CloFix API Security Engine Guide

Overview

The API Security Engine runs only when the request path matches a configured prefix. HTML pages and static assets skip it. Enable or disable it per domain with api_engine without redeploying application code.

Path scoping

The default prefixes are /api/ and /graphql. A prefix match comes first. Non-API paths leave the engine entirely, which keeps the overhead on marketing and static traffic at zero.

GraphQL

With graphql on, the engine blocks introspection probes, deeply nested queries, and dangerous operations.

API abuse

With abuse on, the engine checks rate abuse, unusual HTTP methods, and admin API paths.

Schema validation

With schema on, mutating API requests must send a Content-Type and valid JSON.

Block or log

block_mode onMatching abusive API requests are denied.

logThe request continues after telemetry is recorded.

Configuration

Set this in the domain configuration, or under Configuration Manager → API Security Engine.

domain conf

api_engine {
    enabled on;
    block_mode on;
    graphql on;
    abuse on;
    schema on;
    paths /api/,/graphql;
}

Dashboard

Status and tuning are on /waf-dashboard/api-engine. The engine complements AI, Bot, CRS, and Advanced Protection on the same host.