Allow trusted traffic with WAF allow policies

You create an expression policy that bypasses WAF inspection for matching trusted traffic. Earlier source blocks and request budgets still apply.

Note: Balancer is in beta. Endpoints, fields and behavior may change before general availability, and the feature must be enabled on your account before use. Contact your NetActuate account manager to request access.

Prerequisites

• Balancer access and a key in the BALANCER_API_KEY environment variable with permission for these operations.
• The API host shown in the Balancer portal. Replace <your-api-host> in every example with that host.
• A shell, curl and Python 3 for examples that build JSON from environment variables.
• An HTTP group and a narrow expression that identifies your trusted requests. The example matches the /api/ path prefix; replace it with your reviewed trust condition before use.

Resource identifiers come from your API responses. Set each variable when its value is available, before the first step that uses it.

Environment variable	Value
GROUP_ID	Returned resource identifier, or your selected scope identifier.
HTTP_LB_ID	Returned resource identifier, or your selected scope identifier.
WAF_ALLOW_POLICY_ID	Returned resource identifier, or your selected scope identifier.

For an identifier, enter the value returned for your resource and export it:

read -r -p 'GROUP_ID: ' GROUP_ID
export GROUP_ID

Steps

1. Create the policy.

   curl --silent --show-error --include \
     --request POST \
     --url "https://<your-api-host>/waf-allow-policies" \
     --header "x-api-key: $BALANCER_API_KEY" \
     --header "Content-Type: application/json" \
     --data-binary '{"name":"trusted_requests"}'

   API reference: Create a reusable WAF allow policy

   Expected: HTTP 200. The following shows the response fields to check; additional data depends on your saved resources. Resource identifiers are illustrative.

   {
     "code": 200,
     "result": "success",
     "data": {
       "wafAllowPolicyId": 1
     }
   }

   Set WAF_ALLOW_POLICY_ID to the returned wafAllowPolicyId.

2. Add your reviewed expression.

   curl --silent --show-error --include \
     --request POST \
     --url "https://<your-api-host>/waf-allow-policies/$WAF_ALLOW_POLICY_ID/rules" \
     --header "x-api-key: $BALANCER_API_KEY" \
     --header "Content-Type: application/json" \
     --data-binary '{"rule":{"name":"trusted_api","requestExpression":"starts_with(http.request.uri.path, \"/api/\")"}}'

   API reference: Create a WAF allow-policy rule

   Expected: HTTP 200. The following shows the response fields to check; additional data depends on your saved resources. Resource identifiers are illustrative.

   {
     "code": 200,
     "result": "success",
     "data": {
       "wafAllowPolicyRuleId": 1
     }
   }

3. Assign the policy to the group.

   python3 - <<'PYBODY' | \
   curl --silent --show-error --include \
     --request PATCH \
     --url "https://<your-api-host>/http-loadbalancers/$HTTP_LB_ID/groups/$GROUP_ID" \
     --header "x-api-key: $BALANCER_API_KEY" \
     --header "Content-Type: application/json" \
     --data-binary @-
   import json, os
   print(json.dumps({'wafAllowPolicyId': int(os.environ['WAF_ALLOW_POLICY_ID'])}))
   PYBODY

   API reference: Update an HTTP group configuration

   Expected: HTTP 200. The following shows the response fields to check; additional data depends on your saved resources. Resource identifiers are illustrative.

   {
     "code": 200,
     "result": "success",
     "data": {
       "groupId": 1
     }
   }

4. Read the assigned policy.

   curl --silent --show-error --include \
     --request GET \
     --url "https://<your-api-host>/http-loadbalancers/$HTTP_LB_ID/groups/$GROUP_ID" \
     --header "x-api-key: $BALANCER_API_KEY"

   API reference: Get HTTP group

   Expected: HTTP 200. The following shows the response fields to check; additional data depends on your saved resources. Resource identifiers are illustrative.

   {
     "code": 200,
     "result": "success",
     "data": {
       "groupId": 1
     }
   }

Verify

Compare a matching request with a request outside the expression. A match continues toward cache or origin without an allow response body. Confirm that earlier source blocks and budgets still produce their configured decisions.

Use your configured site domain in this traffic check:

curl --silent --show-error --include "https://example.com/api/"

Expected: the site behavior described above. The application response body and status depend on your origin and selected policies.

An API mutation saves desired configuration first. Readback and a live traffic check answer different questions. No fixed propagation time is established.

Troubleshooting

Symptom	Cause	Fix
Trusted request returns 403 or 429	An earlier source block or budget rejects it	Inspect source policies and rate limits.
Trusted request still reaches WAF	Effective group or route lacks the policy	Read wafAllowPolicyId at the effective scope.
Request returns 502	WAF allow evaluation fails	Check the expression and request fields.

Limits and defaults

Setting	Limit or default
Policy name	1 to 64 characters
Rule expression	Maximum 8192 characters

API status codes

Status	Meaning
200	Request succeeds; inspect returned data.
400	Invalid arguments or configuration.
401	Authentication or authorization denied.
404	Resource or parent is unavailable.
409	Resource state conflicts with the operation.
412	Inspect the returned error details.
500	The request encounters a server error.
503	The operation is temporarily unavailable.

Related API operations

• DELETE /waf-allow-policies/{wafAllowPolicyId}
• DELETE /waf-allow-policies/{wafAllowPolicyId}/rules/{wafAllowPolicyRuleId}
• GET /http-loadbalancers/{httpLbId}/groups/{groupId}
• GET /waf-allow-policies
• GET /waf-allow-policies/{wafAllowPolicyId}
• GET /waf-allow-policies/{wafAllowPolicyId}/rules
• GET /waf-allow-policies/{wafAllowPolicyId}/rules/{wafAllowPolicyRuleId}
• PATCH /http-loadbalancers/{httpLbId}/groups/{groupId}
• PATCH /waf-allow-policies/{wafAllowPolicyId}
• PATCH /waf-allow-policies/{wafAllowPolicyId}/rules/{wafAllowPolicyRuleId}
• POST /waf-allow-policies
• POST /waf-allow-policies/{wafAllowPolicyId}/rules

API reference

• Delete a reusable WAF allow policy after verifying it is not assigned

• Delete a WAF allow-policy rule

• Get HTTP group

• List reusable WAF allow policies

• Return details of a reusable WAF allow policy

• List rules for a WAF allow policy

• Return details of a WAF allow-policy rule

• Update an HTTP group configuration

• Update a reusable WAF allow policy

• Update a WAF allow-policy rule

• Create a reusable WAF allow policy

• Create a WAF allow-policy rule

• Groups and Routes

• WAF Allow Policies

Need Help?

Contact your account manager or use the Balancer portal.