Microsoft Azure Azure CDN WebApplicationFirewallManagement
Browse all Azure APIs45
AI ReadinessFoundational (D)45/100
Community OpenAPI document · agent-readySecurityThreat Detectionoauth26 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage Azure CDN Web Application Firewall policies and inspect available managed rule sets. Supports six endpoints for policy CRUD plus rule-set listing under Microsoft.Cdn.
Use for: I need to create a CDN WAF policy that blocks SQL injection attempts, List all CDN WAF policies in resource group cdn-prod, Retrieve the policy attached to my CDN endpoint to inspect its rules, Set up a rate-limit rule on a CDN WAF policy for /login traffic
Not supported: Does not configure Azure Front Door WAF, Application Gateway WAF, or DDoS Protection plans - use for Azure CDN WAF policies under Microsoft.Cdn only.
The Azure CDN Web Application Firewall Management API configures WAF policies and managed rule sets attached to Azure CDN endpoints. It exposes operations to list, create, update, and delete CdnWebApplicationFirewallPolicies under Microsoft.Cdn, plus a discovery endpoint for the managed rule sets that ship with the service. Each policy bundles custom rules, managed rule sets, and rate-limit rules that Azure CDN evaluates on incoming HTTP requests.
Install Jentic One Beta
Connect the Azure CDN WebApplicationFirewallManagement to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure CDN WebApplicationFirewallManagement, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-cdn-webapplicationfirewallmanagement" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fazure.com%2Fazure-cdn-webapplicationfirewallmanagement" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure CDN WebApplicationFirewallManagement API.
List the managed rule sets that can be attached to a CDN WAF policy
Enumerate CdnWebApplicationFirewallPolicies in a resource group
Retrieve a single WAF policy with its custom rules, managed rules, and rate-limit configuration
Create or update a CDN WAF policy with custom rules and managed rule overrides
Patch a policy's tags or enabled state without rewriting the full configuration
Delete a CDN WAF policy that is no longer attached to any CDN endpoint
Use Cases
Patterns agents use Azure CDN WebApplicationFirewallManagement API for, with concrete tasks.
★ Block Common Web Attacks at the CDN Edge
Attach a CDN WAF policy that includes a managed rule set covering OWASP Top 10 categories such as SQL injection and XSS, evaluated at the Azure CDN edge before requests reach origin servers. The Web Application Firewall Management API lets you create the policy, reference the managed rule set ID, and link the policy to one or more CDN endpoints. Most teams roll out a baseline policy across an entire CDN profile in under an hour.
Create a CdnWebApplicationFirewallPolicy named edge-baseline in rg-cdn that references the latest DefaultRuleSet managed rule set with action=Block.
Rate-Limit Sensitive Endpoints
Throttle abusive traffic to login or checkout paths by adding rate-limit rules to a CDN WAF policy. The policy properties include a rateLimitRules array with matchConditions on RequestUri, plus thresholds in requests per minute. Once the policy is attached to a CDN endpoint, any client exceeding the threshold receives a 429 from the edge without ever hitting origin compute.
Update an existing CDN WAF policy to add a rate-limit rule on RequestUri Contains '/login' with rateLimitThreshold=100 and rateLimitDurationInMinutes=1.
Geo-Block Traffic by Country
Deny CDN traffic from specific countries by adding a custom rule with a RemoteAddr or GeoMatch operator to a WAF policy. The API supports custom rules with priorities and explicit Allow or Block actions, evaluated before managed rule sets. Rolling out the change is a single PATCH or PUT against the policy resource, with effect propagating across the CDN footprint within minutes.
Update CdnWebApplicationFirewallPolicy edge-baseline to add a custom rule with name=GeoBlock, priority=10, action=Block, and matchCondition GeoMatch on the configured country list.
Agent-Driven Policy Standardisation
A Jentic agent enumerates every CDN WAF policy across the tenant and patches each one to use the same managed rule set version, custom rules, and rate-limit configuration. The agent uses Policies_List to discover policies and Policies_CreateOrUpdate to converge them on a baseline, replacing manual portal review with deterministic enforcement.
List all CdnWebApplicationFirewallPolicies in subscription 1111-2222 and patch each policy whose managed rule set version is older than 1.0 to the latest available DefaultRuleSet version.
Key Endpoints
6 endpoints — the azure cdn web application firewall management api configures waf policies and managed rule sets attached to azure cdn endpoints.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets
List available managed rule sets
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies
List CDN WAF policies in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Get a single CDN WAF policy
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Create or update a CDN WAF policy
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Patch tags or basic state of a policy
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Delete a CDN WAF policy
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Cdn/CdnWebApplicationFirewallManagedRuleSets
List available managed rule sets
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies
List CDN WAF policies in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Get a single CDN WAF policy
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Create or update a CDN WAF policy
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Patch tags or basic state of a policy
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}
Delete a CDN WAF policy
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
Azure CDN WebApplicationFirewallManagement
- Foundational (D)45/100
73
Foundational Compliance61
Developer Experience & Jentic Compatibility23
AI-Readiness & Agent Experience94
Agent Usability35
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
73
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A-Signals: 4
90%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
0%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
61
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
0%
Example Density
How richly the API is illustrated with examples.
100%
Example Validity
Percentage of examples that conform to their schemas.
46%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
23
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
91%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
0%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
94
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: A+Signals: 1
94%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
35
Security
Trust, risk posture, and security compliance.
Grade: FSignals: 1
35%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring Azure CDN WebApplicationFirewallManagement by hand means registering an Azure AD app, exchanging OAuth 2.0 tokens for management.azure.com, discovering managed rule set versions, and building the Azure Resource Manager plumbing that polls long-running policy updates and retries on throttling. Through Jentic you install once, import Azure CDN WebApplicationFirewallManagement from the API Directory, store the Azure AD credential once, and your agent calls it.
Permission scoping
This API puts the subscription, resource group, and policy name in the URL path (for example /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName}), so a rule can pin your agent to a specific WAF policy. You choose the operations it may call, so ones like deleting a policy or overwriting it with a create-or-update are not included unless you add them.
Credential isolation
Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create an Azure CDN WAF policy with managed rules' or 'add a rate-limit rule to a WAF policy', and Jentic returns the matching Policies operation with its full schema, including the managedRules and rateLimitRules blocks, so the agent does not read ARM docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure CDN WebApplicationFirewallManagement API through Jentic.
What authentication does the Azure CDN WAF Management API use?
Azure Active Directory OAuth 2.0 via the azure_auth scheme (user_impersonation scope) on https://management.azure.com/. Through Jentic, the AAD app credentials live in your Jentic One instance and the agent receives a runtime bearer token, never the secret.
Can I add a rate-limit rule with this API?
Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/CdnWebApplicationFirewallPolicies/{policyName} with a rateLimitRules array containing matchConditions, rateLimitThreshold (requests), and rateLimitDurationInMinutes.
What are the rate limits for the Azure CDN WAF Management API?
It shares Azure Resource Manager subscription throttling, typically 12,000 reads and 1,200 writes per hour per subscription. The API itself manages WAF rate-limit rules; do not confuse those data-plane limits with the control-plane ARM throttling that affects how often you can update policies.
How do I attach a managed rule set through Jentic?
Search Jentic for "create azure cdn waf policy", load the schema for Policies_CreateOrUpdate, populate the managedRules.managedRuleSets array with the desired ruleSetType and ruleSetVersion (discovered via ManagedRuleSets_List), then execute. Get an API key through Jentic One, the self-hosted execution layer.
Does this API protect Azure Front Door endpoints?
No. This API targets Azure CDN endpoints under Microsoft.Cdn. Azure Front Door uses its own WAF resource provider, Microsoft.Network/frontdoorWebApplicationFirewallPolicies, which is exposed by a different API.
Can a single policy be attached to multiple CDN endpoints?
Yes. A CdnWebApplicationFirewallPolicy can be referenced by multiple CDN endpoint resources, and changes to the policy propagate to every endpoint that links it. The policy resource tracks the linked endpoints via its endpointLinks property.
Can I limit what my agent is allowed to do with the Azure CDN WAF Management API?
Yes. Because you run Jentic One yourself, your own rules decide which of this API's operations the agent may call, so you can grant read-only access like listing policies and managed rule sets while excluding destructive calls such as deleting a policy or overwriting it with a create-or-update. Since this API places the subscription, resource group, and policy name directly in the URL path, you can also pin the agent to one specific WAF policy or resource group rather than the whole subscription. The Azure AD credential stays in your Jentic One instance and is injected only at execution time, never exposed to the agent.
GET STARTED