Exempt one request header

Name a single header in a WAF exception from the API, and avoid the condition shape that silently covers every header.

Last updated

View as Markdown Agent setup

You can create a WAF exception that names a single request header from the API. The exception below stops rule 1005, the pipe-character rule, firing on the Cookie header, and leaves it firing on the body, the path, and the query string.

Prerequisites

  • The rule set that blocked the request, such as storefront-waf.
  • A personal token.

Create the exception

Send a POST request to the rule set’s exceptions endpoint, with specific_http_header_name as the match value:

Shell
01curl --request POST \
02 --url https://api.azion.com/v4/workspace/wafs/<waf-id>/exceptions \
03 --header 'Accept: application/json' \
04 --header 'Authorization: Token [TOKEN VALUE]' \
05 --header 'Content-Type: application/json' \
06 --data {
07 "rule_id": 1005,
08 "name": "Allow the session cookie on the storefront",
09 "path": "/",
10 "operator": "contains",
11 "active": true,
12 "conditions": [
13 { "match": "specific_http_header_name", "name": "cookie" }
14 ]
15}
JSON
01{
02 "state": "pending",
03 "data": {
04 "id": 123465,
05 "rule_id": 1005,
06 "name": "Allow the session cookie on the storefront",
07 "path": "/",
08 "conditions": [
09 { "match": "specific_http_header_name", "name": "cookie" }
10 ],
11 "operator": "contains",
12 "active": true,
13 "last_editor": "user@example.com",
14 "last_modified": "2026-01-01T12:00:00.000000Z"
15 }
16}

The API answers 202 and echoes the exception under data, with the name key of the condition intact. The Azion CLI sends the same body from a file with azion create waf-exceptions --waf-id <waf-id> --file exception.json.

Note — A condition carries only the keys its own shape declares, and a key the shape does not declare is dropped rather than refused. Sending {"match": "any_http_header_value", "name": "cookie"} answers 202 and reads back as {"match": "any_http_header_value"}: the exception now covers every header, and no response, read-back, or screen reports the difference. Read the stored condition after you create one. The API also stores the header name exactly as sent, so cookie, Cookie, and HTTP_COOKIE are each kept as written.

For the key each of the fifteen match values carries, refer to WAF Exceptions.

Next steps

Exempt one query string parameterThe same shape for a named query string argument, with the Console and CLI procedures.WAF ExceptionsAll fifteen match values, and the key each one carries.