通过 API 创建源站规则

使用 Rulesets API 通过 API 创建源站规则。

基本规则设置

通过 API 创建源站规则时，请确保：

将规则操作设置为 route。
根据源站覆盖类型，在 action_parameters 字段中定义参数。
将规则部署到 zone 层级的 http_request_origin 阶段。

操作步骤

通过 API 为给定 zone 创建 an origin rule 时，请遵循以下工作流：

使用 List zone rulesets 操作检查 zone 级别是否已有 http_request_origin phase 的 ruleset。
如果 phase ruleset 不存在，使用 Create a zone ruleset 操作创建。在新 ruleset 属性中设置以下值：
- kind：zone
- phase：http_request_origin
使用 Update a zone ruleset 操作将 an origin rule 添加到 ruleset 规则列表。或者，在上一步的 Create a zone ruleset 请求中包含该规则。

确保你的 API 令牌具有执行 API 操作所需的权限。

示例请求

示例：添加一条规则，覆盖传入请求的 Host 标头和解析的 DNS 记录

以下示例使用更新区域规则集操作，将现有阶段规则集 ($RULESET_ID) 的规则设置为单个源站规则——重写传入请求的 Host 标头和解析后的 DNS 记录。响应将包含您更新后的规则集的完整定义。

Required API token permissions

At least one of the following token permissions is required:

Response Compression Write
Config Settings Write
Dynamic URL Redirects Write
Cache Settings Write
Custom Errors Write
Origin Write
Managed headers Write
Zone Transform Rules Write
Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
HTTP DDoS Managed Ruleset Write
Sanitize Write
Transform Rules Write
Select Configuration Write
Bot Management Write
Zone WAF Write
Account WAF Write
Account Rulesets Write
Logs Write
Logs Write

Update a zone rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$RULESET_ID" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"ref": "hr_app_overrides",
						"expression": "starts_with(http.request.uri.path, \"/hr-app/\")",
						"description": "Origin rule for the company HR application",
						"action": "route",
						"action_parameters": {
								"host_header": "hr-server.example.com",
								"origin": {
										"host": "hr-server.example.com"
								}
						}
				}
		]
	}'

{
	"result": {
		"id": "<RULESET_ID>",
		"name": "Origin Rules ruleset",
		"description": "Zone-level ruleset that will execute origin rules.",
		"kind": "zone",
		"version": "2",
		"rules": [
			{
				"ref": "hr_app_overrides",
				"id": "<RULE_ID>",
				"version": "1",
				"action": "route",
				"action_parameters": {
					"host_header": "hr-server.example.com",
					"origin": {
						"host": "hr-server.example.com"
					}
				},
				"expression": "starts_with(http.request.uri.path, \"/hr-app/\")",
				"description": "Origin rule for the company HR application",
				"last_updated": "2022-06-03T14:42:04.219025Z",
				"ref": "<RULE_REF>"
			}
		],
		"last_updated": "2022-06-03T14:42:04.219025Z",
		"phase": "http_request_origin"
	},
	"success": true,
	"errors": [],
	"messages": []
}

使用 Terraform 时，通过 ref 字段可在更新后保持稳定的规则 ID。添加该字段可防止 Terraform 在变更时重建规则。更多信息请参阅故障排除（Terraform 文档）。

示例：添加一条规则，覆盖传入请求的端口

以下示例使用更新区域规则集操作，将现有阶段规则集 ($RULESET_ID) 的规则设置为单个源站规则——重写传入请求的端口。响应将包含您更新后的规则集的完整定义。

Required API token permissions

At least one of the following token permissions is required:

Response Compression Write
Config Settings Write
Dynamic URL Redirects Write
Cache Settings Write
Custom Errors Write
Origin Write
Managed headers Write
Zone Transform Rules Write
Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
HTTP DDoS Managed Ruleset Write
Sanitize Write
Transform Rules Write
Select Configuration Write
Bot Management Write
Zone WAF Write
Account WAF Write
Account Rulesets Write
Logs Write
Logs Write

Update a zone rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$RULESET_ID" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"ref": "calendar_app_change_port",
						"expression": "starts_with(http.request.uri.path, \"/team/calendar/\")",
						"description": "Origin rule for the team calendar application",
						"action": "route",
						"action_parameters": {
								"origin": {
										"port": 8081
								}
						}
				}
		]
	}'

{
	"result": {
		"id": "<RULESET_ID>",
		"name": "Origin Rules ruleset",
		"description": "Zone-level ruleset that will execute origin rules.",
		"kind": "zone",
		"version": "2",
		"rules": [
			{
				"ref": "calendar_app_change_port",
				"id": "<RULE_ID>",
				"version": "1",
				"action": "route",
				"action_parameters": {
					"origin": {
						"port": 8081
					}
				},
				"expression": "starts_with(http.request.uri.path, \"/team/calendar/\")",
				"description": "Origin rule for the team calendar application",
				"last_updated": "2022-06-03T14:42:04.219025Z",
				"ref": "<RULE_REF>"
			}
		],
		"last_updated": "2022-06-03T14:42:04.219025Z",
		"phase": "http_request_origin"
	},
	"success": true,
	"errors": [],
	"messages": []
}

示例：添加一条规则，覆盖传入请求的 SNI 值

以下示例使用 Update a zone ruleset 操作，将现有阶段 ruleset（$RULESET_ID）的规则设置为一条源站规则——覆盖发往 admin.example.com 的传入请求的 SNI 值。

Required API token permissions

At least one of the following token permissions is required:

Response Compression Write
Config Settings Write
Dynamic URL Redirects Write
Cache Settings Write
Custom Errors Write
Origin Write
Managed headers Write
Zone Transform Rules Write
Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
HTTP DDoS Managed Ruleset Write
Sanitize Write
Transform Rules Write
Select Configuration Write
Bot Management Write
Zone WAF Write
Account WAF Write
Account Rulesets Write
Logs Write
Logs Write

Update a zone rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$RULESET_ID" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"ref": "override_sni_for_admin",
						"expression": "http.host eq \"admin.example.com\"",
						"description": "SNI Override for the admin area",
						"action": "route",
						"action_parameters": {
								"sni": {
										"value": "sni.example.com"
								}
						}
				}
		]
	}'

所需的 API 令牌权限

用于管理源站规则的 API 请求中使用的 API 令牌，至少必须具有以下权限：

Zone > Origin Rules > Edit