[WAF] Document Application Profiles and Schema Profile workflow

src/content/docs/api-shield/get-started.mdx

@@ -9,14 +9,10 @@ sidebar:
   label: Get started
 ---
 
-import { GlossaryTooltip, Render, Steps } from "~/components";
+import { GlossaryTooltip, Render } from "~/components";
 
 API Shield protects your APIs by discovering endpoints, validating request schemas, and detecting abuse patterns. This guide walks through the initial setup from configuring session identifiers to enabling advanced protections.
 
-:::note
-Enabling API Shield features will have no impact on your traffic until you choose to move a setting from `log` to `block` mode.
-:::
-
 ## Session identifiers
 
 <Render file="session-identifiers" product="api-shield" />
@@ -27,17 +23,17 @@ Enabling API Shield features will have no impact on your traffic until you choos
 
 <Render file="set-up-session-identifiers" product="api-shield" />
 
-## Upload a schema using Schema validation (optional)
+## Create a Schema Profile
 
-Schema validation protects your APIs by checking incoming requests against your <GlossaryTooltip term="API schema">API schema</GlossaryTooltip>. Depending on your configured action, requests that do not match the schema are logged or blocked.
+[Application Profiles](/waf/detections/application-profiles/) provides one Schema Profile with two sources. Schema Learning derives a profile from traffic, while Schema Validation uses an uploaded <GlossaryTooltip term="API schema">OpenAPI schema</GlossaryTooltip>.
 
-When you upload a schema via the Cloudflare dashboard, its endpoints are automatically added to Endpoint Management. If you already have an OpenAPI specification, upload it to [Schema validation](/api-shield/security/schema-validation/).
+Both sources provide an **always-on detection** after their profile becomes available. Mitigation requires a separate WAF Custom Rule.
 
 :::note
-It is recommended to start with Schema validation rules set to `log` to review logged requests in [Security Events](/waf/analytics/security-events/). When you are confident that only the correct requests are logged, you should switch the rule to `block`.
+Customers with API Security already have access to Schema Profiles through Schema Learning and Schema Validation. Cloudflare is opening a closed beta to invited Enterprise customers without API Security. Interested customers can contact their account team to express interest. Closed-beta access does not imply future plan availability or pricing.
 :::
 
-If you do not have a schema to upload, continue reading this guide to learn how to generate a schema with API Shield.
+If you maintain an OpenAPI schema, follow the [Schema Validation upload procedure](/api-shield/security/schema-validation/#upload-a-schema). API Shield remains the reference for OpenAPI compatibility, schema governance, and automation.
 
 ## Enable the Sensitive Data Detection ruleset and accompanying rules
 
@@ -49,29 +45,15 @@ Sensitive Data Detection requires a separate subscription. Contact your account
 
 You can identify endpoints returning sensitive data by selecting the icon next to the path in a row. Expand the endpoint to see details on which rules were triggered and view more information by exploring events in **Firewall Events**.
 
-## Add your discovered endpoints to Endpoint Management
-
-Cloudflare automatically discovers API endpoints by inspecting your traffic. Adding these discovered endpoints to [Endpoint Management](/api-shield/management-and-monitoring/endpoint-management/) unlocks additional security and monitoring features.
-
-Endpoint Management tracks request counts, error rates, and latency for each saved endpoint.
-
-:::note
-Schema validation, schema learning, JWT validation rules, sequence mitigation rules, and rate limit recommendations use operations in the `full` state. Sequence Analytics runs on operations in the `full` or `candidate` state that API Shield can match at the edge. For more information, refer to [Operation states](/security/web-assets/manage-operations/#operation-states).
-:::
-
-You can save your endpoints directly from [API Discovery](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-api-discovery), [Schema validation](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-from-schema-validation), or [manually](/api-shield/management-and-monitoring/endpoint-management/#add-endpoints-manually) by method, path, and host.
-
-You can view your list of saved endpoints in the **Endpoint Management** page. Cloudflare will aggregate [performance data](/api-shield/management-and-monitoring/endpoint-management/#endpoint-analysis) and security data on your endpoint once it is saved.
+## Manage operations
 
-### Allow the system to learn your traffic patterns
+Web Assets continuously discovers operations from traffic. An operation represents an endpoint by HTTP method, hostname pattern, and path pattern.
 
