← Ruleset Engine / ruleset-engine / managed-rulesets / override-examples

Enable only selected rules

Use a ruleset override and a rule override in a phase entry point ruleset to execute only selected rules in a managed ruleset.

Add a rule to a phase entry point ruleset that executes a managed ruleset.
Configure a ruleset override that disables all rules in the managed ruleset.
Configure a rule override to set an action for the rules you want to execute.

Zone-level example

The following PUT request uses the Update a zone entry point ruleset operation to define a configuration that executes only two rules from a managed ruleset in the http_request_firewall_managed phase.

In this example:

"id": "<MANAGED_RULESET_ID>" defines the managed ruleset to execute for requests in the specified zone ($ZONE_ID).
"enabled": false defines an override at the ruleset level to disable all rules in the managed ruleset.
"rules": [{"id": "<RULE_ID_1>", "action": "block", "enabled": true}, {"id": "<RULE_ID_2>", "action": "log", "enabled": true}] defines a list of overrides at the rule level to enable two individual rules.

Required API token permissions

At least one of the following token permissions is required:

Response Compression Write
Config Settings Write
Dynamic URL Redirects Write
Cache Settings Write
Custom Errors Write
Origin Write
Managed headers Write
Zone Transform Rules Write
Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
HTTP DDoS Managed Ruleset Write
Sanitize Write
Transform Rules Write
Select Configuration Write
Bot Management Write
Zone WAF Write
Account WAF Write
Account Rulesets Write
Logs Write
Logs Write

Update a zone entry point ruleset

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"action": "execute",
						"expression": "true",
						"action_parameters": {
								"id": "<MANAGED_RULESET_ID>",
								"overrides": {
										"enabled": false,
										"rules": [
												{
														"id": "<RULE_ID_1>",
														"action": "block",
														"enabled": true
												},
												{
														"id": "<RULE_ID_2>",
														"action": "log",
														"enabled": true
												}
										]
								}
						}
				}
		]
	}'

Account-level example

The following PUT request uses the Update an account entry point ruleset operation to define a configuration that executes only two rules from a managed ruleset in the http_request_firewall_managed phase.

In this example:

"id": "<MANAGED_RULESET_ID>" defines the managed ruleset to execute for requests addressed to example.com.
"enabled": false defines an override at the ruleset level to disable all rules in the managed ruleset.
"rules": [{"id": "<RULE_ID_1>", "action": "block", "enabled": true}, {"id": "<RULE_ID_2>", "action": "log", "enabled": true}] defines a list of overrides at the rule level to enable two individual rules.

Required API token permissions

At least one of the following token permissions is required:

Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
Transform Rules Write
Select Configuration Write
Account WAF Write
Account Rulesets Write
Logs Write

Update an account entry point ruleset

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"action": "execute",
						"expression": "cf.zone.name eq \"example.com\" and cf.zone.plan eq \"ENT\"",
						"action_parameters": {
								"id": "<MANAGED_RULESET_ID>",
								"overrides": {
										"enabled": false,
										"rules": [
												{
														"id": "<RULE_ID_1>",
														"action": "block",
														"enabled": true
												},
												{
														"id": "<RULE_ID_2>",
														"action": "log",
														"enabled": true
												}
										]
								}
						}
				}
		]
	}'