Akamai Application Security API

https://techdocs.akamai.com/application-security/reference
Admin
This documentation provides comprehensive details on the Akamai Application Security API, enabling...
Tokens:506,134
Snippets:4,058
Trust Score:9.6
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Example 200 response for get onboarding activation status

Source: https://techdocs.akamai.com/application-security/reference/get-onboarding-activation-status

Example JSON response returned by the GET request. It includes the activation ID, status (e.g., ACTIVE), network (e.g., STAGING), and timestamps. The activationStatusLink and onboardingLink provide URLs for further operations.

```json
{
  "activationId": 51,
  "activationStatus": "ACTIVE",
  "activationStatusLink": "/appsec/v1/onboardings/101/activations/51",
  "completedDate": "2014-03-01T21:12:57Z",
  "createdBy": "afero",
  "createdDate": "2014-03-02T02:22:12Z",
  "network": "STAGING",
  "onboardingLink": "/appsec/v1/onboardings/101"
}
```

--------------------------------

### 200 Response Example for Get Activations

Source: https://techdocs.akamai.com/application-security/reference/get-activations

Example 200 response containing a list of activations with details such as activation ID, status, version, and timestamps. Includes pagination links and metadata.

```json
{
  "activations": [
    {
      "activationId": "98765",
      "completedDate": "2024-06-25T17:42:00Z",
      "createdBy": "adevi",
      "createdDate": "2024-06-25T17:30:00Z",
      "faiConfigId": "12345",
      "note": "Activating updated PII detection rules for testing",
      "status": "SUCCEEDED",
      "version": 6
    },
    {
      "activationId": "98764",
      "completedDate": "2024-06-15T10:15:00Z",
      "createdBy": "tyamada",
      "createdDate": "2024-06-15T10:00:00Z",
      "faiConfigId": "12345",
      "note": "Production deployment of version 4",
      "status": "SUCCEEDED",
      "version": 4
    },
    {
      "activationId": "98763",
      "completedDate": "2024-06-18T11:58:00Z",
      "createdBy": "mrossi",
      "createdDate": "2024-06-18T11:45:00Z",
      "faiConfigId": "12346",
      "note": "Staging deployment with new topic filters",
      "status": "SUCCEEDED",
      "version": 3
    }
  ],
  "links": [
    {
      "href": "/appsec/v1/fai-configurations/12345/activations?start=2024-01-01T00:00:00Z&end=2024-07-01T00:00:00Z&pageSize=10&page=1",
      "rel": "self"
    }
  ],
  "metadata": {
    "end": "2024-07-01T00:00:00Z",
    "faiConfigId": "12345"
  }
}
```

--------------------------------

### 200 response for GET /appsec/v1/onboardings

Source: https://techdocs.akamai.com/application-security/reference/get-onboardings

Example 200 response for the GET /appsec/v1/onboardings request. Shows two onboarding records with fields such as createdBy, hostnames, onboardingId, onboardingLink, and onboardingStatus.

```json
{
  "onboardings": [
    {
      "createdBy": "jdupont",
      "createdTime": "2024-05-07T22:08:50Z",
      "hostnames": [
        "www.example.com"
      ],
      "modifiedBy": "asingh",
      "modifiedTime": "2024-07-09T15:03:29Z",
      "onboardingId": 101,
      "onboardingLink": "/appsec/v1/onboardings/101",
      "onboardingStatus": "VALIDATION_PENDING"
    },
    {
      "createdBy": "jsmith",
      "createdTime": "2024-05-03T22:08:51Z",
      "hostnames": [
        "www.example.net",
        "test.example.net"
      ],
      "modifiedBy": "jsmith",
      "modifiedTime": "2024-07-05T12:34:21Z",
      "onboardingId": 102,
      "onboardingLink": "/appsec/v1/onboardings/102",
      "onboardingStatus": "CREATED"
    }
  ]
}
```

--------------------------------

### Example response for get version notes

Source: https://techdocs.akamai.com/application-security/reference/get-version-notes

Example JSON response returned by the API when the request is successful. The response contains the version notes in the 'notes' field.

```json
{
  "notes": "This is the version notes."
}
```

--------------------------------

### Response body for PII Learning settings

Source: https://techdocs.akamai.com/application-security/reference/get-advanced-settings-pii-learning

Example response body returned by the GET request. Shows the enablePiiLearning field set to true.

```json
{
  "enablePiiLearning": true
}
```

--------------------------------

### 200 Response Body

Source: https://techdocs.akamai.com/application-security/reference/get-onboarding-settings