-After you add an endpoint, Cloudflare begins learning schema parameters from your API traffic. Endpoints must be saved for at least 24 hours before schema learning begins. Schema learning is a continuous process that inspects the most recent 72 hours of traffic. Endpoints with higher traffic volumes produce more accurate schemas.
+You can also add operations manually under **Web Assets** > **Operations**. Discovery and manual creation only add inventory entries.
 
-Cloudflare also uses your configured session identifiers to generate rate limit recommendations for each endpoint.
+To start Schema Learning, select **Learn profile** from the operation overflow menu. Review the learned schema through **View details** > **Security overview**.
 
-Allow at least 24 hours after adding endpoints before proceeding to the schema and rate limit steps below.
-
-While the system learns your traffic patterns, you can continue with [additional configurations](/api-shield/get-started/#additional-configuration) such as JWT validation or mTLS.
+For the complete workflow and traffic thresholds, refer to [Get started with Application Profiles](/waf/detections/application-profiles/get-started/).
 
 ## Add rate limits to your most sensitive endpoints
 
@@ -81,20 +63,14 @@ API Shield generates rate limit recommendations for each endpoint based on your
 
 Per-session rate limits track traffic from individual visitors during their session to a specific endpoint. This reduces false positives from broadly scoped rules while still limiting abusive traffic.
 
-## Import a learned schema to Schema validation
-
-Cloudflare learns schema parameters by inspecting request traffic for all endpoints saved to Endpoint Management. You can export the learned schema as an OpenAPI v3.0.0 specification by hostname.
-
-Import the learned schema into Schema validation to protect endpoints that Cloudflare discovered through traffic inspection — including endpoints you may not have had a schema for previously.
-
-You can import the learned schema of an entire hostname using the [Cloudflare dashboard](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-an-entire-hostname). Alternatively, you can [apply learned schemas to individual endpoints](/api-shield/security/schema-validation/#add-validation-by-applying-a-learned-schema-to-a-single-endpoint). Before applying a learned schema, export and review it to verify the schema accurately represents your expected traffic patterns.
-
-## Export a learned schema from Endpoint Management
+## Export a learned schema
 
 Learned schemas include the hostname, all endpoints by host, method, and path, and detected path variables (for example, `/users/{id}`). They can also include detected query parameters and their format. You can optionally include rate limit threshold recommendations.
 
 You can export your learned schemas in the [Cloudflare dashboard](/api-shield/management-and-monitoring/endpoint-management/schema-learning/#export-a-schema) or via the [API](/api/resources/api_gateway/subresources/schemas/methods/list/).
 
+Exporting creates an OpenAPI `v3.0.0` file. To use a fixed profile, upload that file through [Schema Validation](/api-shield/security/schema-validation/).
+
 ## View and configure Sequence Analytics
 
 [Sequence Analytics](/api-shield/security/sequence-analytics/) identifies common patterns of API requests — for example, a user checking their account balance before initiating a funds transfer.

src/content/docs/api-shield/index.mdx

@@ -11,7 +11,7 @@ head:
     content: Overview
 ---
 
-import { Description, Feature, Plan, RelatedProduct, Render } from "~/components"
+import { Description, Feature, Plan, RelatedProduct, Render } from "~/components";
 
 <Description>
 Identify and address your API vulnerabilities.
@@ -29,7 +29,7 @@ As APIs have become more prevalent, however, so have their problems:
 
 - Many companies have [thousands of APIs](/api-shield/security/api-discovery/), including ones they do not even know about.
 - To support a large base of users, many APIs are protected by a negative security model that makes them vulnerable to credential-stuffing attacks and automated scanning tools.
-- With so many endpoints and users, it’s difficult to recognize brute-force attacks against [specific endpoints](/api-shield/security/volumetric-abuse-detection/).
+- With so many endpoints and users, it is difficult to recognize brute-force attacks against [specific endpoints](/api-shield/security/volumetric-abuse-detection/).
 - Sophisticated attacks are even harder to recognize, often because even development teams are unaware of common and uncommon [usage patterns](/api-shield/security/sequence-analytics/).
 
