Traffic Policy Rules

Security Rules

Protect your endpoint with IP restrictions, rate limiting, authentication, and circuit breaking.

IP Restriction

Allow or deny requests from specific IP ranges (IPv4/IPv6 CIDR).

Rate Limit

Limit requests per time window. Protect your backend from abuse.

Verify Webhook

Validate incoming webhook signatures against a shared secret.

JWT Validation

Validate JSON Web Tokens at the edge. Supports HMAC and RSA/ECDSA algorithms.

API Key Validation

Validate API keys at the edge. Manage keys in the API Keys tab.

Body Validation

Validate JSON request bodies against a JSON Schema (draft 2020-12). Only validates application/json requests.

Circuit Breaker

Stop sending traffic to failing backends. The circuit opens when error rates exceed a threshold, and automatically recovers after a cooldown period.

Terminate TLS

Decrypt TLS traffic at the edge. Optionally enforce mutual TLS (mTLS) with client certificate verification.

Traffic Rules

Control traffic flow with caching, redirects, custom responses, and webhooks.

Cache Response

Cache responses at the edge (Redis-backed). Serve cached content without hitting your backend.

Force HTTPS

Redirect all HTTP requests to HTTPS with a 301 status code. No configuration needed. Also available as a toggle on the Endpoint Overview tab.

Redirect

Redirect requests to a different URL with configurable status code.

Custom Response

Return a custom response without forwarding to your backend. Useful for maintenance pages, health checks, or static content. Subject to AI content safety validation.

Custom Error Page

Replace error responses from your backend with custom-branded error pages. Supports template tokens for dynamic content.

Webhook

Forward request or response data to an external HTTP endpoint. Useful for logging, notifications, or custom processing pipelines.

Modification Rules

Modify request and response headers and rewrite URLs.

Add Headers

Inject custom headers into requests (before forwarding) or responses (before returning to client).

Remove Headers

Strip specific headers from requests or responses.

URL Rewrite

Rewrite request URLs before forwarding to your backend using regex patterns with capture groups.

# Example: Strip /api/v1 prefix
# Pattern: ^/api/v1/(.*)$
# Replacement: /$1

API Gateway Rules

Additional edge rule types for full API-gateway behavior. Add them from the same Traffic Policy editor.

CORS

Answer CORS preflight (OPTIONS) requests at the edge and add Access-Control-Allow-* headers to responses — no backend changes. Runs in the request phase.

Set Variables

Compute named variables from CEL expressions into a per-request bus. Later rules read them in conditions (vars.tier == "gold") and in header / redirect / custom-response values (${vars.tier}). Runs in the request phase. One name = expression per line.

tier = req.headers["x-tier"]
is_admin = req.path.startsWith("/admin")
# then, in an Add Headers rule:  X-Plan: plan-${vars.tier}

Replace Body

Find/replace in the response body (literal or regex) — e.g. rewrite internal URLs or redact strings. Applies to complete, uncompressed responses up to a size cap; streamed and already-compressed responses pass through untouched.

Compress

Compress eligible response bodies at the edge, negotiating br (Brotli, preferred) or gzip from the client's Accept-Encoding. Compressible text/JSON types only; never inflates or double-compresses.

WAF

A web application firewall that inspects each request (URI, headers, and optionally an inline body) against an OWASP-style ruleset via the Coraza engine and blocks or logs matches. Runs in the request phase. The built-in core ruleset covers SQL injection and XSS (libinjection), path traversal / sensitive-file access, OS-command and template injection, Log4Shell/JNDI, and known scanner user-agents — no external OWASP CRS to manage. Advanced users can supply their own Coraza SecLang.

Mode defaults to detect (log only) so turning the WAF on can never break a live endpoint on day one — watch the logs, then switch to block. The compiled engine is cached per ruleset; endpoints without a WAF rule pay nothing.

Bot Management

Match the client's TLS JA3 fingerprint — computed at the edge from the ClientHello — against allow/deny lists to block or log automated clients. Runs in the request phase. Mode defaults to detect (log only). Fingerprinting is only computed when a bot-management rule exists on some endpoint, so endpoints not using it pay nothing.

The JA3 is GREASE-normalized (RFC 8701 random values stripped) so it's stable per client. Run in detect mode first and copy the exact fingerprints the edge logs into your denylist — those match what the matcher computes. The fingerprint is also readable in any rule's CEL guard as conn.ja3 (e.g. conn.ja3 == "e7d705…" && req.path.startsWith("/api")).

Rate limit — flexible keying

The Rate Limit rule's Scope now supports per-IP, per-endpoint, and per header, cookie, or JWT claim value (with a key name). Counting is shared across edges. Header/cookie/JWT-claim scopes bucket by client-controlled values (the JWT claim is not signature-verified) — use them for fair sharing, and pair with a per-IP rule as the hard ceiling against abuse.

Impact preview (blast radius)

In the rule editor, replayable rule types show a Preview impact button. It replays your last ~2 hours of captured traffic through the unsaved rule and reports how many requests would be newly blocked / throttled / redirected, how many previously-successful requests would break, the client IPs affected, and a safe / caution / risky verdict — so you can check the blast radius before you save. Requires request capture enabled on the endpoint.