Web Application Firewall:Asset management

Access the console

1. Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.

2. In the left-side navigation pane, choose Protection Config > API Security.

3. Click the Assets tab.

Feature areas

On the Assets tab, you can view API asset statistics and search for assets by using filters. The page has three main areas:

• API asset overview: Located at the top of the page, this area displays overall statistics for your API assets.

• Application site bar: Located on the lower-left side of the page, this area lets you filter assets by site.

• API asset list: Located on the lower-right side of the page, this area lists the details of API assets that match your filter criteria.

Search and filter

The search bar above the asset list allows you to filter API assets by the following criteria: API name, remarks, time range, sensitive data type, service object, business purpose, request method, active status, watch status, authentication status, and API sensitivity level.

Manually import API assets from Swagger

Agentic API Security supports automatic discovery and management of API assets from traffic, which is suitable for discovering APIs that are already running online. For scenarios where an API is not yet online, has low traffic, is in a canary release, or requires contract-level validation for requests and responses, automatic discovery may delay asset discovery or provide incomplete parameter information. In these cases, you can manually import a Swagger (OpenAPI) specification file to bulk-import API contracts defined by your development team as API assets. This method lets you onboard assets in advance and provides a definitive API structure for subsequent schema validation and sensitive data identification.

Procedure

1. In the API Assets, click Import Swagger on the right.

2. In the Import API Assets from Swagger dialog box, upload a JSON file (up to 5 MB in size). The following is an example.

   {
     "openapi": "3.0.3",
     "info": {
       "title": "User Information API",
       "version": "1.0.0"
     },
     "servers": [
       {
         "url": "https://user.example.com"
       }
     ],
     "paths": {
       "/users/{userId}": {
         "get": {
           "summary": "Query user information",
           "parameters": [
             {
               "name": "userId",
               "in": "path",
               "required": true,
               "schema": {
                 "type": "string"
               }
             }
           ],
           "responses": {
             "200": {
               "description": "Query successful",
               "content": {
                 "application/json": {
                   "schema": {
                     "$ref": "#/components/schemas/UserResponse"
                   }
                 }
               }
             }
           }
         }
       }
     },
     "components": {
       "schemas": {
         "UserResponse": {
           "type": "object",
           "properties": {
             "userId": {
               "type": "string"
             },
             "userName": {
               "type": "string"
             },
             "phone": {
               "type": "string"
             },
             "idCard": {
               "type": "string"
             }
           }
         }
       }
     }
   }

3. After the file is uploaded, the system automatically parses the APIs. Complete the following settings:

   • Associated Protected Object: Select the protected object to associate with the APIs.

   • Handling for existing APIs: If the system has already auto-discovered the same API asset from traffic, select how to handle the duplicate:

     • Skip: Keep the existing asset discovered by the system and ignore the duplicate item in this upload.

     • Overwrite: Use the API specification from this upload to update the schema of the existing discovered asset. The call volume, active status, risk records, and other information of the existing asset are not affected.

4. After you complete the configuration, click Import Records on the right side of the API Assets to view the import status and results.

Configure a schema for an API asset

Agentic API Security allows you to configure a schema for an API asset, which defines the specifications for its request parameters and response structure. This schema serves as the official API contract, which the schema validation policy uses to compare runtime requests against the defined structure.

Procedure

1. In the API Assets, locate the target API asset.

2. In the Actions column, click Configure Schema. You can configure the schema in either of the following modes.

   Visual mode

   In Visual Mode, you can configure the schema in three separate tabs: Parameters, Request body, and Responses. Information such as Method, HostName, and Path cannot be modified.

   Parameters

   You can add parameters located in the path, query, header, or cookie. For each parameter, you can configure the following settings:

   Parameter	Description
   Field name	The name of the parameter. This setting is required.
   Type	The data type of the parameter, such as string, integer, or boolean.
   required	Specifies whether the parameter is required. Parameters in the path are always required. You can toggle this setting for other locations.
   format	The format of the parameter, such as email, date, or uuid. The available options depend on the selected type.
   pattern	A regular expression for validation. This setting applies only to the string type.
   enum	A list of acceptable values. Separate multiple values with commas.