Example 200 response body for the GET onboarding settings request. Shows the structure with certificate, delivery, and security objects.

```json
{
  "certificate": {
    "adminContact": {
      "email": "adminContact@nomail-akamai.com",
      "firstName": "AdminUser",
      "lastName": "User",
      "phone": "+919090909090"
    },
    "certificateType": "CUSTOM_EXISTING",
    "commonName": "www.commonName.com",
    "enrollmentId": 87902,
    "enrollmentLink": "/cps/v2/enrollments/87902"
  },
  "delivery": {
    "origins": [
      {
        "hostname": "www.example.com",
        "origin": "origin-ea0ac1-.www.example.com"
      },
      {
        "hostname": "www.example.net",
        "origin": "origin-8eeeba-.www.example.net"
      }
    ]
  },
  "onboardingLink": "/appsec/v1/onboardings/101",
  "security": {
    "cloneVersion": 25,
    "configId": 24335,
    "configLink": "/appsec/v1/configs/24335",
    "configName": "sec-config",
    "configType": "EXISTING",
    "evalRequired": true,
    "policyId": "000Q_475674",
    "policyLink": "/appsec/v1/configs/243359/versions/25/security-policies/000Q_475674",
    "policyName": "sec-policy",
    "policyType": "EXISTING",
    "protections": {
      "applyApplicationLayerControls": true,
      "applyBotmanControls": false,
      "applyClientSideProtectionControls": false,
      "applyNetworkLayerControls": true,
      "applyRateControls": true
    }
  }
}
```

--------------------------------

### Sample 200 response for onboarding details

Source: https://techdocs.akamai.com/application-security/reference/get-onboarding

Example JSON response returned by the GET request, containing account, contract, group, hostnames, activations, and next steps.

```json
{
  "accountId": "A-CCT1234",
  "activations": [
    {
      "activationId": 105,
      "activationLink": "/appsec/v1/onboardings/101/activations/105",
      "activationStatus": "ACTIVE",
      "completedDate": "2024-05-03T12:34:21Z",
      "createdDate": "2024-05-03T10:38:21Z",
      "network": "STAGING"
    },
    {
      "activationId": 106,
      "activationLink": "/appsec/v1/onboardings/101/activations/106",
      "activationStatus": "ACTIVE",
      "completedDate": "2024-05-04T12:34:21Z",
      "createdDate": "2024-05-04T10:38:21Z",
      "network": "PRODUCTION"
    }
  ],
  "contractId": "C-0N7RAC7",
  "createdBy": "hgildong",
  "createdDate": "2024-05-02T22:08:50Z",
  "currentStep": 3,
  "groupId": 54321,
  "hostnames": [
    "www.example.com",
    "www.example.net"
  ],
  "modifiedBy": "jsmith",
  "modifiedDate": "2024-05-04T12:34:21Z",
  "nextSteps": [
    {
      "stepDescription": "Validate the certificate challenge",
      "stepLink": "/appsec/v1/onboardings/101/certificate-validation",
      "stepName": "certificate-validation"
    },
    {
      "stepDescription": "Validate that the origin is live",
      "stepLink": "/appsec/v1/onboardings/101/origin-validation",
      "stepName": "origin-validation"
    }
  ]
}
```

--------------------------------

### Get API List response example

Source: https://techdocs.akamai.com/application-security/reference/get-api-list

Example response body for the Get API List endpoint. Shows two API entries with basePath, encodedBasePath, encodedHost, host, lastModified, type, and visibility fields.

```json
{
  "apis": [
    {
      "basePath": "/api/v2",
      "encodedBasePath": "L2FwaS92Mg",
      "encodedHost": "Y2RuLnh5ei5jb20",
      "host": "cdn.xyz.com",
      "lastModified": "2021-08-24",
      "type": "API",
      "visibility": "VISIBLE"
    },
    {
      "basePath": "/api/v3",
      "encodedBasePath": "L2FwaS92Mg",
      "encodedHost": "Y2RuLnh5ei5jb20",
      "host": "host.xyz.com",
      "lastModified": "2021-08-29",
      "type": "RESOURCE",
      "visibility": "VISIBLE"
    }
  ]
}

```

--------------------------------

### Example 200 Response for Get WAF Ruleset

Source: https://techdocs.akamai.com/application-security/reference/get-waf-policy-ruleset-composite

