All Products
Search

This Product

    Web Application Firewall:DescribeApisecAbnormals

    Document Center

    Web Application Firewall:DescribeApisecAbnormals

    Last Updated:Jul 06, 2026

    Queries the list of API security risks.

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-waf:DescribeApisecAbnormals

    get

    *All Resource

    *
    • acs:ResourceGroupId
    		 None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    InstanceId

    string

    Yes

    Instance ID of the WAF instance.

    Note

    You can call the DescribeInstance operation to query instance ID of the WAF instance.

    waf_v2_public_cn-z***9g301
    ApiId

    string

    No

    The ID of the API associated with the risk.

    bd9efb8ad******d9ca6
    ApiFormat

    string

    No

    The API operation associated with the risk.

    /api/users/login
    MatchedHost

    string

    No

    The domain name or IP address to which the API operation belongs.

    a.aliyun.com
    StartTime

    string

    No

    The start time of the query. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684252800
    EndTime

    string

    No

    The end time of the query. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684382100
    OrderKey

    string

    No

    The name of the field used for sorting. Valid values:

    • discoverTime: the time when the risk was first detected. This is the default value.

    • abnormalLevel: the risk level.

    • latestDiscoverTime: the time when the risk was most recently detected.

    firstTime
    OrderWay

    string

    No

    The sort order. Valid values:

    • desc: descending order. This is the default value.

    • asc: ascending order.

    desc
    AbnormalLevel

    string

    No

    The risk level. Valid values:

    • high: high risk.

    • medium: medium risk.

    • low: low risk.

    medium
    AbnormalTag

    string

    No

    The risk type.

    Note

    You can call the DescribeApisecRules operation to query the supported risk types.

    LackOfSpeedLimit
    AbnormalId

    string

    No

    The risk ID.

    29c6401****99a2bad3943e26d8
    UserStatus

    string

    No

    The risk status. Valid values:

    • toBeConfirmed: to be confirmed.

    • confirmed: confirmed.

    • toBeFixed: to be fixed.

    • fixed: fixed (manually verified).

    • ignored: ignored.

    • toBeVerified: to be verified by the system.

    • notFixed: not fixed after verification.

    • systemFixed: fixed (verified by the system).

    Confirmed
    PageNumber

    integer

    No

    The page number to return in a paging query. Default value: 1, which indicates the first page.

    2
    PageSize

    integer

    No

    The number of entries per page in a paging query. Default value: 10, which indicates 10 entries per page.

    10
    Origin

    string

    No

    The source of the risk type. Valid values:

    • custom: custom.

    • default: built-in.

    custom
    ApiTag

    string

    No

    The business purpose of the API.

    Note

    You can call the DescribeApisecRules operation to query the supported business purposes.

    RegisterAPI
    ClusterId

    string

    No

    The ID of the hybrid cloud cluster.

    Note

    This parameter applies only to hybrid cloud scenarios. You can call the DescribeHybridCloudClusters operation to query hybrid cloud cluster information.

    546
    RegionId

    string

    No

    The region where the WAF instance is deployed. Valid values:

    • cn-hangzhou: the Chinese mainland.

    • ap-southeast-1: outside the Chinese mainland.

    cn-hangzhou
    ResourceManagerResourceGroupId

    string

    No

    The Alibaba Cloud resource group ID.

    rg-acfm***q

    Response elements

    Element

    Type

    Description

    Example

    object

    The response.

    TotalCount

    integer

    The total number of entries returned.

    5
    RequestId

    string

    The request ID.

    9469646C-F2CC-5F0F-8401-C53***4F46
    Data

    array<object>

    The list of risks.

    object

    The risk information.

    AbnormalId

    string

    The risk ID.

    7c1431f27ae7e9c8cc64095***68e
    Origin

    string

    The source of the risk type. Valid values:

    • custom: custom.

    • default: built-in.

    custom
    LastestTime

    integer

    The most recent access time of the API asset. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684252800
    FirstTime

    integer

    The time when the API asset was first discovered. The value is a UNIX timestamp (UTC). Unit: seconds.

    1701138088
    AbnromalStatus

    string

    The risk status.

    unresolved
    ApiFormat

    string

    The API operation associated with the risk.

    /api/login
    ApiTag

    string

    The business purpose of the API.

    Note

    You can call the DescribeApisecRules operation to query the supported business purposes.

    SendMail
    DiscoverTime

    integer

    The time when the risk was first detected. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684252800
    UserStatus

    string

    The risk status. Valid values:

    • toBeConfirmed: to be confirmed.

    • confirmed: confirmed.

    • toBeFixed: to be fixed.

    • fixed: fixed (manually verified).

    • ignored: ignored.

    • ** toBeVerified**: to be verified by the system.

    • ** notFixed**: not fixed after verification.

    • ** systemFixed**: fixed (verified by the system).

