Dear Alibaba Cloud Customer,

Thank you for your continued trust in and support of Alibaba Cloud Web Application Firewall (WAF).

To better address security threats in API scenarios, Alibaba Cloud WAF 3.0 will officially launch Agentic API Security (LLM-Powered Edition) on July 31, 2026. This release also introduces billing and feature upgrades to the existing API Security module. Please review the following changes and make the necessary preparations in advance.

1. Overview

WAF 3.0 will introduce a brand-new Agentic API Security module. Building on the existing API Security capabilities, it incorporates an LLM-powered intelligent detection engine (Agentic AI) and will progressively add advanced security operations and management capabilities, significantly enhancing the depth and breadth of API security protection.

After the new version goes live, the existing "API Security" module will enter maintenance mode and will no longer receive feature updates.

2. Feature Changes

2.1 Agentic API Security (New Version)

Agentic API Security is the LLM-powered edition of API Security. Compared with the existing API Security module (rule-based detection), the new version introduces the following key enhancements:

An LLM-powered Agentic API security detection engine that improves the identification of unknown threats

Richer API security operations and management capabilities

2.2 Existing API Security (Legacy Version)

After the new version goes live, the existing "API Security" module will enter maintenance mode:

Users who have already enabled the legacy API Security can continue to use it normally without any impact on existing functionality.

The legacy API Security module will no longer receive new features. Only essential stability maintenance will be performed.

We recommend upgrading to Agentic API Security at your earliest convenience to benefit from more comprehensive protection.

3. Billing Changes

3.1 Subscription Users

(1) New Purchases

Starting from July 31, 2026, when purchasing a new WAF 3.0 instance, the API Security module will default to Agentic API Security. The legacy "API Security" option will no longer be displayed.

(2) Upgrades

If the legacy API Security is not enabled on your instance: you can directly purchase Agentic API Security during the upgrade.

If the legacy API Security is already enabled on your instance: please contact our support team or your account manager for assistance with upgrading to Agentic API Security.

(3) Downgrades

Once you choose to enable Agentic API Security, you will not be able to switch back to the legacy API Security. Please confirm your decision before proceeding.

(4) Agentic API Security Pricing

Base Edition Fees

Pro: 1,080 USD/month

Enterprise: 1,800 USD/month

Ultimate: 3,600 USD/month

QPS Extension Surcharge: After enabling Agentic API Security, the API Security portion of the QPS extension fee will be replaced by the AI module QPS extension fee at a rate of 0.36 USD/QPS/month (previously 0.30 USD/QPS/month), displayed as a separate line item in the billing details.

Elastic QPS Extension Surcharge: After enabling Agentic API Security, the API Security portion of the elastic QPS extension fee will be replaced by the AI module elastic QPS extension fee at a rate of 0.018 USD/QPS/day (previously 0.015 USD/QPS/day), displayed as a separate line item in the billing details.

3.2 Pay-As-You-Go Users

(1) New Credit Billing Unit

Agentic API Security uses a new Credit billing unit for pay-as-you-go pricing (100 Credits = 0.2 USD). The specific rates are as follows:

Instance fee (per protected object): 125 Credits / protected object / hour

Request processing fee: 1 Credit / 1,200 requests / hour

(2) Migration for Existing Users

Existing pay-as-you-go API Security users will continue to use SeCU billing. There is no impact on functionality or billing.

A "Switch to Agentic API Security" button will be added to the API Security console page. Clicking this button will switch you to the new Credit billing model and unlock all Agentic API Security features.

Important: The switch is a one-way operation. Once you switch to Credit billing, you cannot revert to SeCU billing. Please review the information carefully before proceeding. A pop-up window will display the pricing changes and an overview of the new features at the time of switching.

The legacy API Security module using SeCU billing will no longer receive feature updates.

(3) Pay-As-You-Go Bill Composition

After switching, your WAF pay-as-you-go bill will consist of two parts — SeCU and Credit:

SeCU portion: Covers WAF instance and traffic fees, resource onboarding fees, core web protection fees, and legacy advanced protection fees (including Bot Management and legacy API Security).

Credit portion: Covers Agentic API Security protected object fees and traffic processing fees.

4. Recommended Actions

Assess the impact: Evaluate whether to upgrade and how the upgrade may affect your API security protection strategy and costs based on your business needs.

Explore the new features: We recommend logging in to the WAF console to learn about the new capabilities and billing details of Agentic API Security.

Plan your migration timeline: If you are currently using the legacy API Security, we recommend switching to Agentic API Security at your earliest convenience after July 31, 2026, to benefit from more comprehensive protection.

5. Frequently Asked Questions

Q1: What is the difference between Agentic API Security and the legacy API Security?

Agentic API Security is a comprehensive upgrade to the legacy API Security module. In addition to the original rule-based API data leak and anomalous request detection capabilities, it introduces an LLM-powered intelligent detection engine that provides contextual semantic recognition of sensitive data and business usage patterns. It also adds advanced security operations and management capabilities (such as API Swagger 3.0 validation), delivering significantly improved protection in both depth and breadth.

Q2: Will my costs increase after the upgrade?

Yes. The overall cost of Agentic API Security will be slightly higher than that of the legacy API Security. For detailed pricing information, please refer to the product documentation. Agentic API Security offers a more transparent fee breakdown.

Q3: I have already purchased the legacy API Security. Am I required to switch?

No, the switch is not mandatory. You can continue to use the legacy API Security; however, it will no longer receive feature updates and will be gradually phased out. We recommend proactively upgrading to Agentic API Security within a suitable timeframe.

Q4: Can I switch back to SeCU billing after switching to Credit billing as a pay-as-you-go user?

No. The switch to Credit billing is a one-way operation and cannot be reverted to SeCU. Please carefully review the pricing and feature descriptions in the pop-up window before proceeding with the switch.

6. Additional Information

WAF 3.0 Billing Documentation: [Link]

If you have any questions, please contact Alibaba Cloud Technical Support via the ticket system or reach out to your account manager.

Alibaba Cloud Web Application Firewall Team

July 2026