code

    The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.

    Error Code Description
    InternalError.ConfigLocked The configuration is locked. Please unlock and try again.
    InternalError.ProxyServer An unknown error occurred in the backend server.
    InternalError.RouteError The backend routing address is incorrect.
    InvalidParameter.Security Invalid parameter.
    LimitExceeded.Security Limit exceeded
    OperationDenied Operation denied.
    ResourceInUse The resource is occupied.
    UnauthorizedOperation.CamUnauthorized CAM is not authorized.
    UnauthorizedOperation.NoPermission The sub-account is not authorized for the operation. Please get permissions first.
    UnauthorizedOperation.Unknown An unknown error occurred in the backend server.
    UnsupportedOperation Unsupported operation.
    Was this page helpful?
    You can also Contact Sales or Submit a Ticket for help.
    Yes
    No

    Feedback

    Contact Us

    Contact our sales team or business advisors to help your business.

    Contact Us
    Technical Support

    Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

    Submit a Ticket
    7x24 Phone Support
    Hong Kong, China
    +852 800 906 020 (Toll Free)
    United States
    +1 844 606 0804 (Toll Free)
    United Kingdom
    +44 808 196 4551 (Toll Free)
    Canada
    +1 888 605 7930 (Toll Free)
    Australia
    +61 1300 986 386 (Toll Free)
    EdgeOne hotline
    +852 300 80699
    More local hotlines coming soon