Example 200 response body for the GET WAF ruleset request. Shows the structure with adaptiveIntelligence settings and attackGroups, including a group with an advanced exception that matches extensions, filenames, and hosts.

```json
{
  "adaptiveIntelligence": {
    "threatIntelEnabled": true
  },
  "attackGroups": [
    {
      "action": "alert",
      "conditionException": {},
      "group": "POLICY"
    },
    {
      "action": "alert",
      "conditionException": {},
      "group": "WAT"
    },
    {
      "action": "deny",
      "conditionException": {
        "advancedExceptions": {
          "conditionOperator": "AND",
          "conditions": [
            {
              "extensions": [
                "test12"
              ],
              "positiveMatch": true,
              "type": "extensionMatch"
            },
            {
              "filenames": [
                "test13"
              ],
              "positiveMatch": true,
              "type": "filenameMatch"
            },
            {
              "hosts": [
                "test.hostname.com"
              ],
              "positiveMatch": true,
              "type": "hostMatch"
            }
          ]
        }
      }
    }
  ]
}
```

--------------------------------

### Sample 200 Response for Selectable Hostnames

Source: https://techdocs.akamai.com/application-security/reference/get-selectable-hostnames-per-config

Example response showing the available hostnames with their production/staging status and ARL inclusion, plus error details for hostnames that cannot be selected.

```json
{
  "availableSet": [
    {
      "activeInProduction": true,
      "activeInStaging": true,
      "arlInclusion": true,
      "configIdInProduction": 77653,
      "configNameInProduction": "WAF Security File",
      "hostname": "example.com"
    },
    {
      "activeInProduction": false,
      "activeInStaging": true,
      "arlInclusion": true,
      "configIdInProduction": 51074,
      "configNameInProduction": "A PUBLIC CONFIG",
      "hostname": "www.example.com"
    },
    {
      "activeInProduction": true,
      "activeInStaging": true,
      "arlInclusion": true,
      "configIdInProduction": 65473,
      "configNameInProduction": "Other Security Configuration",
      "hostname": "www.example-123.com"
    }
  ],
  "configId": 123,
  "configVersion": 2,
  "errorSet": [
    {
      "hostname": "*.example.net",
      "reason": "property is not active in either production or staging",
      "reasonCode": 400
    },
    {
      "hostname": "test-example.net",
      "reason": "You don't have access to this property",
      "reasonCode": 403
    }
  ],
  "protectARLInclusionHost": true,
}
```

--------------------------------

### Create Onboarding Response (201)

Source: https://techdocs.akamai.com/application-security/reference/post-onboarding

Example response body for a successful create onboarding request (HTTP 201). Contains account, contract, group, hostnames, next steps, and settings details.

```json
{
  "accountId": "A-CCT7890",
  "contractId": "C-0N7RAC7",
  "createdBy": "jsmith",
  "createdDate": "2024-05-02T22:08:50Z",
  "currentStep": 2,
  "groupId": 54321,
  "hostnames": [
    "www.example.com",
    "test.example.org"
  ],
  "modifiedBy": "asingh",
  "modifiedDate": "2024-07-02T22:08:50Z",
  "nextSteps": [
    {
      "stepDescription": "Activate the onboarding",
      "stepLink": "/appsec/v1/onboardings/101/activate",
      "stepName": "activate-onboarding"
    }
  ],
  "onboardingId": 101,
  "onboardingLink": "/appsec/v1/onboardings/101",
  "onboardingStatus": "CREATED",
  "product": "AAP",
  "settings": {
    "certificate": {
      "adminContact": {
        "email": "adminContact@nomail-akamai.com",
        "firstName": "AdminUser",
        "lastName": "User",
        "phone": "+9180460018"
      },
      "certificateType": "CUSTOM_EXISTING",
      "commonName": "www.at.konaqa.com",
      "enrollmentId": 94723,
      "enrollmentLink": "/cps/v2/enrollments/94723"
    },
    "delivery": {
      "origins": [
        {
      }
    }
  }
}
```

--------------------------------

### POST /onboardings

Source: https://techdocs.akamai.com/application-security/reference/api-summary

Creates an onboarding.

```APIDOC
## POST /onboardings

### Description
Creates an onboarding.

### Method
POST

### Endpoint
/onboardings

```

--------------------------------

### 200 OK response for advanced settings prefetch

Source: https://techdocs.akamai.com/application-security/reference/get-advanced-settings-prefetch

Example JSON response returned on success. Shows prefetch settings including allExtensions, enableAppLayer, enableRateControls, and a list of extensions.

```json
{
  "allExtensions": false,
  "enableAppLayer": true,
  "enableRateControls": false,
  "extensions": [
    "cgi",
    "jsp",
    "EMPTY_STRING",
    "aspx",
    "py",
    "php",
    "asp"
  ]
}
```

