Managed Waf
- Written for
- ＋ Written for
- Deprecated
- ＋ Deprecated
- Applies to
- ＋ Applies to
Managed Waf
Backend API — secret key (Authorization: Bearer sk_…).
5 routes. Each row is one endpoint with its explanation, required scope, and whether it honours the Idempotency-Key header.
Method & path | Scope | Idem | Explanation |
|---|---|---|---|
|
| Read the managed AWS WAF configuration and provisioning state. AWS credential secrets are never returned, only has_* markers. | |
|
| Read just the managed AWS WAF provisioning state: status, WebACL id/arn, last error and last-provisioned time. | |
|
| Configure the managed AWS WAF: scope/region, edge target, token domains, gated paths, and the write-only BYO AWS credentials. Enabling points auth_config.captcha at awswaf. | |
|
| Provision now: idempotently create-or-update the AWS WAF WebACL with the CAPTCHA rule and associate it with the edge (ALB or CloudFront). Fail-safe: AWS errors are recorded, not thrown into auth. | |
|
| Deprovision: disassociate the WebACL from the edge and delete it, then clear the stored state. Fail-safe like provision. |