Skip to content

[API Shield] Update API Discovery operation workflow #32581

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
xmflszz wants to merge 1 commit into
base: production
Choose a base branch
from
+12 −14
Open

[API Shield] Update API Discovery operation workflow #32581

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 12 additions & 14 deletions src/content/docs/api-shield/security/api-discovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,26 +46,24 @@ Cloudflare consolidates these to `{hostVar1}.example.com/api/v1/users/{var1}`.

For more technical details, refer to the [blog post](https://blog.cloudflare.com/ml-api-discovery-and-schema-learning/).

### Inbox view
### Discovered operations

API Shield first catalogs your discovered API endpoints in an inbox-style view. From API Discovery, you can save endpoints to [Endpoint Management](/api-shield/management-and-monitoring/) or ignore endpoints to remove them from view.
Web Assets adds discovered API endpoints to the operation inventory as candidate operations. Candidate operations provide context for matching, logging, detections, and rules before you manually review them.

Save all discovered API endpoints to Endpoint Management. Ignore any false positives by selecting **Save** or **Ignore** on each line, or use bulk selection.
You do not need to promote every discovered operation. Promote an operation to move it to the `full` state and start profile learning. Full operations support persisted API profiles, risk findings, and protections that require a known API endpoint.

To get started, search for `var1` in the search box to find all endpoints with path variables and save them first. You can examine endpoints without path variables later.
To promote a discovered operation:

Adding endpoints to Endpoint Management unlocks additional [security](/api-shield/security/), [visibility](/api-shield/management-and-monitoring/#endpoint-analysis), and [management](/api-shield/management-and-monitoring/) features.

To restore any errantly ignored endpoints, you can filter by **Ignored** and select **Restore**.

API Discovery is an ongoing process. Check back regularly for new results — a badge in the dashboard shows how many endpoints need review.

The **Needs Review** and **Ignored** counts may change over time as your API or traffic patterns change. Discovery results that are not saved can disappear.
<Steps>
1. In the Cloudflare dashboard, go to the **Web Assets** page.

:::note
<DashButton url="/?to=/:account/:zone/security/web-assets" />
2. Go to the **Operations** tab.
3. Open the row actions for a candidate or shadow operation.
4. Select **Learn profile**.
</Steps>

Cloudflare will use your feedback on ignored endpoints to improve the API Discovery machine learning model in a future release.
:::
Cloudflare moves the operation to the `full` state. The row action then changes to **Profile learned**. For more information, refer to [Promote an operation](/security/web-assets/manage-operations/#promote-an-operation).

### Machine learning-based discovery

Expand Down