--------------------------------

### 200 Response for GET advanced-settings/logging

Source: https://techdocs.akamai.com/application-security/reference/get-policies-logging

Example 200 response body for the GET advanced-settings/logging request. Shows the logging configuration with allowSampling, cookies, customHeaders, override, and standardHeaders fields.

```json
{
  "allowSampling": true,
  "cookies": {
    "type": "all"
  },
  "customHeaders": {
    "type": "exclude",
    "values": [
      "csdasdad"
    ]
  },
  "override": true,
  "standardHeaders": {
    "type": "only",
    "values": [
      "Accept"
    ]
  }
}
```

--------------------------------

### GET /onboardings

Source: https://techdocs.akamai.com/application-security/reference/api-summary

Lists onboardings.

```APIDOC
## GET /onboardings

### Description
Lists onboardings.

### Method
GET

### Endpoint
/onboardings

```

--------------------------------

### Create Onboarding with cURL

Source: https://techdocs.akamai.com/application-security/reference/post-onboarding

Sends a POST request to create a new onboarding. The request body includes an empty hostnames array. An Authorization header must be added to the snippet before use.

```shell
curl --request POST \
     --url https://hostname/appsec/v1/onboardings \
     --header 'accept: application/json' \
     --header 'content-type: application/json' \
     --data '{"hostnames":[]}'
```

--------------------------------

### 200 Response for Get FAI Configurations

Source: https://techdocs.akamai.com/application-security/reference/get-fai-configurations

Example 200 response for the GET request to /appsec/v1/fai-configurations. Shows two FAI configurations with fields like activeVersion, contractId, faiConfigId, and faiConfigType.

```json
{
  "fai-configurations": [
    {
      "activeVersion": 4,
      "contractId": "K-0N7RAK7",
      "createdBy": "jdupont",
      "createdDate": "2024-01-15T10:30:00Z",
      "description": "Production FAI configuration for main application",
      "faiConfigId": "12345",
      "faiConfigName": "production-fai-config",
      "faiConfigType": "EDGE",
      "groupId": "54321",
      "latestVersion": 5,
      "modifiedBy": "jkowalski",
      "modifiedDate": "2024-06-20T14:22:00Z"
    },
    {
      "activeVersion": 2,
      "contractId": "C-0N7RAC7",
      "createdBy": "szhang",
      "createdDate": "2024-02-10T09:15:00Z",
      "description": "API configuration for customer applications",
      "faiConfigId": "12346",
      "faiConfigName": "api-fai-config",
      "faiConfigType": "API",
      "groupId": "32145",
      "latestVersion": 3,
      "modifiedBy": "jdupont",
      "modifiedDate": "2024-06-18T11:45:00Z"
    }
  ]
}
```

--------------------------------

### Objects diff example

Source: https://techdocs.akamai.com/application-security/reference/diff-configuration-versions

Shows how changes to object properties are represented. The example renames a configuration and adds a description.

```json
{
  "id": 7180,
  "latestVersion": 9,
  "name": "Corporate Sites WAF"
}
```

```json
{
  "id": 7180,
  "latestVersion": 9,
  "name": "App and API protector for corporate sites",
  "description": "New name for an old configuration"
} 
```

```json
{
  "name": {
    "from": "Corporate Sites WAF",
    "outcome": "MODIFIED",
    "to": "App and API protector for corporate sites"
  },
  "description": {
    "from": null,
    "outcome": "ADDED",
    "to": "New name for an old configuration"
  }
}
```

--------------------------------

### 200 response body for listing configuration versions

Source: https://techdocs.akamai.com/application-security/reference/get-config-versions

Example 200 response body for the GET request to list configuration versions. Shows the structure with configuration details, active versions, and a list of version objects.

```json
{
  "configId": 48579,
  "configName": "TestConfig",
  "lastCreatedVersion": 9,
  "page": 1,
  "pageSize": 3,
  "productionActiveVersion": 9,
  "productionExpediteRequestId": 6951,
  "stagingActiveVersion": 8,
  "stagingExpediteRequestId": 5861,
  "totalSize": 3,
  "versionList": [
    {
      "basedOn": 8,
      "createDate": "2013-10-07T17:58:52Z",
      "createdBy": "jperez",
      "production": {
        "status": "Active",
        "time": "2014-07-08T07:40:00Z"
      },
      "staging": {
        "status": "Inactive"
      },
      "version": 9,
      "versionNotes": "Membership Benefits"
    },
    {
      "basedOn": 7,
      "createDate": "2013-07-08T17:41:52Z",
      "createdBy": "hgildong",
      "production": {
        "status": "Inactive"
      },
      "staging": {
        "status": "Active",
        "time": "2014-07-08T07:40:00Z"
      },
      "version": 8,
      "versionNotes": "Membership Benefits"
    },
    {
      "createDate": "2013-08-07T17:41:52Z"
    }
  ]
}
```

