Azure CDN WebApplicationFirewallManagement

Name: Azure CDN WebApplicationFirewallManagement API
Brand: Azure CDN WebApplicationFirewallManagement
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth26 EndpointsREST

For Agents

Manage Azure CDN Web Application Firewall policies and inspect available managed rule sets. Supports six endpoints for policy CRUD plus rule-set listing under Microsoft.Cdn.

Connect the Azure CDN WebApplicationFirewallManagement to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure CDN WebApplicationFirewallManagement, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure CDN WebApplicationFirewallManagement API.

List the managed rule sets that can be attached to a CDN WAF policy

Enumerate CdnWebApplicationFirewallPolicies in a resource group

Retrieve a single WAF policy with its custom rules, managed rules, and rate-limit configuration

Create or update a CDN WAF policy with custom rules and managed rule overrides

GET STARTED

Start building with Azure CDN WebApplicationFirewallManagement API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Azure CDN WebApplicationFirewallManagement, keeping it validated and agent-ready.

The Azure CDN Web Application Firewall Management API configures WAF policies and managed rule sets attached to Azure CDN endpoints. It exposes operations to list, create, update, and delete CdnWebApplicationFirewallPolicies under Microsoft.Cdn, plus a discovery endpoint for the managed rule sets that ship with the service. Each policy bundles custom rules, managed rule sets, and rate-limit rules that Azure CDN evaluates on incoming HTTP requests.

Use Cases

Patterns agents use Azure CDN WebApplicationFirewallManagement API for, with concrete tasks.

★ Block Common Web Attacks at the CDN Edge

Attach a CDN WAF policy that includes a managed rule set covering OWASP Top 10 categories such as SQL injection and XSS, evaluated at the Azure CDN edge before requests reach origin servers. The Web Application Firewall Management API lets you create the policy, reference the managed rule set ID, and link the policy to one or more CDN endpoints. Most teams roll out a baseline policy across an entire CDN profile in under an hour.

Create a CdnWebApplicationFirewallPolicy named edge-baseline in rg-cdn that references the latest DefaultRuleSet managed rule set with action=Block.

Rate-Limit Sensitive Endpoints

Throttle abusive traffic to login or checkout paths by adding rate-limit rules to a CDN WAF policy. The policy properties include a rateLimitRules array with matchConditions on RequestUri, plus thresholds in requests per minute. Once the policy is attached to a CDN endpoint, any client exceeding the threshold receives a 429 from the edge without ever hitting origin compute.

Update an existing CDN WAF policy to add a rate-limit rule on RequestUri Contains '/login' with rateLimitThreshold=100 and rateLimitDurationInMinutes=1.

Geo-Block Traffic by Country

Deny CDN traffic from specific countries by adding a custom rule with a RemoteAddr or GeoMatch operator to a WAF policy. The API supports custom rules with priorities and explicit Allow or Block actions, evaluated before managed rule sets. Rolling out the change is a single PATCH or PUT against the policy resource, with effect propagating across the CDN footprint within minutes.

Update CdnWebApplicationFirewallPolicy edge-baseline to add a custom rule with name=GeoBlock, priority=10, action=Block, and matchCondition GeoMatch on the configured country list.

Agent-Driven Policy Standardisation

A Jentic agent enumerates every CDN WAF policy across the tenant and patches each one to use the same managed rule set version, custom rules, and rate-limit configuration. The agent uses Policies_List to discover policies and Policies_CreateOrUpdate to converge them on a baseline, replacing manual portal review with deterministic enforcement.

List all CdnWebApplicationFirewallPolicies in subscription 1111-2222 and patch each policy whose managed rule set version is older than 1.0 to the latest available DefaultRuleSet version.

Key Endpoints

6 endpoints — the azure cdn web application firewall management api configures waf policies and managed rule sets attached to azure cdn endpoints.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets

List available managed rule sets

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies

List CDN WAF policies in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Get a single CDN WAF policy

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Create or update a CDN WAF policy

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Patch tags or basic state of a policy

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Delete a CDN WAF policy

GET

/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets

List available managed rule sets

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies

List CDN WAF policies in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Get a single CDN WAF policy

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Create or update a CDN WAF policy

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD service principal credentials stay in the Jentic MAXsystem vault. Agents call the WAF management endpoints with a scoped bearer token issued at runtime, so no secret material flows through prompts, logs, or agent memory.

Intent-based discovery

Agents search Jentic by intent (e.g. "create azure cdn waf policy with managed rules") and Jentic returns the matching Policies operation with its full schema, including the managedRules and rateLimitRules blocks, so the agent does not need to read ARM docs.

Time to first call

Direct integration: about a day for AAD setup, ARM long-running operation polling, and rule-set discovery. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure CDN Management

Provisions CDN profiles and endpoints that this WAF API protects.

Use alongside this API when the agent must create or modify the CDN endpoints that a WAF policy attaches to.

Alternative

Azure Front Door Management

Front Door is the alternative global edge with its own WAF resource provider.

Choose Front Door management when the workload is fronted by Front Door instead of Azure CDN.

Alternative

Web Application Firewall Management

Generic Microsoft.Network WAF policies for Application Gateway scenarios.

Choose this when the WAF is fronting Application Gateway rather than Azure CDN.

FAQs

Specific to using Azure CDN WebApplicationFirewallManagement API through Jentic.

What authentication does the Azure CDN WAF Management API use?

Azure Active Directory OAuth 2.0 via the azure_auth scheme (user_impersonation scope) on https://management.azure.com/. Through Jentic, the AAD app credentials live in the MAXsystem vault and the agent receives a runtime bearer token, never the secret.

Can I add a rate-limit rule with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} with a rateLimitRules array containing matchConditions, rateLimitThreshold (requests), and rateLimitDurationInMinutes.

What are the rate limits for the Azure CDN WAF Management API?

It shares Azure Resource Manager subscription throttling, typically 12,000 reads and 1,200 writes per hour per subscription. The API itself manages WAF rate-limit rules; do not confuse those data-plane limits with the control-plane ARM throttling that affects how often you can update policies.

How do I attach a managed rule set through Jentic?

Search Jentic for "create azure cdn waf policy", load the schema for Policies_CreateOrUpdate, populate the managedRules.managedRuleSets array with the desired ruleSetType and ruleSetVersion (discovered via ManagedRuleSets_List), then execute. Get an API key at https://app.jentic.com/sign-up.

Does this API protect Azure Front Door endpoints?

No. This API targets Azure CDN endpoints under Microsoft.Cdn. Azure Front Door uses its own WAF resource provider, Microsoft.Network/frontdoorWebApplicationFirewallPolicies, which is exposed by a different API.

Can a single policy be attached to multiple CDN endpoints?

Yes. A CdnWebApplicationFirewallPolicy can be referenced by multiple CDN endpoint resources, and changes to the policy propagate to every endpoint that links it. The policy resource tracks the linked endpoints via its endpointLinks property.