Microsoft Azure WebApplicationFirewallManagement
Browse all Azure APIsCommunity OpenAPI document · agent-readySecurityThreat Detectionoauth25 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage Azure Front Door Web Application Firewall policies and list available managed rule sets so agents can lock down web traffic against OWASP-style threats.
Use for: Create a Front Door WAF policy with the default managed rule set, List all WAF policies in resource group prod-rg, Get the current rules on WAF policy app-waf-prod, Delete an unused Front Door WAF policy
Not supported: Does not handle Application Gateway WAF, network DDoS protection, or backend application code - use for Front Door WAF policy and managed rule set management only.
The Azure WebApplicationFirewallManagement API manages Azure Front Door Web Application Firewall (WAF) policies and inspects the managed rule sets that Microsoft maintains for blocking common web exploits. It exposes five management plane operations across three resource paths under Microsoft.Network, covering policy create-or-update, policy retrieval and deletion, listing policies in a resource group, and listing managed rule sets globally for a subscription. Use it to script WAF policy lifecycle, attach policies to Front Door endpoints, and audit which managed rule set versions are available before assigning them.
Install Jentic One Beta
Connect the WebApplicationFirewallManagement to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the WebApplicationFirewallManagement, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fwebapplicationfirewallmanagement" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fwebapplicationfirewallmanagement" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with WebApplicationFirewallManagement API.
Create or update Front Door WAF policies with custom rules and managed rule set assignments
Retrieve a Front Door WAF policy by name to inspect its current rule configuration
List all Front Door WAF policies within a resource group for audit and reporting
Delete a WAF policy when an application is decommissioned or migrated
Enumerate available Microsoft-managed rule sets and versions before binding them to a policy
Use Cases
Patterns agents use WebApplicationFirewallManagement API for, with concrete tasks.
★ Standardise WAF policy across environments
Define a single WAF policy template and roll it out consistently across dev, staging, and production resource groups using Policies_CreateOrUpdate. Agents can list managed rule sets, choose a specific Microsoft rule set version, and apply it to every Front Door instance so security posture stays consistent without manual portal clicks.
Create a WAF policy named app-waf-prod in resource group prod-rg with the latest Microsoft Default Rule Set in Prevention mode and verify the response status.
WAF policy audit and drift detection
Inventory all Front Door WAF policies in a subscription by listing policies per resource group, then read each one to compare its custom rules and managed rule set versions against an approved baseline. This makes it possible to surface drift and unauthorised rule disables before they affect production traffic.
List all Front Door WAF policies in resource group prod-rg, fetch each by name, and report any policy where mode is set to Detection instead of Prevention.
Decommission unused WAF policies
When an application is retired, an agent can delete its associated WAF policy with Policies_Delete after confirming no Front Door endpoint references it. The API supports straightforward lifecycle removal so operators can keep their security configuration tidy and avoid orphaned policies that drift out of date.
Delete the WAF policy named legacy-app-waf in resource group archive-rg and confirm the long-running operation succeeds.
Agent-driven web edge hardening
Allow an AI agent to harden a new web application by discovering managed rule sets, applying the recommended one, and attaching the resulting policy to a Front Door deployment, all through Jentic-mediated calls. This turns WAF setup into a tool an agent can invoke as part of a broader provisioning runbook.
Search Jentic for 'list azure front door waf managed rule sets', load the schema, execute it for the target subscription, and pick the latest stable rule set.
Key Endpoints
5 endpoints — the azure webapplicationfirewallmanagement api manages azure front door web application firewall (waf) policies and inspects the managed rule sets that microsoft maintains for blocking common web exploits.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Create or update a Front Door WAF policy
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Get a Front Door WAF policy by name
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies
List WAF policies in a resource group
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Delete a Front Door WAF policy
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallManagedRuleSets
List available Microsoft-managed rule sets
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Create or update a Front Door WAF policy
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Get a Front Door WAF policy by name
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies
List WAF policies in a resource group
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}
Delete a Front Door WAF policy
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallManagedRuleSets
List available Microsoft-managed rule sets
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Managing Front Door WAF policies by hand means acquiring Azure Active Directory OAuth 2.0 tokens, targeting the management.azure.com ARM control plane, and threading subscription, resource group, and policy names through every Microsoft.Network path yourself. Through Jentic you install once, import Web Application Firewall Management from the API Directory, store the Azure AD credential once, and your agent calls it.
Permission scoping
This API carries the subscription, resource group, and policy name in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}), so a rule can pin your agent to one WAF policy or resource group and nothing else. You choose the operations it may call, so policy deletion is not included unless you add it.
Credential isolation
Your Azure AD token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create a Front Door WAF policy' or 'list managed rule sets', and Jentic returns the matching Policies operation with its input schema so the agent calls the right ARM endpoint without browsing Microsoft docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using WebApplicationFirewallManagement API through Jentic.
What authentication does the WebApplicationFirewallManagement API use?
The API uses Azure Active Directory OAuth 2.0 via the implicit flow scheme `azure_auth` defined in the spec, scoped to user_impersonation against https://management.azure.com. Through Jentic the OAuth token stays in the vault; agents only ever see scoped, short-lived bearer tokens.
Can I create a Front Door WAF policy with this API?
Yes. Use PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName} (Policies_CreateOrUpdate) to create or update a policy, including custom rules and managed rule set references.
What are the rate limits for this API?
The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which applies standard ARM throttling per subscription. Inspect the x-ms-ratelimit-remaining-subscription-writes and -reads headers to track remaining quota.
How do I list all WAF policies in my subscription through Jentic?
Search Jentic for 'list azure front door waf policies', load the schema for the Policies_List operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies, and execute it. Install with `pip install jentic` and use the async search/load/execute pattern.
Does this API protect Application Gateway WAFs as well?
No. This API only manages Front Door WAF policies under the FrontDoorWebApplicationFirewallPolicies resource type. Application Gateway WAF policies are managed through a separate Azure Network resource and are out of scope here.
Can I see which managed rule sets are available before assigning one?
Yes. GET /subscriptions/{subscriptionId}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallManagedRuleSets (ManagedRuleSets_List) returns each Microsoft-managed rule set and its versions so you can pin a policy to a specific version.
Can I limit what my agent is allowed to do with the Microsoft Azure Front Door WAF Management API?
Yes. Because you run Jentic One yourself, your own rules decide which of the five operations your agent may call and which Azure AD credential it uses, so you can allow it to create or read WAF policies and list managed rule sets while withholding Policies_Delete. Since this API carries the subscription, resource group, and policy name in the request path, you can pin the agent to a single WAF policy or one resource group and nothing beyond it. The Azure AD token is stored once by your own instance and injected only at execution time, so it never reaches the agent's prompt or logs.
GET STARTED