--------------------------------

### Get FAI Activation 200 Response

Source: https://techdocs.akamai.com/application-security/reference/get-fai-activation

Example 200 response body for the Get FAI Activation request. Shows activation details including status SUCCEEDED and version 6.

```json
{
  "activationId": "98765",
  "completedDate": "2024-06-25T17:42:00Z",
  "createdBy": "mrossi",
  "createdDate": "2024-06-25T17:30:00Z",
  "faiConfigId": "12345",
  "note": "Activating updated PII detection rules for testing",
  "status": "SUCCEEDED",
  "version": 6
}
```

--------------------------------

### Sample 200 response for get activation

Source: https://techdocs.akamai.com/application-security/reference/get-activation

Example JSON response returned when the activation is successfully retrieved. Contains activation details such as action, configs, status, and network.

```json
{
  "action": "ACTIVATE",
  "activationConfigs": [
    {
      "configId": 1,
      "configName": "config 1",
      "configVersion": 4,
      "previousConfigVersion": 2
    }
  ],
  "activationId": 1234,
  "createDate": "2013-10-07T17:41:52+00:00",
  "createdBy": "mrossi",
  "dispatchCount": 1,
  "estimate": "PTM5",
  "network": "PRODUCTION",
  "status": "RECEIVED"
}
```

--------------------------------

### Get Security Policy Mode Response

Source: https://techdocs.akamai.com/application-security/reference/get-policy-mode

Example response from the GET mode endpoint. The 'current' field shows the active mode version and 'mode' indicates the mode type (e.g., KRS).

```json
{
  "current": "KRS 1.0 (Apr 20, 2020)",
  "mode": "KRS"
}
```

--------------------------------

### GET /appsec/v1/onboarding-settings

Source: https://techdocs.akamai.com/application-security/reference/get-onboarding-settings

Retrieves the onboarding settings for a site, including certificate, delivery, and security settings.

```APIDOC
## GET /appsec/v1/onboarding-settings

### Description
Retrieves the onboarding settings for your site, including delivery, certificate, and security settings.

### Method
GET

### Endpoint
/appsec/v1/onboarding-settings

### Response
#### Success Response (200)
- **certificate** (object) - Required - The certificate settings to secure your site.
  - **adminContact** (object) - Required - Contact information for the certificate administrator.
    - **certificateType** (string) - Required - Enum: `DEFAULT`, `CUSTOM_EXISTING`, `CUSTOM_NEW`. A value of `DEFAULT` creates a new secure-by-default certificate. A value of `CUSTOM_EXISTING` means the certificate already exists on your account. If you want to create a new certificate, choose `CUSTOM_NEW`. Note that your certificate is created when you activate your onboarding. Your account may have limits for how many certificates you can create.
    - **commonName** (string) - The domain name to use for the certificate, also known as the common name.
    - **enrollmentId** (integer) - A unique identifier for an enrollment in the Certificate Provisioning System (CPS).
    - **enrollmentLink** (string) - The URL to call the enrollment. Note this URL is for the Certificate Provisioning System (CPS) API.
- **delivery** (object) - Required - The delivery settings for your site traffic.
  - **origins** (array of objects) - Required - List of hostnames and proposed origin hostnames. If you choose not to use an origin hostname suggested to you, you can edit it to the value you want with a request to Update onboarding settings.
    - **hostname** (string) - Required - The hostname for your site. You can add up to 100 hostnames.
    - **origin** (string) - Required - The origin server hostname.
- **onboardingLink** (string) - Required - The URL to call when you want to access this onboarding at a later time.
- **security** (object) - Required - The security settings for your site.
  - **cloneVersion** (integer) - The configuration version that is cloned to make a new configuration for onboarding.
  - **configId** (integer) - The identifier for the existing configuration.
  - **configLink** (string) - The URL to make a call for the specific configuration. For example, Get a configuration.
  - **configName** (string) - The name of configuration.
  - **configType** (string) - Required - Enum: `NEW`, `EXISTING`. Specifies whether the security configuration is `NEW`, or you're using an `EXISTING` one. Note than when you use an existing configuration, the onboarding process creates a new version of the configuration from _the version that is currently active_ on the production network. If no version is active on production, the clone will be the most recent version of the configuration.
  - **evalRequired** (boolean) - If `TRUE`, adds the hostnames to evaluation mode for the policy. This applies to AAP only.
  - **policyId** (string) - If `securityPolicy` is `EXISTING`, lists the unique identifier for the policy.
  - **policyLink** (string) - The URL to make a call for the specific policy. For example, the URL in Update a policy.
  - **policyName** (string) - The name of the security policy.
  - **policyType** (string) - Required - Enum: `NEW`, `EXISTING`. Specifies whether the security policy is `NEW`, or you're using an `EXISTING` one. Note that you can only edit policy settings if `"policyType": "NEW"` because editing existing, active policies could disrupt service to your site.
  - **protections** (object) - Required - The set of protections in the security policy.
- **settingsLink** (string) - Required - The URL to call to manage onboarding settings after you finishing the initial creation.

#### Response Example
```json
{
  "certificate": {
    "adminContact": {
      "certificateType": "DEFAULT",
      "commonName": "example.com",
      "enrollmentId": 12345,
      "enrollmentLink": "https://api.akamai.com/cps/v2/enrollments/12345"
    }
  },
  "delivery": {
    "origins": [
      {
        "hostname": "www.example.com",
        "origin": "origin.example.com"
      }
    ]
  },
  "onboardingLink": "https://api.akamai.com/appsec/v1/onboarding-settings/12345",
  "security": {
    "cloneVersion": 14,
    "configId": 12345,
    "configLink": "https://api.akamai.com/appsec/v1/configs/12345",
    "configName": "Example Config",
    "configType": "NEW",
    "evalRequired": false,
    "policyId": "12345",
    "policyLink": "https://api.akamai.com/appsec/v1/policies/12345",
    "policyName": "Example Policy",
    "policyType": "NEW",
    "protections": {}
  },
  "settingsLink": "https://api.akamai.com/appsec/v1/onboarding-settings/12345"
}
```
```

