Can I protect my REST APIs with TR7 WAF?

Short answer

Yes. REST APIs are protected on the same HTTP vService as web pages, with the same WAF; no separate API product or setting is required (use cases). The request is parsed according to the Content-Type header: every key and text value of JSON and XML bodies, the query parameters, the headers and the path are scanned separately with signatures; all items of the OWASP API Top 10 are covered, the tenth item with structural rules rather than signatures. As the positive model, every endpoint becomes a page type: the allowed methods, the parameter, header and JSON key lists, and the depth and length limits are defined. This rule set can be generated in a single step from the API's OpenAPI definition with Import (OpenAPI) or learned from the traffic with Analysis & Learning. A JSON blocking response can be returned to a blocked API client instead of HTML. WAF inspects only the request; it does not verify the validity of a JWT, OAuth or API key and does not scan the response. A request rate limit is set up not in WAF but in L7 DDoS & Threat Protection and with Load Balancer Conditions and actions.

How Does It Work?

WAF parses an API request according to the type of its body and inspects each part separately:

Request part	How it is inspected
Path	The path is matched with the page types; the method, the path length and the path depth are checked.
Query parameters	Each parameter name and value goes separately through signature scanning and the Query checks.
Headers	The Header checks and signature scanning.
JSON body	If the Content-Type is of the …/json or …+json type (e.g. application/json; charset=utf-8, application/problem+json), the body is parsed as JSON; every key path and text value goes through the JSON checks and signature scanning.
XML body	If the Content-Type is of the …/xml or …+xml type, the body is parsed as XML; the element and attribute paths and values go through the Xml checks and signature scanning.
Other bodies	Types other than form (e.g. application/graphql, text/plain) go through the Raw checks as a raw body.

Each violation is added to the attack score of the request: signature hits are 2 to 8 points (9 in three built-in rules), structural violations (an unexpected parameter, a method that is not allowed, excessive depth) are 24 points, and when the score reaches the blocking threshold, the request is blocked in Blocking mode (violation scores).

API Protection in TR7

Requirement	In TR7	Details
Signature scanning (SQL injection, XSS, SSRF…)	In the JSON, XML, form, query, header, path and raw body	In which parts of a request are signatures scanned (Path, Query, Header, JSON, XML, Form and Raw)?
Endpoint and method allowlist	Page type + Allowed Methods; rejecting undefined endpoints with the Any Paths rule	How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?
Rules from OpenAPI	Import (OpenAPI); in the reverse direction, Export (OpenAPI)	Can I generate API protection rules automatically from my OpenAPI definition?
JSON key, depth, length	The JSON tab of the page type	Can I apply schema-like checks (key list, depth, length) to JSON-bodied API requests?
SOAP / XML, XXE	The Xml tab and the XML External Entity signatures	Can I protect my SOAP / XML services; is there protection against XXE attacks?
GraphQL	Parsing as JSON and GraphQL-specific signatures	Can I protect GraphQL requests?
Required header (e.g. x-api-key)	Required Headers; the presence of the header is checked, its value is not verified	Can I define required parameters (Required Query Parameters / Required Headers / Required Form Fields)?
JSON blocking response	Blocking Page ready-made template	Can I return a JSON blocking response instead of HTML for API clients?
Request rate limit	Not in WAF; L7 DDoS & Threat Protection and Load Balancer Conditions and actions	Can I do rate limiting (X requests per second per IP)? · Can I apply rate limiting based on a key such as an API key / token?
JWT, OAuth, API key verification	Not in WAF	The validity of the token and the key is verified in the API itself
Response inspection	Not in WAF	WAF inspects only the request

Recommended starting order:

1. WAF is turned on in the HTTP vService (How do I enable WAF protection on a vService?). With HTTPS, TLS must be terminated on this vService (Can the WAF see the content of HTTPS traffic; what is required for that?).
2. If the API is on a separate domain name, its own host group is added (How is a Host Group added; what goes into the Virtual Host Patterns field?).
3. The rule set is imported from the OpenAPI definition or learned from the traffic; in the Analysis & Learning window, the Only Browsers check mark is removed, because API clients are not recognized as browsers. The paths that come out of the analysis are reviewed; only the endpoints for which WAF rules will be created should remain in the list. It is recommended that unknown or suspicious paths be removed from the analysis with Exclude from Analysis before applying.
4. The Blocking Page is set with the JSON template.
5. The host group is tried with real traffic in Monitor mode, false positives are taught, and then Blocking mode is switched to (When should I move from Learning to Monitor and from Monitor to Blocking?).

Common Misconceptions

• "A separate product is required for API protection." API traffic is inspected with the same WAF as web traffic, on the same vService; the API-specific settings are the field checks of the page types.
• "WAF verifies the API key or the JWT." WAF does not authenticate; only the presence of the header (Required Headers) and the format of its value (Header Value Pattern) can be checked. This check can be imitated; it is not authentication.
• "WAF limits the number of requests." The rate limit is on the L7 DDoS & Threat Protection and Load Balancer side (What is the difference between WAF and L7 DDoS & Threat Protection; do I need both?).
• "JSON checks work even if the Content-Type is wrong." If the Content-Type is not of the …/json or …+json type, the body is not parsed as JSON; it is scanned as a raw body.

How it is done in the documentation

• WAF · Use Cases
• WAF · What Is the Classification Good For?
• Import (OpenAPI) · What Is Import (OpenAPI)?
• Path Check Fields · The Tabs and the Section They Inspect

Related questions

• How do I set up a positive security model for an API (allowed endpoints, methods, parameters)?
• Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?
• Can I return a JSON blocking response instead of HTML for API clients?