   Request body

   You can specify whether the request body is required and define the field structure of the request body based on its Content-Type (such as application/json). The field settings are the same as those for Parameters.

   Responses

   You can add a status code, such as 200, and configure the response headers and response body for each status code:

   • Response headers: Define the field name, type, and the required, format, pattern, and enum properties for response header fields.

   • Response body: Define the field structure of the response body based on its Content-Type. The field settings are the same as described above. Additionally, you can set the sensitive data type for fields in the response body, which is used for real-time data masking of API responses. Sensitive data types can only be configured in Responses.

   JSON mode

   In JSON Mode, you can directly edit JSON content that complies with the OpenAPI 3.0.x/3.1.x specification. The following requirements apply:

   • The JSON content can contain only one path and one method, and they must match the method, domain name, and path of the current API asset.

   • The servers array must include a domain name that matches the current asset.

   JSON example

   {
     "openapi": "3.0.3",
     "info": {
       "title": "Create User API",
       "version": "1.0.0"
     },
     "servers": [
       {
         "url": "https://www.example.com"
       }
     ],
     "paths": {
       "/users": {
         "post": {
           "summary": "Create user",
           "requestBody": {
             "required": true,
             "content": {
               "application/json": {
                 "schema": {
                   "type": "object",
                   "properties": {
                     "userName": { "type": "string" },
                     "email": { "type": "string", "format": "email" },
                     "status": {
                       "type": "string",
                       "enum": ["active", "inactive"]
                     }
                   },
                   "required": ["userName", "email"]
                 }
               }
             }
           },
           "responses": {
             "200": {
               "description": "Success",
               "content": {
                 "application/json": {
                   "schema": {
                     "type": "object",
                     "properties": {
                       "userId": { "type": "integer", "format": "int64" },
                       "userName": { "type": "string" },
                       "email": {
                         "type": "string",
                         "format": "email",
                         "x-sensitive-data-types": ["Email"]
                       }
                     },
                     "required": ["userId"]
                   }
                 }
               }
             }
           }
         }
       }
     }
   }

3. Configure a Schema Validation template to validate actual requests and responses. For more information, see IV. Response Policy Configuration.

View API asset details

In the API Asset List, click an API name to go to the API Details page. This page has five tabs: Overview, Sample Request, Traffic Analytics, Risks and Events, and Protection Suggestions.

Overview

The overview card at the top of the page displays the following information: associated domain, first discovered time, last active time, business purpose, service object, authentication status, associated protected object, and remarks.

Request sample

Click the Sample Request tab to view the following information:

• Sensitive Data Type: If the request or response contains sensitive data, the specific types are displayed here.

• Request Sample Display: This section displays up to five randomly selected API request samples. You can switch between Split Display and Merge Display modes:

  • Split Display: Splits the sample into Sensitive Data, Standard, Request Header, Response Header, Request Body, and Response Body sections, which you can view and copy individually.

  • Merge Display: Consolidates the sample into Sensitive Data, Sample Request, and Sample Response sections, which you can view and copy individually to simplify traffic replay tests.

• Validation Actions:

  • Click Browser to quickly test API access.

  • Click Command Line to get a cURL command for manual access validation.

• Parameter Recognition Results: The Request Parameter Type and Response Parameter Type areas display the results from traffic baselining, including Parameter, Value Characteristics, and Parameter Position.

Traffic analysis

Click the Traffic Analytics tab to view access data for the API over the last 30 days:

• Traffic Analytics: Displays the API call trend and statistics for Total Calls, Bot Requests, and Cross-border Requests.

• Top 20 Access Sources: This section lists the top 20 access sources from the last 30 days, which you can rank by Total Traffic, Bot Traffic, and Cross-border Traffic.

• Client Source Statistics: This section provides statistics on access source distribution over the last 30 days across four dimensions: Referer, client type, geographic location, and account.

Risks and events

Click the Risks and Events tab to view Risks, IP Security Events, and Account Security Events associated with the API. In the Actions column, click View Details to navigate to the details page for more information.

Protection suggestions

Click the Protection Suggestions tab. WAF provides targeted security recommendations based on its analysis of the API call baseline.

Routine operations

In the API Asset List, you can select which columns to display by clicking the icon in the upper-right corner of the list, and perform the following actions: