Create a learned Schema Profile for one operation. Then review its detections before configuring mitigation.
Cloudflare learns profiles weekly from qualifying traffic during the previous seven days. Only requests that received a 2xx response qualify.
An operation needs 1,000 qualifying requests for the field-learning threshold. It needs 10,000 qualifying requests for the boundary-learning threshold.
After meeting the field-learning threshold, Cloudflare can learn request fields. After meeting the boundary-learning threshold, Cloudflare can learn constraints such as numeric ranges and string lengths.
The first profile appears after the next weekly learning run. This can take up to seven days after meeting the relevant threshold.
-
In the Cloudflare dashboard, go to Web Assets > Operations.
Go to Web assets ↗ -
Select a discovered operation or add one manually. An operation uses an HTTP method, hostname pattern, and path pattern.
-
From the operation overflow menu, select Learn profile. Discovery and manual creation do not start profiling.
-
Allow Cloudflare to collect enough qualifying traffic.
-
From the operation overflow menu, select View details. Review the learned schema under Security overview.
-
In Security > Analytics, open Profile Analysis. Review request time series for profile conformance and violations.
Go to Analytics ↗ -
Drill into sampled logs to review violation reasons.
-
After reviewing representative production traffic, create a Custom Rule.
-
Scope the rule to the intended hostname, path, or operation. Then choose a mitigation action.
After the profile becomes available, Cloudflare runs an always-on detection. It does not mitigate requests without a Custom Rule.
If no learned schema appears, confirm that you selected Learn profile. Cloudflare may still be collecting enough qualifying traffic.
For learning details and limitations, refer to Schema Profiles.
If you have an OpenAPI schema, upload it through Schema validation. Uploaded schemas produce detections through cf.schema_validation.uploaded.violated.
The API Shield reference covers upload formats, OpenAPI requirements, API configuration, Terraform configuration, and limitations.