--------------------------------

### 200 response body for GET CPC

Source: https://techdocs.akamai.com/application-security/reference/get-policy-cpc

Example 200 response body for the GET CPC request. Shows the edge injection settings, edge test parameters, and injection criteria returned by the API.

```json
{
  "edgeInjection": {
    "autoLoadStaging": false,
    "clientSideProtectionConfigId": 5965,
    "loadScriptAsync": false
  },
  "edgeTestParameters": {
    "disableInjectionKey": "page-integrity",
    "disableInjectionValue": "disable-injection-1234_104690",
    "forceInjectionKey": "page-integrity",
    "forceInjectionValue": "force-injection-1234_104690"
  },
  "injectionCriteria": {
    "injectionPathExcludes": "",
    "injectionPathIncludes": "",
    "injectionPercent": 100,
    "injectionPolicy": "late_head"
  }
}
```

--------------------------------

### Example 200 response for List configurations

Source: https://techdocs.akamai.com/application-security/reference/get-configs

Example 200 response body for the List configurations endpoint. Shows the configurations array with fields such as id, latestVersion, name, productionHostnames, productionVersion, and stagingVersion.

```json
{
  "configurations": [
    {
      "description": "(user notes)",
      "id": 22330,
      "latestVersion": 5,
      "name": "CaroTestTransition2Versioning"
    },
    {
      "id": 7180,
      "latestVersion": 9,
      "name": "Corporate Sites WAF",
      "productionHostnames": [
        "example.com",
        "www.example.net",
        "m.example.com"
      ],
      "productionVersion": 1,
      "stagingVersion": 2
    }
  ]
}
```

--------------------------------

### Get ASE Penalty Box Settings response

Source: https://techdocs.akamai.com/application-security/reference/get-ase-penalty-box-settings

Example response body for the Get ASE Penalty Box Settings API, showing the structure with akamaiManagedExclusions, blockDuration, clientIdentifiers, qualificationExclusions, and requestCount.

```json
{
  "akamaiManagedExclusions": {
    "lastUpdated": "2025-02-01",
    "rules": [
      1000000,
      2000000,
      3000000
    ]
  },
  "blockDuration": 10,
  "clientIdentifiers": [
    "ip-useragent"
  ],
  "qualificationExclusions": {
    "attackGroups": [
      "XSS",
      "IN"
    ],
    "rules": [
      950002
    ]
  },
  "requestCount": 1
}
```

