All Products
Search

This Product

    Web Application Firewall:DescribeApisecAbnormals

    Document Center

    Web Application Firewall:DescribeApisecAbnormals

    Last Updated:Mar 17, 2026

    Queries the API security risks that are detected by Web Application Firewall (WAF).

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    yundun-waf:DescribeApisecAbnormals

    get

    *All Resource

    *
    • acs:ResourceGroupId
    		 None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    InstanceId

    string

    Yes

    The ID of the WAF instance.

    Note

    Call DescribeInstance to query the ID of the WAF instance.

    waf_v2_public_cn-z***9g301
    ApiId

    string

    No

    The ID of the API that is associated with the security risk.

    bd9efb8ad******d9ca6
    ApiFormat

    string

    No

    The path of the API that is associated with the security risk.

    /api/users/login
    MatchedHost

    string

    No

    The domain name or IP address that the API resides on.

    a.aliyun.com
    StartTime

    string

    No

    The start of the time range to query. The value is a UNIX timestamp. Unit: seconds.

    1684252800
    EndTime

    string

    No

    The end of the time range to query. The value is a UNIX timestamp. Unit: seconds.

    1684382100
    OrderKey

    string

    No

    The field by which the query results are sorted. Valid values:

    • discoverTime (default): The time when the risk was first detected.

    • abnormalLevel: The risk level.

    • latestDiscoverTime: The most recent time when the risk was detected.

    firstTime
    OrderWay

    string

    No

    The sorting order. Valid values:

    • desc (default): Descending order.

    • asc: Ascending order.

    desc
    AbnormalLevel

    string

    No

    The severity level of the security risk. Valid values:

    • high: High.

    • medium: Medium.

    • low: Low.

    medium
    AbnormalTag

    string

    No

    The type of the security risk.

    Note

    Call DescribeApisecRules to query the supported risk types.

    LackOfSpeedLimit
    AbnormalId

    string

    No

    The ID of the security risk.

    29c6401****99a2bad3943e26d8
    UserStatus

    string

    No

    The handling status of the security risk. Valid values:

    • toBeConfirmed: To be confirmed.

    • confirmed: Confirmed.

    • toBeFixed: To be fixed.

    • fixed: Fixed (manually verified).

    • ignored: Ignored.

    • toBeVerified: To be verified by the system.

    • notFixed: Verification failed.

    • systemFixed: Fixed (verified by the system).

    Confirmed
    PageNumber

    integer

    No

    The page number of the returned page. Default value: 1.

    2
    PageSize

    integer

    No

    The number of entries per page. Default value: 10. Maximum value: 100.

    10
    Origin

    string

    No

    The source of the risk detection rule. Valid values:

    • custom: Custom rule.

    • default: Built-in rule.

    custom
    ApiTag

    string

    No

    The business purpose of the API.

    Note

    Call DescribeApisecRules to query the supported business purposes.

    RegisterAPI
    ClusterId

    string

    No

    The ID of the hybrid cloud WAF cluster.

    Note

    This parameter is required only for hybrid cloud scenarios. Call DescribeHybridCloudClusters to query the IDs of hybrid cloud WAF clusters.

    546
    RegionId

    string

    No

    The region in which the WAF instance resides. Valid values:

    • cn-hangzhou: Chinese mainland.

    • ap-southeast-1: outside the Chinese mainland.

    cn-hangzhou
    ResourceManagerResourceGroupId

    string

    No

    The ID of the resource group.

    rg-acfm***q

    Response elements

    Element

    Type

    Description

    Example

    object

    The response body.

    TotalCount

    integer

    The total number of security risks returned.

    5
    RequestId

    string

    The request ID.

    9469646C-F2CC-5F0F-8401-C53***4F46
    Data

    array<object>

    The list of security risks.

    object

    The details of a security risk entry.

    AbnormalId

    string

    The ID of the security risk.

    7c1431f27ae7e9c8cc64095***68e
    Origin

    string

    The source of the risk detection rule. Valid values:

    • custom: Custom rule.

    • default: Built-in rule.

    custom
    LastestTime

    integer

    The most recent time when the API was accessed. The value is a UNIX timestamp. Unit: seconds.

    1684252800
    FirstTime

    integer

    The time when the API was first discovered. The value is a UNIX timestamp. Unit: seconds.

    1701138088
    AbnromalStatus

    string

    The processing status of the security risk.

    unresolved
    ApiFormat

    string

    The path of the API that is associated with the security risk.

    /api/login
    ApiTag

    string

    The business purpose of the API.

    Note

    Call DescribeApisecRules to query the supported business purposes.

    SendMail
    DiscoverTime

    integer

    The time when the security risk was first detected. The value is a UNIX timestamp. Unit: seconds.

    1684252800
    UserStatus

    string

    The handling status of the security risk. Valid values:

    • toBeConfirmed: To be confirmed.

    • confirmed: Confirmed.

    • toBeFixed: To be fixed.

    • fixed: Fixed (manually verified).

    • ignored: Ignored.

    • toBeVerified: To be verified by the system.

    • notFixed: Verification failed.

