部署自定义规则集

要部署自定义规则集，请向账户或 zone 级别 phase 入口点规则集的规则列表添加一条动作为 execute 的规则。新规则的表达式将定义该自定义规则集何时运行。

您只能在具有相同作用域的入口点规则集中部署自定义规则集。例如，在账户级别定义的自定义规则集只能在账户级别部署。

如果您正在使用 Terraform，请参阅使用 Terraform 配置 WAF 自定义规则，了解创建和部署自定义规则集的示例。

如果您正在使用 Cloudflare 仪表板，请参阅在仪表板中使用自定义规则集。

开始之前

获取要部署自定义规则集的 phase 名称。
创建自定义规则集，并保留新自定义规则集的 ID。
获取 phase 入口点规则集中已有的规则。您必须在 PUT 请求中包含所有希望保留的现有规则。

示例 A - 账户级别部署

以下 PUT 请求添加一条规则：当 zone 名称匹配 example.com 时执行自定义规则集。

在 PUT 请求中，您必须包含所有希望保留的现有规则的 ID。响应将包含更新后 phase 入口点规则集中的所有规则。

Required API token permissions

At least one of the following token permissions is required:

Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
Transform Rules Write
Select Configuration Write
Account WAF Write
Account Rulesets Write
Logs Write

Update an account entry point rulesetbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"action": "execute",
						"description": "Execute custom ruleset",
						"expression": "(cf.zone.name == \"example.com\") and cf.zone.plan eq \"ENT\"",
						"action_parameters": {
								"id": "<CUSTOM_RULESET_ID>"
						}
				},
				{
						"id": "<EXISTING_PHASE_RULE_ID_1>"
				},
				{
						"id": "<EXISTING_PHASE_RULE_ID_2>"
				}
		]
	}'

{
	"result": {
		"id": "<ACCOUNT_PHASE_RULESET_ID>",
		"name": "http_request_firewall_custom phase entry point ruleset for my account",
		"description": "Execute several rulesets",
		"kind": "root",
		"version": "3",
		"rules": [
			{
				"id": "<PHASE_RULE_ID>",
				"version": "1",
				"action": "execute",
				"description": "Execute custom ruleset",
				"action_parameters": {
					"id": "<CUSTOM_RULESET_ID>",
					"version": "latest"
				},
				"expression": "(cf.zone.name == \"example.com\") and cf.zone.plan eq \"ENT\"",
				"last_updated": "2021-03-18T18:35:14.135697Z",
				"ref": "<PHASE_RULE_REF>",
				"enabled": true
			},
			{
				"id": "<EXISTING_PHASE_RULE_ID_1>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "<EXECUTED_RULESET_ID_1>",
					"version": "latest"
				},
				"expression": "(cf.zone.name eq \"example.com\") and cf.zone.plan eq \"ENT\"",
				"last_updated": "2021-03-16T15:51:49.180378Z",
				"ref": "<EXISTING_PHASE_RULE_REF_1>",
				"enabled": true
			},
			{
				"id": "<EXISTING_PHASE_RULE_ID_2>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "<EXECUTED_RULESET_ID_2>",
					"version": "latest"
				},
				"expression": "(cf.zone.name eq \"example.com\") and cf.zone.plan eq \"ENT\"",
				"last_updated": "2021-03-16T15:50:29.861157Z",
				"ref": "<EXISTING_PHASE_RULE_REF_2>",
				"enabled": true
			}
		],
		"last_updated": "2021-03-18T18:35:14.135697Z",
		"phase": "http_request_firewall_custom"
	},
	"success": true,
	"errors": [],
	"messages": []
}

示例 B - Zone 级别部署

以下 PUT 请求向 zone 级别入口点规则集添加一条规则，对目标为 /login URI 路径的请求执行 ID 为 "<CUSTOM_RULESET_ID>" 的自定义规则集。

您必须在 PUT 请求中包含所有希望保留的现有规则的 ID。响应将包含更新后 phase 入口点规则集中的所有规则。

Required API token permissions

At least one of the following token permissions is required:

Response Compression Write
Config Settings Write
Dynamic URL Redirects Write
Cache Settings Write
Custom Errors Write
Origin Write
Managed headers Write
Zone Transform Rules Write
Mass URL Redirects Write
Magic Firewall Write
L4 DDoS Managed Ruleset Write
HTTP DDoS Managed Ruleset Write
Sanitize Write
Transform Rules Write
Select Configuration Write
Bot Management Write
Zone WAF Write
Account WAF Write
Account Rulesets Write
Logs Write
Logs Write

Update a zone entry point rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_custom/entrypoint" \
	--request PUT \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"rules": [
				{
						"action": "execute",
						"description": "Execute custom ruleset (zone)",
						"expression": "(http.request.uri.path eq \"/login\")",
						"action_parameters": {
								"id": "<CUSTOM_RULESET_ID>"
						}
				},
				{
						"id": "<EXISTING_PHASE_RULE_ID_1>"
				}
		]
	}'

{
	"result": {
		"id": "<ZONE_PHASE_RULESET_ID>",
		"name": "http_request_firewall_custom phase entry point ruleset for my zone",
		"description": "",
		"kind": "zone",
		"version": "3",
		"rules": [
			{
				"id": "<PHASE_RULE_ID>",
				"version": "1",
				"action": "execute",
				"description": "Execute custom ruleset (zone)",
				"action_parameters": {
					"id": "<CUSTOM_RULESET_ID>",
					"version": "latest"
				},
				"expression": "(http.request.uri.path eq \"/login\")",
				"last_updated": "2025-08-18T18:35:14.135697Z",
				"ref": "<PHASE_RULE_REF>",
				"enabled": true
			},
			{
				"id": "<EXISTING_PHASE_RULE_ID_1>",
				"version": "1",
				"action": "managed_challenge",
				"expression": "(cf.waf.score lt 20 and http.request.uri.path wildcard \"/admin/*\")",
				"last_updated": "2025-08-16T15:51:49.180378Z",
				"ref": "<EXISTING_PHASE_RULE_REF_1>",
				"enabled": true
			}
		],
		"last_updated": "2025-08-18T18:35:14.135697Z",
		"phase": "http_request_firewall_custom"
	},
	"success": true,
	"errors": [],
	"messages": []
}