--------------------------------

### 200 Response for GET /appsec/v1/fai-configurations/rules

Source: https://techdocs.akamai.com/application-security/reference/get-rule-types

Example 200 response body for the GET request, showing rule type objects with fields such as ruleId, ruleName, description, inspectionTarget, ruleCategories, and ruleConfigFields. The response is truncated in the source.

```json
{
  "ruleTypes": [
    {
      "description": "Detected potential prompt injection in user input",
      "inspectionTarget": "INPUT",
      "ruleCategories": [
        {
          "ruleCategoryId": "LLM01:2025",
          "ruleCategoryName": "Prompt Injection",
          "ruleCategoryType": "OWASP_TOP_10_LLM"
        }
      ],
      "ruleConfigFields": [
        {
          "enum": [
            "HIGH",
            "MEDIUM",
            "LOW"
          ],
          "fieldName": "sensitivity",
          "fieldType": "string"
        }
      ],
      "ruleId": "LLM-INJECT-PROMPT",
      "ruleName": "LLM Prompt Injection",
      "version": 1
    },
    {
      "description": "Detected potential PII in user input",
      "inspectionTarget": "INPUT",
      "ruleCategories": [
        {
          "ruleCategoryId": "LLM02:2025",
          "ruleCategoryName": "Sensitive Information Disclosure",
          "ruleCategoryType": "OWASP_TOP_10_LLM"
        }
      ],
      "ruleConfigFields": [
        {
          "fieldName": "maskPii",
          "fieldType": "boolean"
        },
      ]
    }
  ]
}
```

--------------------------------

### Export Configuration Version Response Example

Source: https://techdocs.akamai.com/application-security/reference/get-export-config-version

Example response body for a successful export request. It shows the structure of the exported configuration, including advanced options like asePenaltyBox, ja4Fingerprint, and logging settings. The response is truncated in the source, so only the beginning is shown.

```json
{
  "advancedOptions": {
    "asePenaltyBox": {
      "akamaiManagedExclusions": {
        "lastUpdated": "2025-02-01",
        "rules": [
          1000000,
          2000000,
          3000000
        ]
      },
      "blockDuration": 10,
      "clientIdentifiers": [
        "ip-useragent"
      ],
      "qualificationExclusions": {
        "attackGroups": [
          "XSS",
          "IN"
        ],
        "rules": [
          950002
        ]
      },
      "requestCount": 1
    },
    "ja4Fingerprint": {
      "headerNames": [
        "test"
      ]
    },
    "logging": {
      "allowSampling": true,
      "cookies": {
        "type": "exclude",
        "values": [
          "_updated_By_SoapUI",
          "w",
          "NEW_VAL_ADDED_BY_SoapUI"
        ]
      },
      "customHeaders": {
      }
    }
  }
}
```

--------------------------------

### GET FAI configuration keys response

Source: https://techdocs.akamai.com/application-security/reference/get-fai-configuration-keys

Example response body for the GET FAI configuration keys endpoint, showing a list of keys with metadata such as createdBy, createdDate, expirationTime, key, keyId, and status.

```json
{
  "keys": [
    {
      "createdBy": "asingh",
      "createdDate": "2024-01-10T09:00:00Z",
      "expirationTime": "2025-01-10T09:00:00Z",
      "key": "sk_prod_***hidden***",
      "keyId": "ak_prod_12345abcde",
      "status": "ACTIVE"
    },
    {
      "createdBy": "jdupont",
      "createdDate": "2024-03-15T14:30:00Z",
      "expirationTime": "2025-03-15T14:30:00Z",
      "key": "sk_stag_***hidden***",
      "keyId": "ak_staging_67890fghij",
      "status": "ACTIVE"
    }
  ]
}

```

--------------------------------

### 200 response for GET eval-penalty-box conditions

Source: https://techdocs.akamai.com/application-security/reference/get-eval-policy-penalty-box-conditions

Example 200 response body for the GET eval-penalty-box conditions request. Shows an AND condition operator with filename and client list match conditions, each with positiveMatch set to true.

```json
{
  "conditionOperator": "AND",
  "conditions": [
    {
      "filenames": [
        "hh"
      ],
      "positiveMatch": true,
      "type": "filenameMatch"
    },
    {
      "clientLists": [
        "88331_TESTGEO1"
      ],
      "positiveMatch": true,
      "type": "clientListMatch",
      "useHeaders": true
    }
  ]
}
```

--------------------------------

### Example response for Behavioral DDoS profiles

Source: https://techdocs.akamai.com/application-security/reference/get-behavioral-ddos-profiles

