---
title: Rulesets REST Interface
slug: ps/help/en_us/vwaf/ag/rulesets-rest-interface
docTags: 
createdAt: 2026-08-02T10:05:41.989Z
---

## Data and limitations

The ruleset data is the internal representation of the ruleset object and is subject to change without notice.

You can’t change rulesets via the REST interface, and you can’t delete them. POST commands on an URL like /application/APPUUID/rulesets/RULESETUUID always return an error code 409. PUT and DELETE also always fail and return an error code 409.

However, you can, for example, export a ruleset and import it into multiple other applications to duplicate it.

## Getting a list of rulesets for an application

- Request

| Method    | GET                             |
| --------- | ------------------------------- |
| URL       | /applications/APPUUID/rulesets/ |
| Arguments | –                               |

- Response

| Return code | Arguments                                  | Meaning                                                                                                                                                                |
| ----------- | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 200         | \{RULEUUID1: VERSION, RULEUUID2: VERSION } | list of rulesets for the given application successfully returned as a dictionary containing the ruleset UUIDs as keys and the representative version numbers as values |
| 401         | -                                          | no login                                                                                                                                                               |
| 403         | -                                          | not enough rights                                                                                                                                                      |
| 404         | -                                          | application not found                                                                                                                                                  |
| 500         | -                                          | internal server error                                                                                                                                                  |

- Example

The following request retrieves a list of all rulesets for the application that has the UUID “f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c”. Note that you don’t use the application name in the request, but this UUID.

In this case, there is only one ruleset available.

```bash
$ curl -u admin:admin -H 'Content-Type: application/json' http://127.0.0.1:8087/api/af/2.0/applications/f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c/rulesets {    "__name": "rulesets",    "__path": "/api/af/2.0/applications/f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c/rulesets/",    "__subnodes": [        "127.0.0.1:8083:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1"    ],    "rulesets": {        "127.0.0.1:8083:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1": 1    } }
```

## Getting a ruleset BLOB

- Request

| Method    | GET                                     |
| --------- | --------------------------------------- |
| URL       | /applications/APPUUID/rulesets/RULEUUID |
| Arguments | –                                       |

- Response

| Return code | Arguments        | Meaning                                                                   |
| ----------- | ---------------- | ------------------------------------------------------------------------- |
| 200         | \{ RULESETDATA } | ruleset successfully returned as a dictionary containing all ruleset data |
| 401         | -                | no login                                                                  |
| 403         | -                | not enough rights                                                         |
| 404         | -                | application or ruleset not found                                          |
| 500         | -                | internal server error                                                     |

Example

The following request retrieves the data of the ruleset with the UUID "127.0.0.1:8083\:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1", which is a ruleset for the application "f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c".

(In the example, the response is truncated.)

```bash
$ curl -u admin:admin -H 'Content-Type: application/json' http://127.0.0.1:8087/api/af/2.0/applications/f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c/rulesets/127.0.0.1:8083:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1 { "__name": "127.0.0.1:8083:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1", "__path": "/api/af/2.0/applications/f011694d47d73578-3c0581461472821ff8d0c3a8c007d88c/rulesets/127.0.0.1:8083:f011694d47d73578-1a7bfe29b480dac5575de4bc15d85a6f:1/", "__subnodes": [], "baseline_config": {}, "changelog": [], "comment": "", "db_last_modified_timestamp": 1347292036, "db_last_modified_userid": "unknown", "global_handler": [ { "ConfigItems": [ { "db_last_modified_userid": "unknown", "description": "Enable Shortcut Handler", "is_inherited": true, "name": "enabled", "owner": [], "type": "boolean" }, .... } ], "global_timestamp": "00000000000000dc-127.0.0.1:8083-f011694d47d73578-d9a8f3dd4119ea7f200fd9b4acd624a1-1347292036", "handler": [ { "ConfigItems": [ { "db_last_modified_userid": "unknown", "description": "Enable this handler", "is_inherited": true, "name": "enabled", "owner": [], "type": "boolean" }, .... } ], "last_modified": 1347292036, "name": "initial ruleset", "owner": [], "rules": [ { "db_last_modified_userid": "unknown", "handler": [ { "ConfigItems": [ { "db_last_modified_userid": "unknown", "description": "Enable this handler", "is_inherited": true, "name": "enabled", "owner": [], "type": "boolean" }, .... ], "name": "/.*", "owner": [], "selector": [ { "ConfigItems": [ { "db_last_modified_userid": "unknown", "description": "Selection based on hostname", "is_inherited": true, "name": "enabled", "owner": [], "type": "boolean" }, .... ] } ], "version": 1 }
```

## Adding a ruleset

- Request

| Method    | POST                            |
| --------- | ------------------------------- |
| URL       | /applications/APPUUID/rulesets/ |
| Arguments | \{ RULESETDATA }                |

:::hint{type="info"}
To activate the added ruleset you need to change the fields logonly\_ruleset\_version and active\_ruleset\_version for the application that is to use this ruleset. See Applications REST Interface .
:::

- Response

| Return code | Arguments   | Meaning                                        |
| ----------- | ----------- | ---------------------------------------------- |
| 200         | RULESETUUID | ruleset with the given UUID successfully added |
| 401         | -           | no login                                       |
| 403         | -           | not enough rights                              |
| 404         | -           | application not found                          |
| 409         | -           | malformed, conflicting, or missing data        |
| 500         | -           | internal server error                          |