API Shield

Run schema learning on demand

You can now manually request an API Shield schema learning run without waiting for the weekly schedule. Use this during testing after sending representative traffic to your API. In Web Assets > Operations, open the More options menu for the operations table and select Ad-hoc learn schema. In the Schema learning dialog, select Run learning. The run covers the entire zone and uses observed traffic.…

Increased limits for JWT validation configurations

API Shield JSON Web Token validation now supports 32 token configurations per zone by default. Each token configuration can contain up to 16 keys. These increased limits support more JWT configurations and provide additional capacity for key rotation. Refer to Configure JWT validation via the API for configuration details.

Symmetric key support for JWT validation

API Shield JSON Web Token validation now supports symmetric keys that use the HS256, HS384, and HS512 algorithms. You can configure HMAC verification keys in the Cloudflare dashboard or with the Cloudflare API. Cloudflare never stores symmetric credentials in plaintext. API responses do not include the credential. Refer to Configure JWT validation via the API for supported key formats and credent…

Web Assets fields now available in GraphQL Analytics API

Two new fields are now available in the httpRequestsAdaptive and httpRequestsAdaptiveGroups GraphQL Analytics API datasets: webAssetsOperationId — the ID of the saved endpoint that matched the incoming request. webAssetsLabelsManaged — the managed labels mapped to the matched operation at the time of the request (for example, cf-llm, cf-log-in). At most 10 labels are returned per request. Both fi…

New Vulnerability Scanner for API Shield

Introducing Cloudflare's Web and API Vulnerability Scanner (Open Beta) Cloudflare is launching the Open Beta of the Web and API Vulnerability Scanner ↗︎ for all API Shield customers. This new, stateful Dynamic Application Security Testing (DAST) platform helps teams proactively find logic flaws in their APIs. The initial release focuses on detecting Broken Object Level Authorization (BOLA) vulner…

New Zombie API detection for API Shield

API Shield now automatically detects zombie endpoints — saved endpoints that have not received traffic for an extended period. When detected, the cf-risk-zombie risk label is applied. The scan runs daily alongside existing risk scans. Endpoints are labeled after 32 days without traffic. Zombie endpoints may indicate deprecated or forgotten API surface area that could pose a security risk. Review…

New BOLA Vulnerability Detection for API Shield

Now, API Shield automatically searches for and highlights Broken Object Level Authorization (BOLA) attacks on managed API endpoints. API Shield will highlight both BOLA enumeration attacks and BOLA pollution attacks, telling you what was attacked, by who, and for how long. You can find these attacks three different ways: Security Overview, Endpoint details, or Security Analytics. If these attacks…

New API Posture Management for API Shield

Now, API Shield automatically labels your API inventory with API-specific risks so that you can track and manage risks to your APIs. View these risks in Endpoint Management by label: ...or in Security Center Insights: API Shield will scan for risks on your API inventory daily. Here are the new risks we're scanning for and automatically labelling: cf-risk-sensitive: applied if the customer is subs…