Example JSON response from the GET request, showing the structure of behavioral DDoS profiles. Includes bypass conditions, exceptions, and metadata. Note that the response is truncated in the source.

```json
{
  "behavioralDdosProfiles": [
    {
      "bypassCondition": {
        "atomicConditions": [
          {
            "checkIps": "connecting",
            "className": "NetworkListCondition",
            "positiveMatch": true,
            "value": [
              "100065_IPLIST"
            ]
          },
          {
            "className": "RequestHeaderCondition",
            "name": [
              "Content-Type"
            ],
            "nameWildcard": true,
            "positiveMatch": true,
            "value": [
              "application/json"
            ],
            "valueCase": false,
            "valueWildcard": true
          }
        ]
      },
      "configId": 1,
      "configVersion": 1,
      "createDate": "2025-02-05T14:00:00Z",
      "createdBy": "jsmith",
      "description": "This is a description of the profile",
      "exceptions": [
        {
          "hosts": [
            "secure.host1.com",
            "help.host3.com"
          ],
          "paths": [
            "/path1",
            "/path2",
          ]
        }
      ]
    }
  ]
}
```

--------------------------------

### JSON response for application configuration

Source: https://techdocs.akamai.com/application-security/reference/get-application

Example JSON response returned by the GET request. It includes application details such as name, creation and modification dates, description, and the user application ID.

```json
{
  "applicationName": "MyProductionApp",
  "createdBy": "jkowalski",
  "createdDate": "2023-12-01T10:00:00Z",
  "description": "Main production application for customer-facing services",
  "modifiedBy": "jkowalski",
  "modifiedDate": "2024-06-20T15:30:00Z",
  "userApplicationId": "app_67890"
}
```

--------------------------------

### POST /onboarding/activations

Source: https://techdocs.akamai.com/application-security/reference/post-onboarding-activation

Activates an onboarding on the staging or production networks. Returns the activation details including status and progress.

```APIDOC
## POST /onboarding/activations

### Description
Activates an onboarding on the staging or production networks. Returns the activation details including status and progress.

### Method
POST

### Endpoint
/onboarding/activations

### Request Body
- **network** (string) - Required - Specifies the network where you are activating your onboarding, either `STAGING` or `PRODUCTION`.

### Response
#### Success Response (200)
- **activationId** (integer) - Required - The unique identifier for the activation.
- **activationStatus** (string) - Required - Read-only. The status of the activation. Activation can take about 20 minutes. A value of `ACTIVE` means activation succeeded and your site is ready for validation. A value of `FAILED` means the onboarding failed to activate and specific information about the failure is returned in the error response. When `PENDING`, the activation partially completed and the response shows you what additional steps you need to complete to finish your activation. Possible values: `PENDING`, `ACTIVE`, `FAILED`.
- **activationStatusLink** (string) - Required - The URL for the operation to request the activation status.
- **completedDate** (date-time) - Optional - The ISO 8601 timestamp when the activation reaches a steady state and validates across the Akamai network.
- **createdBy** (string) - Required - Read-only. The user who created the activation request.
- **createdDate** (date-time) - Required - Read-only. The ISO 8601 timestamp when the activation request was submitted.
- **network** (string) - Required - Specifies the network where you are activating your onboarding, either `STAGING` or `PRODUCTION`.
- **onboardingLink** (string) - Required - The URL to get the onboarding's details.
- **percentComplete** (integer) - Optional - The percentage of the activation that is complete.
- **retryAfter** (integer) - Optional - The time remaining, in seconds, until the activation finishes. If your activation fails and you need to try activating again, you won't be able to until this value reaches `0`.

#### Response Example
```json
{
  "activationId": 12345,
  "activationStatus": "PENDING",
  "activationStatusLink": "https://api.akamai.com/onboarding/activations/12345",
  "completedDate": "2023-01-01T00:00:00Z",
  "createdBy": "user@example.com",
  "createdDate": "2023-01-01T00:00:00Z",
  "network": "STAGING",
  "onboardingLink": "https://api.akamai.com/onboarding/12345",
  "percentComplete": 50,
  "retryAfter": 120
}
```
```

--------------------------------

### GET response JSON for evasive path match

Source: https://techdocs.akamai.com/application-security/reference/get-evasive-path-match-per-config

Example response body for a successful GET request. The enablePathMatch field is required and when enabled, evaluates requests with the listed characters removed and a trailing dot removed.

```json
{
  "enablePathMatch": true
}
```
Tokens:
Raw