Classic Schema Validation

Use the API Shield interface to configure API Schema Validation, which validates requests according to the API schema you provide.

Before you can configure Schema Validation for an API, you must obtain an API Schema file matching our specifications.

If you are in the Schema Validation 2.0 beta, you can make changes to your settings but you cannot add any new Classic Schema Validation schemas.

Note

This feature is only available for customers on an Enterprise plan. Contact your Cloudflare Customer Success Manager to get access.

Create an API Shield with Schema Validation

To configure Schema Validation in the Cloudflare dashboard:

1. Log in to the Cloudflare dashboard and select your account and domain.

2. Select Security > API Shield.

3. Go to Schema Validation and select Add schema.

4. Enter a descriptive name for your policy and optionally edit the expression to trigger Schema Validation.

   For example, if your API is available at http://api.example.com/v1, include a check for the Hostname field — equal to api.example.com — and a check for the URI Path field using a regular expression — matching the regex ^/v1.

   Important

   To validate the hostname, you must include the Hostname field explicitly in the rule, even if the hostname value is in the schema file. Any hostname value present in the schema file will be ignored.

5. Select Next.

6. Upload your schema file.

7. Select Save to validate the content of the schema file and deploy the Schema Validation rule.

   If you get a validation error, ensure that you are using one of the supported file formats and that each endpoint and method pair has a unique operation ID.

After deploying your API Shield rule, Cloudflare displays a summary of all API endpoints organized by their protection level and actions that will occur for non-compliant and unprotected requests.

1. In the Endpoint action dropdown, select an action for every request that targets a protected endpoint and fails Schema Validation.
2. In the Fallthrough action dropdown, select an action for every request that targets an unprotected endpoint.
3. Optionally, you can save the endpoints to Endpoint Management at the same time the Schema is saved by selecting Save new endpoints to endpoint management. Endpoints will be saved regardless of whether the Schema is saved as a draft or published live.
4. Select Done.