    Confirmed
    IgnoreTime

    integer

    The time when the user marked the risk as ignored. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684252800
    Follow

    integer

    Indicates whether the risk is followed. Valid values:

    • 1: followed.

    • 0: not followed. This is the default value.

    0
    MatchedHost

    string

    The domain name or IP address to which the API operation belongs.

    a.aliyun.com
    Note

    string

    The remarks.

    Strict
    AbnormalEventNumber

    integer

    The number of events associated with the risk.

    2
    AbnormalTag

    string

    The risk type.

    Note

    You can call the DescribeApisecRules operation to query the supported risk types.

    LackOfSpeedLimit
    AbnormalInfo

    string

    The detailed risk information, which is a JSON string constructed from a series of parameters. The parameters include:

    • rule: the rule associated with the risk.

    • data_type: the sensitive data type.

    • custom_rule_name: the custom rule name.

    • rule_name: the built-in rule name.

    { "data_type": ["1005","1004"], "rule": { "parent": "RiskType_Permission", "code": "Risk_UnauthSensitive", "level": "high", "origin": "default", "name": "Risk_UnauthSensitive" } }
    ApiId

    string

    The ID of the API associated with the risk.

    09559c0d71ca2ffc996b81***836d8
    AbnormalLevel

    string

    The risk level. Valid values:

    • high: high risk.

    • medium: medium risk.

    • low: low risk.

    high
    LatestDiscoverTime

    integer

    The time when the risk was most recently detected. The value is a UNIX timestamp (UTC). Unit: seconds.

    1684252800
    Examples deprecated

    array

    The list of examples associated with the risk.

    string

    The example information, which is a JSON string constructed from a series of parameters. The parameters include:

    • param_num: the number of API parameters.

    • request_method: the request method.

    • protocol: the request protocol.

    • api_url: the request URL.

    • poc_payload: the request payload.

    • request: the request example.

    • response: the response example.

    • param: the request parameters.

    { "request": {"referer": "-","content_type": "-","cookie": "-","method": "GET","param": [],"host": "test.cn"}, "protocol": "https", "api_url": "https://test.cn:443/index.php", "param": [], "response": {"param": [], "sensitive_type": {}, "header": {},"body": "", "status": 405 }, "request_method": "GET", "poc_payload": "curl -X GET -H 'Accept: */*' -H 'Connection: keep-alive' -H 'User-agent: python-requests/2.32.3' -H 'X-forwarded-for: {{IPv6 Address}}' -H 'Host: test.cn' -H 'Accept-encoding: gzip, deflate' 'https://test.cn:443/index.php'", "param_num": 0 }

    Examples

    Success response

    JSON format

    {
  "TotalCount": 5,
  "RequestId": "9469646C-F2CC-5F0F-8401-C53***4F46",
  "Data": [
    {
      "AbnormalId": "7c1431f27ae7e9c8cc64095***68e",
      "Origin": "custom",
      "LastestTime": 1684252800,
      "FirstTime": 1701138088,
      "AbnromalStatus": "unresolved",
      "ApiFormat": "/api/login",
      "ApiTag": "SendMail",
      "DiscoverTime": 1684252800,
      "UserStatus": "Confirmed",
      "IgnoreTime": 1684252800,
      "Follow": 0,
      "MatchedHost": "a.aliyun.com",
      "Note": "Strict",
      "AbnormalEventNumber": 2,
      "AbnormalTag": "LackOfSpeedLimit",
      "AbnormalInfo": "{\n    \"data_type\": [\"1005\",\"1004\"],\n    \"rule\": {\n        \"parent\": \"RiskType_Permission\",\n        \"code\": \"Risk_UnauthSensitive\",\n        \"level\": \"high\",\n        \"origin\": \"default\",\n        \"name\": \"Risk_UnauthSensitive\"\n    }\n}",
      "ApiId": "09559c0d71ca2ffc996b81***836d8",
      "AbnormalLevel": "high",
      "LatestDiscoverTime": 1684252800,
      "Examples": [
        "{\n    \"request\": {\"referer\": \"-\",\"content_type\": \"-\",\"cookie\": \"-\",\"method\": \"GET\",\"param\": [],\"host\": \"test.cn\"},\n    \"protocol\": \"https\",\n    \"api_url\": \"https://test.cn:443/index.php\",\n    \"param\": [],\n    \"response\": {\"param\": [], \"sensitive_type\": {}, \"header\": {},\"body\": \"\", \"status\": 405 },\n    \"request_method\": \"GET\",\n    \"poc_payload\": \"curl -X GET -H 'Accept: */*' -H 'Connection: keep-alive' -H 'User-agent: python-requests/2.32.3' -H 'X-forwarded-for: {{IPv6 Address}}' -H 'Host: test.cn' -H 'Accept-encoding: gzip, deflate' 'https://test.cn:443/index.php'\",\n    \"param_num\": 0\n}"
      ]
    }
  ]
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.