 Refer to the [Get started](/api-shield/get-started/) guide to set up API Shield.
@@ -44,11 +44,21 @@ Secure your APIs using API Shield's security features.
 Monitor the health of your API endpoints.
 </Feature>
 
+## Use Schema Profiles
+
+[Application Profiles](/waf/detections/application-profiles/) provides a shared detection, analytics, and mitigation model. Schema Profile is its only current profile type.
+
+API Shield provides two Schema Profile sources. [Schema Learning](/api-shield/management-and-monitoring/endpoint-management/schema-learning/) learns from traffic, while [Schema Validation](/api-shield/security/schema-validation/) uses uploaded OpenAPI schemas.
+
+Use API Shield for API inventory, OpenAPI governance, profile export, automation, and higher-scale API workflows. Use the WAF Application Profiles pages for Profile Analysis and Custom Rule enforcement.
+
 ## Availability
 
-Cloudflare API Security products are available to Enterprise customers only, though anyone can set up [Mutual TLS](/api-shield/security/mtls/) with a Cloudflare-managed certificate authority.
+Cloudflare API Security products are available to Enterprise customers only. Anyone can set up [Mutual TLS](/api-shield/security/mtls/) with a Cloudflare-managed certificate authority.
+
+The full API Shield security suite is available as an Enterprise paid add-on. Refer to [API Shield plans](/api-shield/plans/) for feature-specific availability.
 
-The full API Shield security suite is available as an Enterprise-only paid add-on, but all customers can access [Endpoint Management](/api-shield/management-and-monitoring/) and [Schema validation](/api-shield/security/schema-validation/) functionalities.
+Customers with API Security already have access to Schema Profiles through Schema Learning and Schema Validation. Cloudflare is opening a closed beta to invited Enterprise customers without API Security. Interested customers can contact their account team to express interest. Closed-beta access does not imply future plan availability or pricing.
 
 :::note
 API Shield currently does not work for JDCloud customers.

src/content/docs/api-shield/management-and-monitoring/endpoint-labels.mdx

@@ -71,9 +71,7 @@ Cloudflare automatically runs risk scans every 24 hours on your saved endpoints.
 
 `cf-risk-mixed-auth`: Automatically added when some successful requests contain a session identifier and some successful requests lack a session identifier. Refer to [Authentication Posture](/api-shield/security/authentication-posture/#process) for more information.
 
-`cf-risk-sensitive`: Automatically added to endpoints when HTTP responses match the WAF's [Sensitive Data Detection](/api-shield/management-and-monitoring/#sensitive-data-detection) ruleset.
-
-`cf-risk-missing-schema`: Automatically added when a learned schema is available for an endpoint that has no active schema.
+`cf-risk-sensitive`: Automatically added to endpoints when HTTP responses match the WAF's [Sensitive Data Detection](/api-shield/management-and-monitoring/endpoint-management/#sensitive-data-detection) ruleset.
 
 `cf-risk-error-anomaly`: Automatically added when an endpoint experiences a recent increase in response errors over the last 24 hours.
 

src/content/docs/api-shield/management-and-monitoring/endpoint-management/index.mdx

@@ -1,6 +1,6 @@
 ---
 pcx_content_type: concept
-description: Promote, learn, and monitor API endpoints with API Shield and Web Assets.
+description: Manage API operations through the Web Assets dashboard.
 products:
   - api-shield
 title: Endpoint Management
@@ -12,9 +12,15 @@ import { GlossaryTooltip, Plan, Steps, DashButton } from "~/components";
 
 <Plan type="all" />
 
-Web Assets provides a unified inventory for managing <GlossaryTooltip term="API endpoint">API endpoints</GlossaryTooltip>. In Web Assets, an **operation** represents an endpoint by its HTTP method, hostname pattern, and path pattern.
+Endpoint Management content uses the current [Web Assets](/security/web-assets/) dashboard. Go to **Web Assets** > **Operations** to manage <GlossaryTooltip term="API endpoint">API endpoints</GlossaryTooltip>.
 
