Using API calls, you can create, download, compare, restore and delete backup copies of the settings of the Mikiri WAF agents, the request and response processing rules, the list of blocked IP addresses, the API Firewall and Nginx settings, data masking, Content Security Policy, as well as the behavioral models.
Backups are managed using specially designed queries. The general conventions (authorization, response codes, the *_hash methods and paginated selection) are described in the relevant section.
A backup copy is created:
automatically - when the data is changed (Nginx, Filter, MLC settings, request processing rule, response processing rule, BL, the list of hosts for machine learning, the API Firewall settings, data masking, Content Security Policy), as well as when a behavioral model is generated, replicated or deleted. In this case, the comment is generated automatically;manually - using the set_%ENTITY% method with the ability to set a comment;before restoring from a backup copy - for the current state of the data.The storage period of backups is set by the
RB_STORAGE_PERIODoption in the configuration file of the API. With the value0, backups are not created.The methods for response processing rule, the Scanner settings and Content Security Policy are available only for the
Enterpriseplan (plan_id > 1).
The full URL is formed as /rollback/v1/%METHOD%, where %METHOD% is %ACTION%_%ENTITY%.
|
Entity |
Description |
Methods |
|
openapi_settings |
All the data of the API Firewall: the specifications, the list of API addresses and the list of excluded addresses. The path schemas generated automatically by MLC are not affected |
get, set, del, diff, restore |
|
nginx_settings |
All the data of the Nginx settings: the global settings, virtual hosts, configuration templates, upstreams, SSL certificates and DHParam. When downloading, sensitive data (private keys, DHParam) is masked |
get, set, del, diff, restore |
|
filter_settings |
The settings of the Filter |
get, set, del, diff, restore |
|
mlc_settings |
The settings of MLC |
get, set, del, diff, restore |
|
scanner_settings |
The settings of the Scanner. Only for the |
get, set, del, diff, restore |
|
masking |
Data masking activity and rules. A backup stores |
get, set, del, diff, restore |
|
csp_settings |
Every host policy of a CID from Content Security Policy. A scanner inventory update does not create a backup. Enterprise only |
get, set, del, diff, restore |
|
ml_hosts |
The list of virtual hosts for which behavioral models are created |
get, set, del, diff, restore |
|
erl |
get, set, del, diff, restore |
|
|
rprl |
The response processing rules. Only for the |
get, set, del, diff, restore |
|
bl |
get, set, del, diff, restore |
|
|
models |
A specific behavioral model (defined by the host) |
get, set, del, restore |
Comparison (
diff) is not supported for behavioral models.
Request example:
curl http://api.example.com:8080/rollback/v1/get_filter_settings --header 'Content-type: application/json' --data '{"key": "%PRODUCT KEY%"}'
Response format:
If backups are missing, the value null is returned in the backups field.
{
"status": "success",
"backups": {
"%BACKUP ID%": {
"rbts": integer,
"rbcm": string,
"%SETTING%": object
}
}
}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Response example:
{
"status": "success",
"backups": {
"b7e0f0a41c6f4f8f9a1d2c3b4e5f6a7b": {
"rbts": 1730986421,
"rbcm": "before changing the autoban limits",
"filter_settings": {
"active": true,
"waf_autoban": [{"rate": "5r/m", "block_time": 600}]
}
}
}
}
rbts - the date of creation of the backup copy in the Unix Timestamp format;rbcm - the comment;%SETTING% - the name of the setting or of the data (filter_settings, mlc_settings, erl, etc.) and its contents.For get_models, the fields host (the host of the model) and hash (the hash sum of the model) are returned instead of the contents of the setting.
The method creates a backup copy of the current state of the data.
Request example:
curl http://api.example.com:8080/rollback/v1/set_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"rbcm": "before changing the autoban limits"
}'
For /rollback/v1/set_models, the host of the model is additionally specified:
curl http://api.example.com:8080/rollback/v1/set_models --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"rbcm": "before retraining the model",
"host": "example.com"
}'
Optional parameters:
rbcm - the comment.Required parameters (only for set_models):
host - the host of the behavioral model.Response example:
{"status": "success", "id": "b7e0f0a41c6f4f8f9a1d2c3b4e5f6a7b"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
A backup copy is not created if there is no data to copy, or if the
RB_STORAGE_PERIODoption is set to0.
The method compares the current data with the data from the backup copy.
Request example:
curl http://api.example.com:8080/rollback/v1/diff_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": "b7e0f0a41c6f4f8f9a1d2c3b4e5f6a7b"
}'
Required parameters:
id - the identifier of the backup copy.Response format:
For the Filter, MLC and Scanner settings, BL, the list of hosts for machine learning, the API Firewall and Nginx settings:
{
"status": "success",
"id": "%BACKUP ID%",
"diff": {
"%SETTING%": {
"%SUBSETTING%": {
"currentOnly": [
{"%PARAMETER%": "%VALUE%"}
],
"backupOnly": [
{"%PARAMETER%": "%VALUE%"}
],
"dataState": {
"%PARAMETER%": {
"backup": "%VALUE%",
"current": "%VALUE%"
}
}
}
}
}
}
For request processing rule and response processing rule, the comparison is performed for each rule:
{
"status": "success",
"id": "%BACKUP ID%",
"diff": {
"%SETTING%": {
"%RULE ID%": {
"currentOnly": [
{"%PARAMETER%": "%VALUE%"}
],
"backupOnly": [
{"%PARAMETER%": "%VALUE%"}
],
"dataState": {
"%PARAMETER%": {
"backup": "%VALUE%",
"current": "%VALUE%"
}
}
}
}
}
}
or (in the case where data is missing)
{"status": "none"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
%SUBSETTING% - the name of the nested setting (only for the API Firewall and Nginx settings), for example, openapi_url, nginx_server;currentOnly - the data is present in the current settings and absent from the backup copy;backupOnly - the data is present in the backup copy and absent from the current settings;dataState - the list of changed values, where backup is the value in the backup copy and current is the current value.When comparing, sensitive data is replaced with a hash sum: SSL certificates and private keys (
certificate_hash,certificate_key_hash), DHParam (dhparam_hash), API Firewall specifications (schema_hash). The contents of the Nginx configuration templates (snippet_data) are displayed in their original form.
Request example:
curl http://api.example.com:8080/rollback/v1/restore_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": "b7e0f0a41c6f4f8f9a1d2c3b4e5f6a7b"
}'
Required parameters:
id - the identifier of the backup copy.Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}
Before restoring, a backup copy of the current state of the data is created automatically.
Request example:
curl http://api.example.com:8080/rollback/v1/del_filter_settings --header 'Content-type: application/json' --data '{
"key": "%PRODUCT KEY%",
"id": "b7e0f0a41c6f4f8f9a1d2c3b4e5f6a7b"
}'
Required parameters:
id - the identifier of the backup copy.Response example:
{"status": "success"}
or (in case of an error)
{"status": "fail", "description": "%DESCRIPTION%"}