    • systemFixed: Fixed (verified by the system).

    Confirmed
    IgnoreTime

    integer

    The time when the security risk was marked as ignored. The value is a UNIX timestamp. Unit: seconds.

    1684252800
    Follow

    integer

    Indicates whether the security risk is being followed. Valid values:

    • 1: The security risk is being followed.

    • 0 (default): The security risk is not being followed.

    0
    MatchedHost

    string

    The domain name or IP address that the API resides on.

    a.aliyun.com
    Note

    string

    The remarks for the security risk.

    Strict
    AbnormalEventNumber

    integer

    The number of risk events that are associated with the security risk.

    2
    AbnormalTag

    string

    The type of the security risk.

    Note

    Call DescribeApisecRules to query the supported risk types.

    LackOfSpeedLimit
    AbnormalInfo

    string

    The details of the security risk in JSON format. The JSON object contains the following fields:

    • rule: The detection rule that triggered the security risk.

    • data_type: The type of sensitive data.

    • custom_rule_name: The name of the custom rule.

    • rule_name: The name of the built-in rule.

    { "data_type": ["1005","1004"], "rule": { "parent": "RiskType_Permission", "code": "Risk_UnauthSensitive", "level": "high", "origin": "default", "name": "Risk_UnauthSensitive" } }
    ApiId

    string

    The ID of the API that is associated with the security risk.

    09559c0d71ca2ffc996b81***836d8
    AbnormalLevel

    string

    The severity level of the security risk. Valid values:

    • high: High.

    • medium: Medium.

    • low: Low.

    high
    LatestDiscoverTime

    integer

    The most recent time when the security risk was detected. The value is a UNIX timestamp. Unit: seconds.

    1684252800
    Examples deprecated

    array

    The list of security risk samples.

    string

    The sample information in JSON format. The JSON object contains the following fields:

    • param_num: The number of API parameters.

    • request_method: The request method.

    • protocol: The request protocol.

    • api_url: The request URL.

    • poc_payload: The request.

    • request: The request sample.

    • response: The response sample.

    • param: The request parameters.

    { "request": {"referer": "-","content_type": "-","cookie": "-","method": "GET","param": [],"host": "test.cn"}, "protocol": "https", "api_url": "https://test.cn:443/index.php", "param": [], "response": {"param": [], "sensitive_type": {}, "header": {},"body": "", "status": 405 }, "request_method": "GET", "poc_payload": "curl -X GET -H 'Accept: */*' -H 'Connection: keep-alive' -H 'User-agent: python-requests/2.32.3' -H 'X-forwarded-for: {{IPv6 Address}}' -H 'Host: test.cn' -H 'Accept-encoding: gzip, deflate' 'https://test.cn:443/index.php'", "param_num": 0 }

    Examples

    Success response

    JSON format

    {
  "TotalCount": 5,
  "RequestId": "9469646C-F2CC-5F0F-8401-C53***4F46",
  "Data": [
    {
      "AbnormalId": "7c1431f27ae7e9c8cc64095***68e",
      "Origin": "custom",
      "LastestTime": 1684252800,
      "FirstTime": 1701138088,
      "AbnromalStatus": "unresolved",
      "ApiFormat": "/api/login",
      "ApiTag": "SendMail",
      "DiscoverTime": 1684252800,
      "UserStatus": "Confirmed",
      "IgnoreTime": 1684252800,
      "Follow": 0,
      "MatchedHost": "a.aliyun.com",
      "Note": "Strict",
      "AbnormalEventNumber": 2,
      "AbnormalTag": "LackOfSpeedLimit",
      "AbnormalInfo": "{\n    \"data_type\": [\"1005\",\"1004\"],\n    \"rule\": {\n        \"parent\": \"RiskType_Permission\",\n        \"code\": \"Risk_UnauthSensitive\",\n        \"level\": \"high\",\n        \"origin\": \"default\",\n        \"name\": \"Risk_UnauthSensitive\"\n    }\n}",
      "ApiId": "09559c0d71ca2ffc996b81***836d8",
      "AbnormalLevel": "high",
      "LatestDiscoverTime": 1684252800,
      "Examples": [
        "{\n    \"request\": {\"referer\": \"-\",\"content_type\": \"-\",\"cookie\": \"-\",\"method\": \"GET\",\"param\": [],\"host\": \"test.cn\"},\n    \"protocol\": \"https\",\n    \"api_url\": \"https://test.cn:443/index.php\",\n    \"param\": [],\n    \"response\": {\"param\": [], \"sensitive_type\": {}, \"header\": {},\"body\": \"\", \"status\": 405 },\n    \"request_method\": \"GET\",\n    \"poc_payload\": \"curl -X GET -H 'Accept: */*' -H 'Connection: keep-alive' -H 'User-agent: python-requests/2.32.3' -H 'X-forwarded-for: {{IPv6 Address}}' -H 'Host: test.cn' -H 'Accept-encoding: gzip, deflate' 'https://test.cn:443/index.php'\",\n    \"param_num\": 0\n}"
      ]
    }
  ]
}

    Error codes

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.