Version 2.1.1792967583 · latest Download OpenAPI Markdown

Upload scan settings

Platform-wide upload scanning (files in multipart form uploads only): master switch, dangerous extensions, double extensions, disguised files, webshell signatures, antivirus, per-file limit, scan timeout, action and exceptions; admin only. Webshell signatures, antivirus and the sha256 blocklist belong to the paid feature WAF enhanced.

upload-scan-settingsProtectionAuthentication: Admin only2 endpoints

Get upload scan settings

GET/api/v2/upload-scan-settings
Authentication: Admin only

Update upload scan settings

PUT/api/v2/upload-scan-settings
Authentication: Admin only

Request body application/json

FieldTypeRequiredDescription
actionstring— On a hit - block, log only, or observe for 3 days (log only, then block); dangerous files have no observation period.
Values ["block","log","observe"]
disguiseboolean— Disguised file detection (image extension but the magic bytes are a script or an executable).
double_extboolean— Double extension detection (e.g. a.php.jpg, a.asp;.jpg).
enabledboolean— Master switch; false = no site is scanned.
enhancedstring— WAF enhanced state - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; enhanced items still work but are read-only) or basic (not purchased or past the buffer; enhanced items are off, settings kept); ignored on update.
Values ["full","readonly","basic"]
exceptionsUploadScanException[]— Exceptions - skip the signature when the site and path prefix match (empty sig = the path is not scanned). Entries that tenants added by marking false positives (source=false_positive) must be sent back unchanged on replace, otherwise they are overwritten.
expected_updated_atstring— Optimistic lock - the updated_at as the caller read it (the version of the node.global config key, shared with CC and WAF settings; use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
extsstring[]— Dangerous extensions (lowercase, without the dot); defaults to php phtml jsp jspx asp aspx ashx cer war sh cgi when omitted. A site may override with waf.upload_exts.
max_file_mbinteger— Per-file scan limit in MB (default 20); larger files only get the extension check and are handled per oversize.
observe_untilstring— End of the observation period (set when action is observe); ignored on update, written by the server.
on_parse_errorstring— On multipart parse errors (bad delimiter, oversized header, truncated body, too many parts) - block or allow (pass and log); default block.
Values ["allow","block"]
on_timeoutstring— On scan timeout (or failure to read the body) - allow (pass and log) or block (default allow).
Values ["allow","block"]
oversizestring— Files over the limit - allow (pass and log) or block.
Values ["allow","block"]
sha256object[]— Local sha256 blocklist (WAF enhanced).
sigboolean— Webshell signatures (WAF enhanced).
timeout_sinteger— Scan timeout per request in seconds (default 2).
updated_atstring— Version in the response (updated_at of the node.global config key; null if never changed); ignored on update.
virusstring— Antivirus (ClamAV, WAF enhanced) - off, mem4g (nodes with at least 4 GB memory) or all nodes.
Values ["off","mem4g","all"]

Upload scan settings object

FieldTypeRequiredDescription
actionstring— On a hit - block, log only, or observe for 3 days (log only, then block); dangerous files have no observation period.
Values ["block","log","observe"]
disguiseboolean— Disguised file detection (image extension but the magic bytes are a script or an executable).
double_extboolean— Double extension detection (e.g. a.php.jpg, a.asp;.jpg).
enabledboolean— Master switch; false = no site is scanned.
enhancedstring— WAF enhanced state - full (active), readonly (expired but within the read-only buffer, License.readonly_days, 7 days by default; enhanced items still work but are read-only) or basic (not purchased or past the buffer; enhanced items are off, settings kept); ignored on update.
read-onlyValues ["full","readonly","basic"]
exceptionsUploadScanException[]— Exceptions - skip the signature when the site and path prefix match (empty sig = the path is not scanned). Entries that tenants added by marking false positives (source=false_positive) must be sent back unchanged on replace, otherwise they are overwritten.
expected_updated_atstring— Optimistic lock - the updated_at as the caller read it (the version of the node.global config key, shared with CC and WAF settings; use 1970-01-01T00:00:00Z when the read value is null). If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
extsstring[]— Dangerous extensions (lowercase, without the dot); defaults to php phtml jsp jspx asp aspx ashx cer war sh cgi when omitted. A site may override with waf.upload_exts.
max_file_mbinteger— Per-file scan limit in MB (default 20); larger files only get the extension check and are handled per oversize.
observe_untilstring— End of the observation period (set when action is observe); ignored on update, written by the server.
read-only
on_parse_errorstring— On multipart parse errors (bad delimiter, oversized header, truncated body, too many parts) - block or allow (pass and log); default block.
Values ["allow","block"]
on_timeoutstring— On scan timeout (or failure to read the body) - allow (pass and log) or block (default allow).
Values ["allow","block"]
oversizestring— Files over the limit - allow (pass and log) or block.
Values ["allow","block"]
sha256object[]— Local sha256 blocklist (WAF enhanced).
sigboolean— Webshell signatures (WAF enhanced).
timeout_sinteger— Scan timeout per request in seconds (default 2).
updated_atstring— Version in the response (updated_at of the node.global config key; null if never changed); ignored on update.
read-only
virusstring— Antivirus (ClamAV, WAF enhanced) - off, mem4g (nodes with at least 4 GB memory) or all nodes.
Values ["off","mem4g","all"]