-Promote an API endpoint to move its operation into the `full` state. Promotion starts collecting data for profile learning and [performance analysis](#endpoint-analysis).
+An operation is Cloudflare's term for an endpoint identified by HTTP method, hostname pattern, and path pattern. Web Assets continuously discovers operations, and you can add them manually.
+
+Discovery and manual creation only add operations to inventory. To start profiling, select **Learn profile** for the intended operation.
+
+:::note[Schema Profile availability]
+Customers with API Security already have access to Schema Profiles through Schema Learning and Schema Validation. Cloudflare is opening a closed beta to invited Enterprise customers without API Security. Interested customers can contact their account team to express interest. Closed-beta access does not imply future plan availability or pricing.
+:::
 
 :::note
 When an endpoint uses [Cloudflare Workers](/workers/), some metrics are not populated.
@@ -29,22 +35,15 @@ When an endpoint uses [Cloudflare Workers](/workers/), some metrics are not popu
 2. Go to the **Operations** tab.
 </Steps>
 
-### Add endpoints from API Discovery
-
-The **Learn profile** action is available to API Shield customers using unified operation discovery and other customers with access to profile learning.
-
-This workflow promotes an existing discovered operation.
+### Review discovered operations
 
-<Steps>
-1. From **Web Assets** > **Operations**, open the row actions for a candidate or shadow operation.
-2. Select **Learn profile**.
-</Steps>
+Web Assets continuously adds discovered operations to the inventory. Discovery does not start profile learning.
 
-Cloudflare promotes the operation to the `full` state. The row action then changes to **Profile learned**. For more information, refer to [Promote an operation](/security/web-assets/manage-operations/#promote-an-operation).
+Candidate operations can provide context for matching, edge security detections, and [Sequence Analytics](/api-shield/security/sequence-analytics/). You do not need to change every discovered operation.
 
-You do not need to promote every discovered operation. Candidate operations can provide context for matching, edge security detections, and [Sequence Analytics](/api-shield/security/sequence-analytics/) without promotion. Persisted API profiles and [risk findings](/api-shield/management-and-monitoring/endpoint-labels/#risk-labels) require operations in the `full` state.
+<a id="add-endpoints-from-schema-validation" />
 
-### Add endpoints from Schema validation
+### Add operations from Schema validation
 
 <Steps>
 1. From **Web Assets** > **Operations**, select **Add operation**.
@@ -55,7 +54,9 @@ You do not need to promote every discovered operation. Candidate operations can
 
 API Shield looks for duplicate operations with the same hostname, method, and path. Duplicate operations are not added.
 
-### Add endpoints manually
+<a id="add-endpoints-manually" />
+
+### Add operations manually
 
 <Steps>
 1. From **Web Assets** > **Operations**, select **Add operation**.
@@ -64,6 +65,8 @@ API Shield looks for duplicate operations with the same hostname, method, and pa
 4. Select **Add operation**.
 </Steps>
 
+Manual operation creation does not start profile learning.
+
 When adding an operation manually, you can specify variable fields in the path or hostname. Enclose variables in braces, such as `/api/user/{var1}/details` or `{hostVar1}.example.com`.
 
 Cloudflare supports hostname variables in the following formats:
@@ -101,13 +104,28 @@ You can edit the identity of an operation.
 
 </Steps>
 
-Editing a candidate or shadow operation promotes it to the `full` state with the edited values.
+Editing an operation updates its inventory identity. It does not start profile learning.
 
 :::caution[Editing this operation will change its ID]
-Cloudflare computes operation IDs from the HTTP method, hostname, and path. Cloudflare relearns labels, schemas, and rate limiting recommendations for an operation with a new ID.
+Cloudflare computes operation IDs from the HTTP method, hostname, and path. Changing these values creates a different operation ID.
 :::
 
-### Delete endpoints manually
+### Start profile learning
+
+Start profiling only after reviewing the operation identity.
+
+<Steps>
+
+1. From **Web Assets** > **Operations**, open the operation overflow menu.
+2. Select **Learn profile**.
+3. After the profile becomes available, open the overflow menu again.
+4. Select **View details** and review **Security overview**.
+
+</Steps>
+
+For learning requirements, analytics, and enforcement, refer to [Application Profiles](/waf/detections/application-profiles/).
+
+### Delete operations manually
 
 You can delete endpoints one at a time or in bulk.
 
@@ -120,7 +138,9 @@ You can delete endpoints one at a time or in bulk.
 When you delete a full operation, Cloudflare stops tracking its associated performance and analytics data. Its previous historical metrics cannot be restored. If the operation returns to the `full` state, metric tracking restarts from that point.
 :::
 
-## Endpoint analysis
+<a id="endpoint-analysis" />
+
+## Operation analysis
 
 For each operation in the `full` state, you can view: