@robinmordasiewicz/f5xc-terraform-mcp 2.3.0 → 2.4.3

package/dist/docs/resources/service_policy.md

@@ -0,0 +1,795 @@
+---
+page_title: "f5xc_service_policy Resource - terraform-provider-f5xc"
+subcategory: "Security"
+description: |-
+  [Category: Security] [Namespace: required] [DependsOn: namespace] Manages service_policy creates a new object in the storage backend for metadata.namespace. in F5 Distributed Cloud.
+---
+
+# f5xc_service_policy (Resource)
+
+[Category: Security] [Namespace: required] [DependsOn: namespace] Manages service_policy creates a new object in the storage backend for metadata.namespace. in F5 Distributed Cloud.
+
+~> **Note** Please refer to [Service Policy API docs](https://docs.cloud.f5.com/docs-v2/api/service-policy) to learn more.
+
+## Example Usage
+
+```terraform
+# Service Policy Resource Example
+# [Category: Security] [Namespace: required] [DependsOn: namespace] Manages service_policy creates a new object in the storage backend for metadata.namespace. in F5 Distributed Cloud.
+
+# Basic Service Policy configuration
+resource "f5xc_service_policy" "example" {
+  name      = "example-service-policy"
+  namespace = "shared"
+
+  labels = {
+    environment = "production"
+    managed_by  = "terraform"
+  }
+
+  annotations = {
+    "owner" = "platform-team"
+  }
+
+  # Service Policy configuration
+  algo = "FIRST_MATCH"
+
+  # Allow specific paths
+  rules {
+    metadata {
+      name = "allow-api"
+    }
+    spec {
+      action = "ALLOW"
+      path {
+        prefix = "/api/"
+      }
+    }
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Argument Reference
+
+### Metadata Argument Reference
+
+<a id="name"></a>&#x2022; [`name`](#name) - Required String<br>Name of the Service Policy. Must be unique within the namespace
+
+<a id="namespace"></a>&#x2022; [`namespace`](#namespace) - Required String<br>Namespace where the Service Policy will be created
+
+<a id="annotations"></a>&#x2022; [`annotations`](#annotations) - Optional Map<br>Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata
+
+<a id="description"></a>&#x2022; [`description`](#description) - Optional String<br>Human readable description for the object
+
+<a id="disable"></a>&#x2022; [`disable`](#disable) - Optional Bool<br>A value of true will administratively disable the object
+
+<a id="labels"></a>&#x2022; [`labels`](#labels) - Optional Map<br>Labels is a user defined key value map that can be attached to resources for organization and filtering
+
+### Spec Argument Reference
+
+-> **One of the following:**
+&#x2022; <a id="allow-all-requests"></a>[`allow_all_requests`](#allow-all-requests) - Optional Block<br>Enable this option
+<br><br>&#x2022; <a id="allow-list"></a>[`allow_list`](#allow-list) - Optional Block<br>Source List. List of sources. A request belongs to this list if it satisfies any of the match criteria<br>See [Allow List](#allow-list) below for details.
+<br><br>&#x2022; <a id="deny-all-requests"></a>[`deny_all_requests`](#deny-all-requests) - Optional Block<br>Enable this option
+<br><br>&#x2022; <a id="deny-list"></a>[`deny_list`](#deny-list) - Optional Block<br>Source List. List of sources. A request belongs to this list if it satisfies any of the match criteria<br>See [Deny List](#deny-list) below for details.
+<br><br>&#x2022; <a id="rule-list"></a>[`rule_list`](#rule-list) - Optional Block<br>Rule List. A list of rules. The order of evaluation of the rules depends on the rule combining algorithm<br>See [Rule List](#rule-list) below for details.
+
+-> **One of the following:**
+&#x2022; <a id="any-server"></a>[`any_server`](#any-server) - Optional Block<br>Enable this option
+<br><br>&#x2022; <a id="server-name"></a>[`server_name`](#server-name) - Optional String<br>Server Name. The expected name of the server to which the request API is directed. The actual names for the server are extracted from the HTTP Host header and the name of the virtual_host to which the request is directed. If the request is directed to a virtual K8S service, the actual names also contain the name of that service. The predicate evaluates to true if any of the actual names is the same as the expected server name
+<br><br>&#x2022; <a id="server-name-matcher"></a>[`server_name_matcher`](#server-name-matcher) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions
+<br><br>&#x2022; <a id="server-selector"></a>[`server_selector`](#server-selector) - Optional Block<br>Label Selector. This type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the value of expresssions. A label selector is a label query over a set of resources. An empty label selector matches all objects. A null label selector matches no objects. Label selector is immutable. expressions is a list of strings of label selection expression. Each string has ',' separated values which are 'AND' and all strings are logically 'OR'. BNF for expression string `<selector-syntax>` ::= `<requirement>` | `<requirement>` ',' `<selector-syntax>` `<requirement>` ::= [!] KEY [ `<set-based-restriction>` | `<exact-match-restriction>` ] `<set-based-restriction>` ::= '' | `<inclusion-exclusion>` `<value-set>` `<inclusion-exclusion>` ::= `<inclusion>` | `<exclusion>` `<exclusion>` ::= 'notin' `<inclusion>` ::= 'in' `<value-set>` ::= '(' `<values>` ')' `<values>` ::= VALUE | VALUE ',' `<values>` `<exact-match-restriction>` ::= ['='|'=='|'!='] VALUE
+
+<a id="timeouts"></a>&#x2022; [`timeouts`](#timeouts) - Optional Block
+
+### Attributes Reference
+
+In addition to all arguments above, the following attributes are exported:
+
+<a id="id"></a>&#x2022; [`id`](#id) - Optional String<br>Unique identifier for the resource
+
+---
+
+#### Allow List
+
+An [`allow_list`](#allow-list) block supports the following:
+
+<a id="allow-list-asn-list"></a>&#x2022; [`asn_list`](#allow-list-asn-list) - Optional Block<br>ASN Match List. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer<br>See [Asn List](#allow-list-asn-list) below.
+
+<a id="allow-list-asn-set"></a>&#x2022; [`asn_set`](#allow-list-asn-set) - Optional Block<br>BGP ASN Set. Addresses that belong to the ASNs in the given bgp_asn_set The ASN is obtained by performing a lookup for the source IPv4 Address in a GeoIP DB<br>See [Asn Set](#allow-list-asn-set) below.
+
+<a id="allow-list-country-list"></a>&#x2022; [`country_list`](#allow-list-country-list) - Optional List  Defaults to `COUNTRY_NONE`<br>Possible values are `COUNTRY_NONE`, `COUNTRY_AD`, `COUNTRY_AE`, `COUNTRY_AF`, `COUNTRY_AG`, `COUNTRY_AI`, `COUNTRY_AL`, `COUNTRY_AM`, `COUNTRY_AN`, `COUNTRY_AO`, `COUNTRY_AQ`, `COUNTRY_AR`, `COUNTRY_AS`, `COUNTRY_AT`, `COUNTRY_AU`, `COUNTRY_AW`, `COUNTRY_AX`, `COUNTRY_AZ`, `COUNTRY_BA`, `COUNTRY_BB`, `COUNTRY_BD`, `COUNTRY_BE`, `COUNTRY_BF`, `COUNTRY_BG`, `COUNTRY_BH`, `COUNTRY_BI`, `COUNTRY_BJ`, `COUNTRY_BL`, `COUNTRY_BM`, `COUNTRY_BN`, `COUNTRY_BO`, `COUNTRY_BQ`, `COUNTRY_BR`, `COUNTRY_BS`, `COUNTRY_BT`, `COUNTRY_BV`, `COUNTRY_BW`, `COUNTRY_BY`, `COUNTRY_BZ`, `COUNTRY_CA`, `COUNTRY_CC`, `COUNTRY_CD`, `COUNTRY_CF`, `COUNTRY_CG`, `COUNTRY_CH`, `COUNTRY_CI`, `COUNTRY_CK`, `COUNTRY_CL`, `COUNTRY_CM`, `COUNTRY_CN`, `COUNTRY_CO`, `COUNTRY_CR`, `COUNTRY_CS`, `COUNTRY_CU`, `COUNTRY_CV`, `COUNTRY_CW`, `COUNTRY_CX`, `COUNTRY_CY`, `COUNTRY_CZ`, `COUNTRY_DE`, `COUNTRY_DJ`, `COUNTRY_DK`, `COUNTRY_DM`, `COUNTRY_DO`, `COUNTRY_DZ`, `COUNTRY_EC`, `COUNTRY_EE`, `COUNTRY_EG`, `COUNTRY_EH`, `COUNTRY_ER`, `COUNTRY_ES`, `COUNTRY_ET`, `COUNTRY_FI`, `COUNTRY_FJ`, `COUNTRY_FK`, `COUNTRY_FM`, `COUNTRY_FO`, `COUNTRY_FR`, `COUNTRY_GA`, `COUNTRY_GB`, `COUNTRY_GD`, `COUNTRY_GE`, `COUNTRY_GF`, `COUNTRY_GG`, `COUNTRY_GH`, `COUNTRY_GI`, `COUNTRY_GL`, `COUNTRY_GM`, `COUNTRY_GN`, `COUNTRY_GP`, `COUNTRY_GQ`, `COUNTRY_GR`, `COUNTRY_GS`, `COUNTRY_GT`, `COUNTRY_GU`, `COUNTRY_GW`, `COUNTRY_GY`, `COUNTRY_HK`, `COUNTRY_HM`, `COUNTRY_HN`, `COUNTRY_HR`, `COUNTRY_HT`, `COUNTRY_HU`, `COUNTRY_ID`, `COUNTRY_IE`, `COUNTRY_IL`, `COUNTRY_IM`, `COUNTRY_IN`, `COUNTRY_IO`, `COUNTRY_IQ`, `COUNTRY_IR`, `COUNTRY_IS`, `COUNTRY_IT`, `COUNTRY_JE`, `COUNTRY_JM`, `COUNTRY_JO`, `COUNTRY_JP`, `COUNTRY_KE`, `COUNTRY_KG`, `COUNTRY_KH`, `COUNTRY_KI`, `COUNTRY_KM`, `COUNTRY_KN`, `COUNTRY_KP`, `COUNTRY_KR`, `COUNTRY_KW`, `COUNTRY_KY`, `COUNTRY_KZ`, `COUNTRY_LA`, `COUNTRY_LB`, `COUNTRY_LC`, `COUNTRY_LI`, `COUNTRY_LK`, `COUNTRY_LR`, `COUNTRY_LS`, `COUNTRY_LT`, `COUNTRY_LU`, `COUNTRY_LV`, `COUNTRY_LY`, `COUNTRY_MA`, `COUNTRY_MC`, `COUNTRY_MD`, `COUNTRY_ME`, `COUNTRY_MF`, `COUNTRY_MG`, `COUNTRY_MH`, `COUNTRY_MK`, `COUNTRY_ML`, `COUNTRY_MM`, `COUNTRY_MN`, `COUNTRY_MO`, `COUNTRY_MP`, `COUNTRY_MQ`, `COUNTRY_MR`, `COUNTRY_MS`, `COUNTRY_MT`, `COUNTRY_MU`, `COUNTRY_MV`, `COUNTRY_MW`, `COUNTRY_MX`, `COUNTRY_MY`, `COUNTRY_MZ`, `COUNTRY_NA`, `COUNTRY_NC`, `COUNTRY_NE`, `COUNTRY_NF`, `COUNTRY_NG`, `COUNTRY_NI`, `COUNTRY_NL`, `COUNTRY_NO`, `COUNTRY_NP`, `COUNTRY_NR`, `COUNTRY_NU`, `COUNTRY_NZ`, `COUNTRY_OM`, `COUNTRY_PA`, `COUNTRY_PE`, `COUNTRY_PF`, `COUNTRY_PG`, `COUNTRY_PH`, `COUNTRY_PK`, `COUNTRY_PL`, `COUNTRY_PM`, `COUNTRY_PN`, `COUNTRY_PR`, `COUNTRY_PS`, `COUNTRY_PT`, `COUNTRY_PW`, `COUNTRY_PY`, `COUNTRY_QA`, `COUNTRY_RE`, `COUNTRY_RO`, `COUNTRY_RS`, `COUNTRY_RU`, `COUNTRY_RW`, `COUNTRY_SA`, `COUNTRY_SB`, `COUNTRY_SC`, `COUNTRY_SD`, `COUNTRY_SE`, `COUNTRY_SG`, `COUNTRY_SH`, `COUNTRY_SI`, `COUNTRY_SJ`, `COUNTRY_SK`, `COUNTRY_SL`, `COUNTRY_SM`, `COUNTRY_SN`, `COUNTRY_SO`, `COUNTRY_SR`, `COUNTRY_SS`, `COUNTRY_ST`, `COUNTRY_SV`, `COUNTRY_SX`, `COUNTRY_SY`, `COUNTRY_SZ`, `COUNTRY_TC`, `COUNTRY_TD`, `COUNTRY_TF`, `COUNTRY_TG`, `COUNTRY_TH`, `COUNTRY_TJ`, `COUNTRY_TK`, `COUNTRY_TL`, `COUNTRY_TM`, `COUNTRY_TN`, `COUNTRY_TO`, `COUNTRY_TR`, `COUNTRY_TT`, `COUNTRY_TV`, `COUNTRY_TW`, `COUNTRY_TZ`, `COUNTRY_UA`, `COUNTRY_UG`, `COUNTRY_UM`, `COUNTRY_US`, `COUNTRY_UY`, `COUNTRY_UZ`, `COUNTRY_VA`, `COUNTRY_VC`, `COUNTRY_VE`, `COUNTRY_VG`, `COUNTRY_VI`, `COUNTRY_VN`, `COUNTRY_VU`, `COUNTRY_WF`, `COUNTRY_WS`, `COUNTRY_XK`, `COUNTRY_XT`, `COUNTRY_YE`, `COUNTRY_YT`, `COUNTRY_ZA`, `COUNTRY_ZM`, `COUNTRY_ZW`<br>[Enum: COUNTRY_NONE|COUNTRY_AD|COUNTRY_AE|COUNTRY_AF|COUNTRY_AG|COUNTRY_AI|COUNTRY_AL|COUNTRY_AM|COUNTRY_AN|COUNTRY_AO|COUNTRY_AQ|COUNTRY_AR|COUNTRY_AS|COUNTRY_AT|COUNTRY_AU|COUNTRY_AW|COUNTRY_AX|COUNTRY_AZ|COUNTRY_BA|COUNTRY_BB|COUNTRY_BD|COUNTRY_BE|COUNTRY_BF|COUNTRY_BG|COUNTRY_BH|COUNTRY_BI|COUNTRY_BJ|COUNTRY_BL|COUNTRY_BM|COUNTRY_BN|COUNTRY_BO|COUNTRY_BQ|COUNTRY_BR|COUNTRY_BS|COUNTRY_BT|COUNTRY_BV|COUNTRY_BW|COUNTRY_BY|COUNTRY_BZ|COUNTRY_CA|COUNTRY_CC|COUNTRY_CD|COUNTRY_CF|COUNTRY_CG|COUNTRY_CH|COUNTRY_CI|COUNTRY_CK|COUNTRY_CL|COUNTRY_CM|COUNTRY_CN|COUNTRY_CO|COUNTRY_CR|COUNTRY_CS|COUNTRY_CU|COUNTRY_CV|COUNTRY_CW|COUNTRY_CX|COUNTRY_CY|COUNTRY_CZ|COUNTRY_DE|COUNTRY_DJ|COUNTRY_DK|COUNTRY_DM|COUNTRY_DO|COUNTRY_DZ|COUNTRY_EC|COUNTRY_EE|COUNTRY_EG|COUNTRY_EH|COUNTRY_ER|COUNTRY_ES|COUNTRY_ET|COUNTRY_FI|COUNTRY_FJ|COUNTRY_FK|COUNTRY_FM|COUNTRY_FO|COUNTRY_FR|COUNTRY_GA|COUNTRY_GB|COUNTRY_GD|COUNTRY_GE|COUNTRY_GF|COUNTRY_GG|COUNTRY_GH|COUNTRY_GI|COUNTRY_GL|COUNTRY_GM|COUNTRY_GN|COUNTRY_GP|COUNTRY_GQ|COUNTRY_GR|COUNTRY_GS|COUNTRY_GT|COUNTRY_GU|COUNTRY_GW|COUNTRY_GY|COUNTRY_HK|COUNTRY_HM|COUNTRY_HN|COUNTRY_HR|COUNTRY_HT|COUNTRY_HU|COUNTRY_ID|COUNTRY_IE|COUNTRY_IL|COUNTRY_IM|COUNTRY_IN|COUNTRY_IO|COUNTRY_IQ|COUNTRY_IR|COUNTRY_IS|COUNTRY_IT|COUNTRY_JE|COUNTRY_JM|COUNTRY_JO|COUNTRY_JP|COUNTRY_KE|COUNTRY_KG|COUNTRY_KH|COUNTRY_KI|COUNTRY_KM|COUNTRY_KN|COUNTRY_KP|COUNTRY_KR|COUNTRY_KW|COUNTRY_KY|COUNTRY_KZ|COUNTRY_LA|COUNTRY_LB|COUNTRY_LC|COUNTRY_LI|COUNTRY_LK|COUNTRY_LR|COUNTRY_LS|COUNTRY_LT|COUNTRY_LU|COUNTRY_LV|COUNTRY_LY|COUNTRY_MA|COUNTRY_MC|COUNTRY_MD|COUNTRY_ME|COUNTRY_MF|COUNTRY_MG|COUNTRY_MH|COUNTRY_MK|COUNTRY_ML|COUNTRY_MM|COUNTRY_MN|COUNTRY_MO|COUNTRY_MP|COUNTRY_MQ|COUNTRY_MR|COUNTRY_MS|COUNTRY_MT|COUNTRY_MU|COUNTRY_MV|COUNTRY_MW|COUNTRY_MX|COUNTRY_MY|COUNTRY_MZ|COUNTRY_NA|COUNTRY_NC|COUNTRY_NE|COUNTRY_NF|COUNTRY_NG|COUNTRY_NI|COUNTRY_NL|COUNTRY_NO|COUNTRY_NP|COUNTRY_NR|COUNTRY_NU|COUNTRY_NZ|COUNTRY_OM|COUNTRY_PA|COUNTRY_PE|COUNTRY_PF|COUNTRY_PG|COUNTRY_PH|COUNTRY_PK|COUNTRY_PL|COUNTRY_PM|COUNTRY_PN|COUNTRY_PR|COUNTRY_PS|COUNTRY_PT|COUNTRY_PW|COUNTRY_PY|COUNTRY_QA|COUNTRY_RE|COUNTRY_RO|COUNTRY_RS|COUNTRY_RU|COUNTRY_RW|COUNTRY_SA|COUNTRY_SB|COUNTRY_SC|COUNTRY_SD|COUNTRY_SE|COUNTRY_SG|COUNTRY_SH|COUNTRY_SI|COUNTRY_SJ|COUNTRY_SK|COUNTRY_SL|COUNTRY_SM|COUNTRY_SN|COUNTRY_SO|COUNTRY_SR|COUNTRY_SS|COUNTRY_ST|COUNTRY_SV|COUNTRY_SX|COUNTRY_SY|COUNTRY_SZ|COUNTRY_TC|COUNTRY_TD|COUNTRY_TF|COUNTRY_TG|COUNTRY_TH|COUNTRY_TJ|COUNTRY_TK|COUNTRY_TL|COUNTRY_TM|COUNTRY_TN|COUNTRY_TO|COUNTRY_TR|COUNTRY_TT|COUNTRY_TV|COUNTRY_TW|COUNTRY_TZ|COUNTRY_UA|COUNTRY_UG|COUNTRY_UM|COUNTRY_US|COUNTRY_UY|COUNTRY_UZ|COUNTRY_VA|COUNTRY_VC|COUNTRY_VE|COUNTRY_VG|COUNTRY_VI|COUNTRY_VN|COUNTRY_VU|COUNTRY_WF|COUNTRY_WS|COUNTRY_XK|COUNTRY_XT|COUNTRY_YE|COUNTRY_YT|COUNTRY_ZA|COUNTRY_ZM|COUNTRY_ZW] Country List. Addresses that belong to one of the countries in the given list The country is obtained by performing a lookup for the source IPv4 Address in a GeoIP DB
+
+<a id="allow-list-default-action-allow"></a>&#x2022; [`default_action_allow`](#allow-list-default-action-allow) - Optional Block<br>Enable this option
+
+<a id="allow-list-default-action-deny"></a>&#x2022; [`default_action_deny`](#allow-list-default-action-deny) - Optional Block<br>Enable this option
+
+<a id="allow-list-default-action-next-policy"></a>&#x2022; [`default_action_next_policy`](#allow-list-default-action-next-policy) - Optional Block<br>Enable this option
+
+<a id="allow-list-ip-prefix-set"></a>&#x2022; [`ip_prefix_set`](#allow-list-ip-prefix-set) - Optional Block<br>IP Prefix Set. Addresses that are covered by the prefixes in the given ip_prefix_set<br>See [IP Prefix Set](#allow-list-ip-prefix-set) below.
+
+<a id="allow-list-prefix-list"></a>&#x2022; [`prefix_list`](#allow-list-prefix-list) - Optional Block<br>IPv4 Prefix List. List of IPv4 prefixes that represent an endpoint<br>See [Prefix List](#allow-list-prefix-list) below.
+
+<a id="allow-list-tls-fingerprint-classes"></a>&#x2022; [`tls_fingerprint_classes`](#allow-list-tls-fingerprint-classes) - Optional List  Defaults to `TLS_FINGERPRINT_NONE`<br>Possible values are `TLS_FINGERPRINT_NONE`, `ANY_MALICIOUS_FINGERPRINT`, `ADWARE`, `ADWIND`, `DRIDEX`, `GOOTKIT`, `GOZI`, `JBIFROST`, `QUAKBOT`, `RANSOMWARE`, `TROLDESH`, `TOFSEE`, `TORRENTLOCKER`, `TRICKBOT`<br>[Enum: TLS_FINGERPRINT_NONE|ANY_MALICIOUS_FINGERPRINT|ADWARE|ADWIND|DRIDEX|GOOTKIT|GOZI|JBIFROST|QUAKBOT|RANSOMWARE|TROLDESH|TOFSEE|TORRENTLOCKER|TRICKBOT] TLS Fingerprint Classes. A list of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against
+
+<a id="allow-list-tls-fingerprint-values"></a>&#x2022; [`tls_fingerprint_values`](#allow-list-tls-fingerprint-values) - Optional List<br>TLS Fingerprint Values. A list of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against
+
+#### Allow List Asn List
+
+An [`asn_list`](#allow-list-asn-list) block (within [`allow_list`](#allow-list)) supports the following:
+
+<a id="allow-list-asn-list-as-numbers"></a>&#x2022; [`as_numbers`](#allow-list-asn-list-as-numbers) - Optional List<br>AS Numbers. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer
+
+#### Allow List Asn Set
+
+An [`asn_set`](#allow-list-asn-set) block (within [`allow_list`](#allow-list)) supports the following:
+
+<a id="allow-list-asn-set-name"></a>&#x2022; [`name`](#allow-list-asn-set-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="allow-list-asn-set-namespace"></a>&#x2022; [`namespace`](#allow-list-asn-set-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="allow-list-asn-set-tenant"></a>&#x2022; [`tenant`](#allow-list-asn-set-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Allow List IP Prefix Set
+
+An [`ip_prefix_set`](#allow-list-ip-prefix-set) block (within [`allow_list`](#allow-list)) supports the following:
+
+<a id="allow-list-ip-prefix-set-name"></a>&#x2022; [`name`](#allow-list-ip-prefix-set-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="allow-list-ip-prefix-set-namespace"></a>&#x2022; [`namespace`](#allow-list-ip-prefix-set-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="allow-list-ip-prefix-set-tenant"></a>&#x2022; [`tenant`](#allow-list-ip-prefix-set-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Allow List Prefix List
+
+A [`prefix_list`](#allow-list-prefix-list) block (within [`allow_list`](#allow-list)) supports the following:
+
+<a id="allow-list-prefix-list-prefixes"></a>&#x2022; [`prefixes`](#allow-list-prefix-list-prefixes) - Optional List<br>IPv4 Prefix List. List of IPv4 prefixes that represent an endpoint
+
+#### Deny List
+
+A [`deny_list`](#deny-list) block supports the following:
+
+<a id="deny-list-asn-list"></a>&#x2022; [`asn_list`](#deny-list-asn-list) - Optional Block<br>ASN Match List. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer<br>See [Asn List](#deny-list-asn-list) below.
+
+<a id="deny-list-asn-set"></a>&#x2022; [`asn_set`](#deny-list-asn-set) - Optional Block<br>BGP ASN Set. Addresses that belong to the ASNs in the given bgp_asn_set The ASN is obtained by performing a lookup for the source IPv4 Address in a GeoIP DB<br>See [Asn Set](#deny-list-asn-set) below.
+
+<a id="deny-list-country-list"></a>&#x2022; [`country_list`](#deny-list-country-list) - Optional List  Defaults to `COUNTRY_NONE`<br>Possible values are `COUNTRY_NONE`, `COUNTRY_AD`, `COUNTRY_AE`, `COUNTRY_AF`, `COUNTRY_AG`, `COUNTRY_AI`, `COUNTRY_AL`, `COUNTRY_AM`, `COUNTRY_AN`, `COUNTRY_AO`, `COUNTRY_AQ`, `COUNTRY_AR`, `COUNTRY_AS`, `COUNTRY_AT`, `COUNTRY_AU`, `COUNTRY_AW`, `COUNTRY_AX`, `COUNTRY_AZ`, `COUNTRY_BA`, `COUNTRY_BB`, `COUNTRY_BD`, `COUNTRY_BE`, `COUNTRY_BF`, `COUNTRY_BG`, `COUNTRY_BH`, `COUNTRY_BI`, `COUNTRY_BJ`, `COUNTRY_BL`, `COUNTRY_BM`, `COUNTRY_BN`, `COUNTRY_BO`, `COUNTRY_BQ`, `COUNTRY_BR`, `COUNTRY_BS`, `COUNTRY_BT`, `COUNTRY_BV`, `COUNTRY_BW`, `COUNTRY_BY`, `COUNTRY_BZ`, `COUNTRY_CA`, `COUNTRY_CC`, `COUNTRY_CD`, `COUNTRY_CF`, `COUNTRY_CG`, `COUNTRY_CH`, `COUNTRY_CI`, `COUNTRY_CK`, `COUNTRY_CL`, `COUNTRY_CM`, `COUNTRY_CN`, `COUNTRY_CO`, `COUNTRY_CR`, `COUNTRY_CS`, `COUNTRY_CU`, `COUNTRY_CV`, `COUNTRY_CW`, `COUNTRY_CX`, `COUNTRY_CY`, `COUNTRY_CZ`, `COUNTRY_DE`, `COUNTRY_DJ`, `COUNTRY_DK`, `COUNTRY_DM`, `COUNTRY_DO`, `COUNTRY_DZ`, `COUNTRY_EC`, `COUNTRY_EE`, `COUNTRY_EG`, `COUNTRY_EH`, `COUNTRY_ER`, `COUNTRY_ES`, `COUNTRY_ET`, `COUNTRY_FI`, `COUNTRY_FJ`, `COUNTRY_FK`, `COUNTRY_FM`, `COUNTRY_FO`, `COUNTRY_FR`, `COUNTRY_GA`, `COUNTRY_GB`, `COUNTRY_GD`, `COUNTRY_GE`, `COUNTRY_GF`, `COUNTRY_GG`, `COUNTRY_GH`, `COUNTRY_GI`, `COUNTRY_GL`, `COUNTRY_GM`, `COUNTRY_GN`, `COUNTRY_GP`, `COUNTRY_GQ`, `COUNTRY_GR`, `COUNTRY_GS`, `COUNTRY_GT`, `COUNTRY_GU`, `COUNTRY_GW`, `COUNTRY_GY`, `COUNTRY_HK`, `COUNTRY_HM`, `COUNTRY_HN`, `COUNTRY_HR`, `COUNTRY_HT`, `COUNTRY_HU`, `COUNTRY_ID`, `COUNTRY_IE`, `COUNTRY_IL`, `COUNTRY_IM`, `COUNTRY_IN`, `COUNTRY_IO`, `COUNTRY_IQ`, `COUNTRY_IR`, `COUNTRY_IS`, `COUNTRY_IT`, `COUNTRY_JE`, `COUNTRY_JM`, `COUNTRY_JO`, `COUNTRY_JP`, `COUNTRY_KE`, `COUNTRY_KG`, `COUNTRY_KH`, `COUNTRY_KI`, `COUNTRY_KM`, `COUNTRY_KN`, `COUNTRY_KP`, `COUNTRY_KR`, `COUNTRY_KW`, `COUNTRY_KY`, `COUNTRY_KZ`, `COUNTRY_LA`, `COUNTRY_LB`, `COUNTRY_LC`, `COUNTRY_LI`, `COUNTRY_LK`, `COUNTRY_LR`, `COUNTRY_LS`, `COUNTRY_LT`, `COUNTRY_LU`, `COUNTRY_LV`, `COUNTRY_LY`, `COUNTRY_MA`, `COUNTRY_MC`, `COUNTRY_MD`, `COUNTRY_ME`, `COUNTRY_MF`, `COUNTRY_MG`, `COUNTRY_MH`, `COUNTRY_MK`, `COUNTRY_ML`, `COUNTRY_MM`, `COUNTRY_MN`, `COUNTRY_MO`, `COUNTRY_MP`, `COUNTRY_MQ`, `COUNTRY_MR`, `COUNTRY_MS`, `COUNTRY_MT`, `COUNTRY_MU`, `COUNTRY_MV`, `COUNTRY_MW`, `COUNTRY_MX`, `COUNTRY_MY`, `COUNTRY_MZ`, `COUNTRY_NA`, `COUNTRY_NC`, `COUNTRY_NE`, `COUNTRY_NF`, `COUNTRY_NG`, `COUNTRY_NI`, `COUNTRY_NL`, `COUNTRY_NO`, `COUNTRY_NP`, `COUNTRY_NR`, `COUNTRY_NU`, `COUNTRY_NZ`, `COUNTRY_OM`, `COUNTRY_PA`, `COUNTRY_PE`, `COUNTRY_PF`, `COUNTRY_PG`, `COUNTRY_PH`, `COUNTRY_PK`, `COUNTRY_PL`, `COUNTRY_PM`, `COUNTRY_PN`, `COUNTRY_PR`, `COUNTRY_PS`, `COUNTRY_PT`, `COUNTRY_PW`, `COUNTRY_PY`, `COUNTRY_QA`, `COUNTRY_RE`, `COUNTRY_RO`, `COUNTRY_RS`, `COUNTRY_RU`, `COUNTRY_RW`, `COUNTRY_SA`, `COUNTRY_SB`, `COUNTRY_SC`, `COUNTRY_SD`, `COUNTRY_SE`, `COUNTRY_SG`, `COUNTRY_SH`, `COUNTRY_SI`, `COUNTRY_SJ`, `COUNTRY_SK`, `COUNTRY_SL`, `COUNTRY_SM`, `COUNTRY_SN`, `COUNTRY_SO`, `COUNTRY_SR`, `COUNTRY_SS`, `COUNTRY_ST`, `COUNTRY_SV`, `COUNTRY_SX`, `COUNTRY_SY`, `COUNTRY_SZ`, `COUNTRY_TC`, `COUNTRY_TD`, `COUNTRY_TF`, `COUNTRY_TG`, `COUNTRY_TH`, `COUNTRY_TJ`, `COUNTRY_TK`, `COUNTRY_TL`, `COUNTRY_TM`, `COUNTRY_TN`, `COUNTRY_TO`, `COUNTRY_TR`, `COUNTRY_TT`, `COUNTRY_TV`, `COUNTRY_TW`, `COUNTRY_TZ`, `COUNTRY_UA`, `COUNTRY_UG`, `COUNTRY_UM`, `COUNTRY_US`, `COUNTRY_UY`, `COUNTRY_UZ`, `COUNTRY_VA`, `COUNTRY_VC`, `COUNTRY_VE`, `COUNTRY_VG`, `COUNTRY_VI`, `COUNTRY_VN`, `COUNTRY_VU`, `COUNTRY_WF`, `COUNTRY_WS`, `COUNTRY_XK`, `COUNTRY_XT`, `COUNTRY_YE`, `COUNTRY_YT`, `COUNTRY_ZA`, `COUNTRY_ZM`, `COUNTRY_ZW`<br>[Enum: COUNTRY_NONE|COUNTRY_AD|COUNTRY_AE|COUNTRY_AF|COUNTRY_AG|COUNTRY_AI|COUNTRY_AL|COUNTRY_AM|COUNTRY_AN|COUNTRY_AO|COUNTRY_AQ|COUNTRY_AR|COUNTRY_AS|COUNTRY_AT|COUNTRY_AU|COUNTRY_AW|COUNTRY_AX|COUNTRY_AZ|COUNTRY_BA|COUNTRY_BB|COUNTRY_BD|COUNTRY_BE|COUNTRY_BF|COUNTRY_BG|COUNTRY_BH|COUNTRY_BI|COUNTRY_BJ|COUNTRY_BL|COUNTRY_BM|COUNTRY_BN|COUNTRY_BO|COUNTRY_BQ|COUNTRY_BR|COUNTRY_BS|COUNTRY_BT|COUNTRY_BV|COUNTRY_BW|COUNTRY_BY|COUNTRY_BZ|COUNTRY_CA|COUNTRY_CC|COUNTRY_CD|COUNTRY_CF|COUNTRY_CG|COUNTRY_CH|COUNTRY_CI|COUNTRY_CK|COUNTRY_CL|COUNTRY_CM|COUNTRY_CN|COUNTRY_CO|COUNTRY_CR|COUNTRY_CS|COUNTRY_CU|COUNTRY_CV|COUNTRY_CW|COUNTRY_CX|COUNTRY_CY|COUNTRY_CZ|COUNTRY_DE|COUNTRY_DJ|COUNTRY_DK|COUNTRY_DM|COUNTRY_DO|COUNTRY_DZ|COUNTRY_EC|COUNTRY_EE|COUNTRY_EG|COUNTRY_EH|COUNTRY_ER|COUNTRY_ES|COUNTRY_ET|COUNTRY_FI|COUNTRY_FJ|COUNTRY_FK|COUNTRY_FM|COUNTRY_FO|COUNTRY_FR|COUNTRY_GA|COUNTRY_GB|COUNTRY_GD|COUNTRY_GE|COUNTRY_GF|COUNTRY_GG|COUNTRY_GH|COUNTRY_GI|COUNTRY_GL|COUNTRY_GM|COUNTRY_GN|COUNTRY_GP|COUNTRY_GQ|COUNTRY_GR|COUNTRY_GS|COUNTRY_GT|COUNTRY_GU|COUNTRY_GW|COUNTRY_GY|COUNTRY_HK|COUNTRY_HM|COUNTRY_HN|COUNTRY_HR|COUNTRY_HT|COUNTRY_HU|COUNTRY_ID|COUNTRY_IE|COUNTRY_IL|COUNTRY_IM|COUNTRY_IN|COUNTRY_IO|COUNTRY_IQ|COUNTRY_IR|COUNTRY_IS|COUNTRY_IT|COUNTRY_JE|COUNTRY_JM|COUNTRY_JO|COUNTRY_JP|COUNTRY_KE|COUNTRY_KG|COUNTRY_KH|COUNTRY_KI|COUNTRY_KM|COUNTRY_KN|COUNTRY_KP|COUNTRY_KR|COUNTRY_KW|COUNTRY_KY|COUNTRY_KZ|COUNTRY_LA|COUNTRY_LB|COUNTRY_LC|COUNTRY_LI|COUNTRY_LK|COUNTRY_LR|COUNTRY_LS|COUNTRY_LT|COUNTRY_LU|COUNTRY_LV|COUNTRY_LY|COUNTRY_MA|COUNTRY_MC|COUNTRY_MD|COUNTRY_ME|COUNTRY_MF|COUNTRY_MG|COUNTRY_MH|COUNTRY_MK|COUNTRY_ML|COUNTRY_MM|COUNTRY_MN|COUNTRY_MO|COUNTRY_MP|COUNTRY_MQ|COUNTRY_MR|COUNTRY_MS|COUNTRY_MT|COUNTRY_MU|COUNTRY_MV|COUNTRY_MW|COUNTRY_MX|COUNTRY_MY|COUNTRY_MZ|COUNTRY_NA|COUNTRY_NC|COUNTRY_NE|COUNTRY_NF|COUNTRY_NG|COUNTRY_NI|COUNTRY_NL|COUNTRY_NO|COUNTRY_NP|COUNTRY_NR|COUNTRY_NU|COUNTRY_NZ|COUNTRY_OM|COUNTRY_PA|COUNTRY_PE|COUNTRY_PF|COUNTRY_PG|COUNTRY_PH|COUNTRY_PK|COUNTRY_PL|COUNTRY_PM|COUNTRY_PN|COUNTRY_PR|COUNTRY_PS|COUNTRY_PT|COUNTRY_PW|COUNTRY_PY|COUNTRY_QA|COUNTRY_RE|COUNTRY_RO|COUNTRY_RS|COUNTRY_RU|COUNTRY_RW|COUNTRY_SA|COUNTRY_SB|COUNTRY_SC|COUNTRY_SD|COUNTRY_SE|COUNTRY_SG|COUNTRY_SH|COUNTRY_SI|COUNTRY_SJ|COUNTRY_SK|COUNTRY_SL|COUNTRY_SM|COUNTRY_SN|COUNTRY_SO|COUNTRY_SR|COUNTRY_SS|COUNTRY_ST|COUNTRY_SV|COUNTRY_SX|COUNTRY_SY|COUNTRY_SZ|COUNTRY_TC|COUNTRY_TD|COUNTRY_TF|COUNTRY_TG|COUNTRY_TH|COUNTRY_TJ|COUNTRY_TK|COUNTRY_TL|COUNTRY_TM|COUNTRY_TN|COUNTRY_TO|COUNTRY_TR|COUNTRY_TT|COUNTRY_TV|COUNTRY_TW|COUNTRY_TZ|COUNTRY_UA|COUNTRY_UG|COUNTRY_UM|COUNTRY_US|COUNTRY_UY|COUNTRY_UZ|COUNTRY_VA|COUNTRY_VC|COUNTRY_VE|COUNTRY_VG|COUNTRY_VI|COUNTRY_VN|COUNTRY_VU|COUNTRY_WF|COUNTRY_WS|COUNTRY_XK|COUNTRY_XT|COUNTRY_YE|COUNTRY_YT|COUNTRY_ZA|COUNTRY_ZM|COUNTRY_ZW] Country List. Addresses that belong to one of the countries in the given list The country is obtained by performing a lookup for the source IPv4 Address in a GeoIP DB
+
+<a id="deny-list-default-action-allow"></a>&#x2022; [`default_action_allow`](#deny-list-default-action-allow) - Optional Block<br>Enable this option
+
+<a id="deny-list-default-action-deny"></a>&#x2022; [`default_action_deny`](#deny-list-default-action-deny) - Optional Block<br>Enable this option
+
+<a id="deny-list-default-action-next-policy"></a>&#x2022; [`default_action_next_policy`](#deny-list-default-action-next-policy) - Optional Block<br>Enable this option
+
+<a id="deny-list-ip-prefix-set"></a>&#x2022; [`ip_prefix_set`](#deny-list-ip-prefix-set) - Optional Block<br>IP Prefix Set. Addresses that are covered by the prefixes in the given ip_prefix_set<br>See [IP Prefix Set](#deny-list-ip-prefix-set) below.
+
+<a id="deny-list-prefix-list"></a>&#x2022; [`prefix_list`](#deny-list-prefix-list) - Optional Block<br>IPv4 Prefix List. List of IPv4 prefixes that represent an endpoint<br>See [Prefix List](#deny-list-prefix-list) below.
+
+<a id="deny-list-tls-fingerprint-classes"></a>&#x2022; [`tls_fingerprint_classes`](#deny-list-tls-fingerprint-classes) - Optional List  Defaults to `TLS_FINGERPRINT_NONE`<br>Possible values are `TLS_FINGERPRINT_NONE`, `ANY_MALICIOUS_FINGERPRINT`, `ADWARE`, `ADWIND`, `DRIDEX`, `GOOTKIT`, `GOZI`, `JBIFROST`, `QUAKBOT`, `RANSOMWARE`, `TROLDESH`, `TOFSEE`, `TORRENTLOCKER`, `TRICKBOT`<br>[Enum: TLS_FINGERPRINT_NONE|ANY_MALICIOUS_FINGERPRINT|ADWARE|ADWIND|DRIDEX|GOOTKIT|GOZI|JBIFROST|QUAKBOT|RANSOMWARE|TROLDESH|TOFSEE|TORRENTLOCKER|TRICKBOT] TLS Fingerprint Classes. A list of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against
+
+<a id="deny-list-tls-fingerprint-values"></a>&#x2022; [`tls_fingerprint_values`](#deny-list-tls-fingerprint-values) - Optional List<br>TLS Fingerprint Values. A list of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against
+
+#### Deny List Asn List
+
+An [`asn_list`](#deny-list-asn-list) block (within [`deny_list`](#deny-list)) supports the following:
+
+<a id="deny-list-asn-list-as-numbers"></a>&#x2022; [`as_numbers`](#deny-list-asn-list-as-numbers) - Optional List<br>AS Numbers. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer
+
+#### Deny List Asn Set
+
+An [`asn_set`](#deny-list-asn-set) block (within [`deny_list`](#deny-list)) supports the following:
+
+<a id="deny-list-asn-set-name"></a>&#x2022; [`name`](#deny-list-asn-set-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="deny-list-asn-set-namespace"></a>&#x2022; [`namespace`](#deny-list-asn-set-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="deny-list-asn-set-tenant"></a>&#x2022; [`tenant`](#deny-list-asn-set-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Deny List IP Prefix Set
+
+An [`ip_prefix_set`](#deny-list-ip-prefix-set) block (within [`deny_list`](#deny-list)) supports the following:
+
+<a id="deny-list-ip-prefix-set-name"></a>&#x2022; [`name`](#deny-list-ip-prefix-set-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="deny-list-ip-prefix-set-namespace"></a>&#x2022; [`namespace`](#deny-list-ip-prefix-set-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="deny-list-ip-prefix-set-tenant"></a>&#x2022; [`tenant`](#deny-list-ip-prefix-set-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Deny List Prefix List
+
+A [`prefix_list`](#deny-list-prefix-list) block (within [`deny_list`](#deny-list)) supports the following:
+
+<a id="deny-list-prefix-list-prefixes"></a>&#x2022; [`prefixes`](#deny-list-prefix-list-prefixes) - Optional List<br>IPv4 Prefix List. List of IPv4 prefixes that represent an endpoint
+
+#### Rule List
+
+A [`rule_list`](#rule-list) block supports the following:
+
+<a id="rule-list-rules"></a>&#x2022; [`rules`](#rule-list-rules) - Optional Block<br>Rules. Define the list of rules (with an order) that should be evaluated by this service policy. Rules are evaluated from top to bottom in the list<br>See [Rules](#rule-list-rules) below.
+
+#### Rule List Rules
+
+A [`rules`](#rule-list-rules) block (within [`rule_list`](#rule-list)) supports the following:
+
+<a id="rule-list-rules-metadata"></a>&#x2022; [`metadata`](#rule-list-rules-metadata) - Optional Block<br>Message Metadata. MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create and replace APIs<br>See [Metadata](#rule-list-rules-metadata) below.
+
+<a id="rule-list-rules-spec"></a>&#x2022; [`spec`](#rule-list-rules-spec) - Optional Block<br>Specification. Shape of service_policy_rule in the storage backend<br>See [Spec](#rule-list-rules-spec) below.
+
+#### Rule List Rules Metadata
+
+A [`metadata`](#rule-list-rules-metadata) block (within [`rule_list.rules`](#rule-list-rules)) supports the following:
+
+<a id="rule-list-rules-metadata-description-spec"></a>&#x2022; [`description_spec`](#rule-list-rules-metadata-description-spec) - Optional String<br>Description. Human readable description
+
+<a id="rule-list-rules-metadata-name"></a>&#x2022; [`name`](#rule-list-rules-metadata-name) - Optional String<br>Name. This is the name of the message. The value of name has to follow DNS-1035 format
+
+#### Rule List Rules Spec
+
+A [`spec`](#rule-list-rules-spec) block (within [`rule_list.rules`](#rule-list-rules)) supports the following:
+
+<a id="rule-list-rules-spec-action"></a>&#x2022; [`action`](#rule-list-rules-spec-action) - Optional String  Defaults to `DENY`<br>Possible values are `DENY`, `ALLOW`, `NEXT_POLICY`<br>[Enum: DENY|ALLOW|NEXT_POLICY] Rule Action. The rule action determines the disposition of the input request API. If a policy matches a rule with an ALLOW action, the processing of the request proceeds forward. If it matches a rule with a DENY action, the processing of the request is terminated and an appropriate message/code returned to the originator. If it matches a rule with a NEXT_POLICY_SET action, evaluation of the current policy set terminates and evaluation of the next policy set in the chain begins. - DENY: DENY Deny the request. - ALLOW: ALLOW Allow the request to proceed. - NEXT_POLICY_SET: NEXT_POLICY_SET Terminate evaluation of the current policy set and begin evaluating the next policy set in the chain. Note that the evaluation of any remaining policies in the current policy set is skipped. - NEXT_POLICY: NEXT_POLICY Terminate evaluation of the current policy and begin evaluating the next policy in the policy set. Note that the evaluation of any remaining rules in the current policy is skipped. - LAST_POLICY: LAST_POLICY Terminate evaluation of the current policy and begin evaluating the last policy in the policy set. Note that the evaluation of any remaining rules in the current policy is skipped. - GOTO_POLICY: GOTO_POLICY Terminate evaluation of the current policy and begin evaluating a specific policy in the policy set. The policy is specified using the goto_policy field in the rule and must be after the current policy in the policy set
+
+<a id="rule-list-rules-spec-any-asn"></a>&#x2022; [`any_asn`](#rule-list-rules-spec-any-asn) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-any-client"></a>&#x2022; [`any_client`](#rule-list-rules-spec-any-client) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-any-ip"></a>&#x2022; [`any_ip`](#rule-list-rules-spec-any-ip) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-api-group-matcher"></a>&#x2022; [`api_group_matcher`](#rule-list-rules-spec-api-group-matcher) - Optional Block<br>String Matcher. A matcher specifies a list of values for matching an input string. The match is considered successful if the input value is present in the list. The result of the match is inverted if invert_matcher is true<br>See [API Group Matcher](#rule-list-rules-spec-api-group-matcher) below.
+
+<a id="rule-list-rules-spec-arg-matchers"></a>&#x2022; [`arg_matchers`](#rule-list-rules-spec-arg-matchers) - Optional Block<br>Argument Matchers. A list of predicates for all POST args that need to be matched. The criteria for matching each arg are described in individual instances of ArgMatcherType. The actual arg values are extracted from the request API as a list of strings for each arg selector name. Note that all specified arg matcher predicates must evaluate to true<br>See [Arg Matchers](#rule-list-rules-spec-arg-matchers) below.
+
+<a id="rule-list-rules-spec-asn-list"></a>&#x2022; [`asn_list`](#rule-list-rules-spec-asn-list) - Optional Block<br>ASN Match List. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer<br>See [Asn List](#rule-list-rules-spec-asn-list) below.
+
+<a id="rule-list-rules-spec-asn-matcher"></a>&#x2022; [`asn_matcher`](#rule-list-rules-spec-asn-matcher) - Optional Block<br>ASN Matcher. Match any AS number contained in the list of bgp_asn_sets<br>See [Asn Matcher](#rule-list-rules-spec-asn-matcher) below.
+
+<a id="rule-list-rules-spec-body-matcher"></a>&#x2022; [`body_matcher`](#rule-list-rules-spec-body-matcher) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Body Matcher](#rule-list-rules-spec-body-matcher) below.
+
+<a id="rule-list-rules-spec-bot-action"></a>&#x2022; [`bot_action`](#rule-list-rules-spec-bot-action) - Optional Block<br>Bot Action. Modify Bot protection behavior for a matching request. The modification could be to entirely skip Bot processing<br>See [Bot Action](#rule-list-rules-spec-bot-action) below.
+
+<a id="rule-list-rules-spec-client-name"></a>&#x2022; [`client_name`](#rule-list-rules-spec-client-name) - Optional String<br>Client Name. The expected name of the client invoking the request API. The predicate evaluates to true if any of the actual names is the same as the expected client name
+
+<a id="rule-list-rules-spec-client-name-matcher"></a>&#x2022; [`client_name_matcher`](#rule-list-rules-spec-client-name-matcher) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Client Name Matcher](#rule-list-rules-spec-client-name-matcher) below.
+
+<a id="rule-list-rules-spec-client-selector"></a>&#x2022; [`client_selector`](#rule-list-rules-spec-client-selector) - Optional Block<br>Label Selector. This type can be used to establish a 'selector reference' from one object(called selector) to a set of other objects(called selectees) based on the value of expresssions. A label selector is a label query over a set of resources. An empty label selector matches all objects. A null label selector matches no objects. Label selector is immutable. expressions is a list of strings of label selection expression. Each string has ',' separated values which are 'AND' and all strings are logically 'OR'. BNF for expression string `<selector-syntax>` ::= `<requirement>` | `<requirement>` ',' `<selector-syntax>` `<requirement>` ::= [!] KEY [ `<set-based-restriction>` | `<exact-match-restriction>` ] `<set-based-restriction>` ::= '' | `<inclusion-exclusion>` `<value-set>` `<inclusion-exclusion>` ::= `<inclusion>` | `<exclusion>` `<exclusion>` ::= 'notin' `<inclusion>` ::= 'in' `<value-set>` ::= '(' `<values>` ')' `<values>` ::= VALUE | VALUE ',' `<values>` `<exact-match-restriction>` ::= ['='|'=='|'!='] VALUE<br>See [Client Selector](#rule-list-rules-spec-client-selector) below.
+
+<a id="rule-list-rules-spec-cookie-matchers"></a>&#x2022; [`cookie_matchers`](#rule-list-rules-spec-cookie-matchers) - Optional Block<br>Cookie Matchers. A list of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances of CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name. Note that all specified cookie matcher predicates must evaluate to true<br>See [Cookie Matchers](#rule-list-rules-spec-cookie-matchers) below.
+
+<a id="rule-list-rules-spec-domain-matcher"></a>&#x2022; [`domain_matcher`](#rule-list-rules-spec-domain-matcher) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Domain Matcher](#rule-list-rules-spec-domain-matcher) below.
+
+<a id="rule-list-rules-spec-expiration-timestamp"></a>&#x2022; [`expiration_timestamp`](#rule-list-rules-spec-expiration-timestamp) - Optional String<br>Expiration Timestamp. The expiration_timestamp is the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore
+
+<a id="rule-list-rules-spec-headers"></a>&#x2022; [`headers`](#rule-list-rules-spec-headers) - Optional Block<br>HTTP Headers. A list of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType instances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type. Note that all specified header predicates must evaluate to true<br>See [Headers](#rule-list-rules-spec-headers) below.
+
+<a id="rule-list-rules-spec-http-method"></a>&#x2022; [`http_method`](#rule-list-rules-spec-http-method) - Optional Block<br>HTTP Method Matcher. A HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list. The result of the match based on the method list is inverted if invert_matcher is true<br>See [HTTP Method](#rule-list-rules-spec-http-method) below.
+
+<a id="rule-list-rules-spec-ip-matcher"></a>&#x2022; [`ip_matcher`](#rule-list-rules-spec-ip-matcher) - Optional Block<br>IP Prefix Matcher. Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true<br>See [IP Matcher](#rule-list-rules-spec-ip-matcher) below.
+
+<a id="rule-list-rules-spec-ip-prefix-list"></a>&#x2022; [`ip_prefix_list`](#rule-list-rules-spec-ip-prefix-list) - Optional Block<br>IP Prefix Match List. List of IP Prefix strings to match against<br>See [IP Prefix List](#rule-list-rules-spec-ip-prefix-list) below.
+
+<a id="rule-list-rules-spec-ip-threat-category-list"></a>&#x2022; [`ip_threat_category_list`](#rule-list-rules-spec-ip-threat-category-list) - Optional Block<br>IP Threat Category List Type. List of IP threat categories<br>See [IP Threat Category List](#rule-list-rules-spec-ip-threat-category-list) below.
+
+<a id="rule-list-rules-spec-ja4-tls-fingerprint"></a>&#x2022; [`ja4_tls_fingerprint`](#rule-list-rules-spec-ja4-tls-fingerprint) - Optional Block<br>JA4 TLS Fingerprint Matcher. An extended version of JA3 that includes additional fields for more comprehensive fingerprinting of SSL/TLS clients and potentially has a different structure and length<br>See [Ja4 TLS Fingerprint](#rule-list-rules-spec-ja4-tls-fingerprint) below.
+
+<a id="rule-list-rules-spec-jwt-claims"></a>&#x2022; [`jwt_claims`](#rule-list-rules-spec-jwt-claims) - Optional Block<br>JWT Claims. A list of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType instances. The actual JWT claims values are extracted from the JWT payload as a list of strings. Note that all specified JWT claim predicates must evaluate to true<br>See [JWT Claims](#rule-list-rules-spec-jwt-claims) below.
+
+<a id="rule-list-rules-spec-label-matcher"></a>&#x2022; [`label_matcher`](#rule-list-rules-spec-label-matcher) - Optional Block<br>Label Matcher. A label matcher specifies a list of label keys whose values need to match for source/client and destination/server. Note that the actual label values are not specified and do not matter. This allows an ability to scope grouping by the label key name<br>See [Label Matcher](#rule-list-rules-spec-label-matcher) below.
+
+<a id="rule-list-rules-spec-mum-action"></a>&#x2022; [`mum_action`](#rule-list-rules-spec-mum-action) - Optional Block<br>Select Modification Action. Modify behavior for a matching request. The modification could be to entirely skip processing<br>See [Mum Action](#rule-list-rules-spec-mum-action) below.
+
+<a id="rule-list-rules-spec-path"></a>&#x2022; [`path`](#rule-list-rules-spec-path) - Optional Block<br>Path Matcher. A path matcher specifies multiple criteria for matching an HTTP path string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of path prefixes, a list of exact path values and a list of regular expressions<br>See [Path](#rule-list-rules-spec-path) below.
+
+<a id="rule-list-rules-spec-port-matcher"></a>&#x2022; [`port_matcher`](#rule-list-rules-spec-port-matcher) - Optional Block<br>Port Matcher. A port matcher specifies a list of port ranges as match criteria. The match is considered successful if the input port falls within any of the port ranges. The result of the match is inverted if invert_matcher is true<br>See [Port Matcher](#rule-list-rules-spec-port-matcher) below.
+
+<a id="rule-list-rules-spec-query-params"></a>&#x2022; [`query_params`](#rule-list-rules-spec-query-params) - Optional Block<br>HTTP Query Parameters. A list of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances of QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query parameter name. Note that all specified query parameter predicates must evaluate to true<br>See [Query Params](#rule-list-rules-spec-query-params) below.
+
+<a id="rule-list-rules-spec-request-constraints"></a>&#x2022; [`request_constraints`](#rule-list-rules-spec-request-constraints) - Optional Block<br>Request Constraints<br>See [Request Constraints](#rule-list-rules-spec-request-constraints) below.
+
+<a id="rule-list-rules-spec-segment-policy"></a>&#x2022; [`segment_policy`](#rule-list-rules-spec-segment-policy) - Optional Block<br>Configure Segments. Configure source and destination segment for policy<br>See [Segment Policy](#rule-list-rules-spec-segment-policy) below.
+
+<a id="rule-list-rules-spec-tls-fingerprint-matcher"></a>&#x2022; [`tls_fingerprint_matcher`](#rule-list-rules-spec-tls-fingerprint-matcher) - Optional Block<br>TLS Fingerprint Matcher. A TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positve match criteria includes a list of known classes of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied and the input fingerprint is not one of the excluded values<br>See [TLS Fingerprint Matcher](#rule-list-rules-spec-tls-fingerprint-matcher) below.
+
+<a id="rule-list-rules-spec-user-identity-matcher"></a>&#x2022; [`user_identity_matcher`](#rule-list-rules-spec-user-identity-matcher) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [User Identity Matcher](#rule-list-rules-spec-user-identity-matcher) below.
+
+<a id="rule-list-rules-spec-waf-action"></a>&#x2022; [`waf_action`](#rule-list-rules-spec-waf-action) - Optional Block<br>App Firewall Action. Modify App Firewall behavior for a matching request. The modification could either be to entirely skip firewall processing or to customize the firewall rules to be applied as defined by App Firewall Rule Control settings<br>See [WAF Action](#rule-list-rules-spec-waf-action) below.
+
+#### Rule List Rules Spec API Group Matcher
+
+An [`api_group_matcher`](#rule-list-rules-spec-api-group-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-api-group-matcher-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-api-group-matcher-invert-matcher) - Optional Bool<br>Invert String Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-api-group-matcher-match"></a>&#x2022; [`match`](#rule-list-rules-spec-api-group-matcher-match) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+#### Rule List Rules Spec Arg Matchers
+
+An [`arg_matchers`](#rule-list-rules-spec-arg-matchers) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-arg-matchers-check-not-present"></a>&#x2022; [`check_not_present`](#rule-list-rules-spec-arg-matchers-check-not-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-arg-matchers-check-present"></a>&#x2022; [`check_present`](#rule-list-rules-spec-arg-matchers-check-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-arg-matchers-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-arg-matchers-invert-matcher) - Optional Bool<br>Invert Matcher. Invert Match of the expression defined
+
+<a id="rule-list-rules-spec-arg-matchers-item"></a>&#x2022; [`item`](#rule-list-rules-spec-arg-matchers-item) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Item](#rule-list-rules-spec-arg-matchers-item) below.
+
+<a id="rule-list-rules-spec-arg-matchers-name"></a>&#x2022; [`name`](#rule-list-rules-spec-arg-matchers-name) - Optional String<br>Argument Name. A case-sensitive JSON path in the HTTP request body
+
+#### Rule List Rules Spec Arg Matchers Item
+
+An [`item`](#rule-list-rules-spec-arg-matchers-item) block (within [`rule_list.rules.spec.arg_matchers`](#rule-list-rules-spec-arg-matchers)) supports the following:
+
+<a id="rule-list-rules-spec-arg-matchers-item-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-arg-matchers-item-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-arg-matchers-item-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-arg-matchers-item-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-arg-matchers-item-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-arg-matchers-item-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Asn List
+
+An [`asn_list`](#rule-list-rules-spec-asn-list) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-asn-list-as-numbers"></a>&#x2022; [`as_numbers`](#rule-list-rules-spec-asn-list-as-numbers) - Optional List<br>AS Numbers. An unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer
+
+#### Rule List Rules Spec Asn Matcher
+
+An [`asn_matcher`](#rule-list-rules-spec-asn-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets"></a>&#x2022; [`asn_sets`](#rule-list-rules-spec-asn-matcher-asn-sets) - Optional Block<br>BGP ASN Sets. A list of references to bgp_asn_set objects<br>See [Asn Sets](#rule-list-rules-spec-asn-matcher-asn-sets) below.
+
+#### Rule List Rules Spec Asn Matcher Asn Sets
+
+An [`asn_sets`](#rule-list-rules-spec-asn-matcher-asn-sets) block (within [`rule_list.rules.spec.asn_matcher`](#rule-list-rules-spec-asn-matcher)) supports the following:
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets-kind"></a>&#x2022; [`kind`](#rule-list-rules-spec-asn-matcher-asn-sets-kind) - Optional String<br>Kind. When a configuration object(e.g. virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. 'route')
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets-name"></a>&#x2022; [`name`](#rule-list-rules-spec-asn-matcher-asn-sets-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets-namespace"></a>&#x2022; [`namespace`](#rule-list-rules-spec-asn-matcher-asn-sets-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets-tenant"></a>&#x2022; [`tenant`](#rule-list-rules-spec-asn-matcher-asn-sets-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+<a id="rule-list-rules-spec-asn-matcher-asn-sets-uid"></a>&#x2022; [`uid`](#rule-list-rules-spec-asn-matcher-asn-sets-uid) - Optional String<br>UID. When a configuration object(e.g. virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g. route's) uid
+
+#### Rule List Rules Spec Body Matcher
+
+A [`body_matcher`](#rule-list-rules-spec-body-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-body-matcher-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-body-matcher-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-body-matcher-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-body-matcher-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-body-matcher-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-body-matcher-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Bot Action
+
+A [`bot_action`](#rule-list-rules-spec-bot-action) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-bot-action-bot-skip-processing"></a>&#x2022; [`bot_skip_processing`](#rule-list-rules-spec-bot-action-bot-skip-processing) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-bot-action-none"></a>&#x2022; [`none`](#rule-list-rules-spec-bot-action-none) - Optional Block<br>Enable this option
+
+#### Rule List Rules Spec Client Name Matcher
+
+A [`client_name_matcher`](#rule-list-rules-spec-client-name-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-client-name-matcher-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-client-name-matcher-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-client-name-matcher-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-client-name-matcher-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-client-name-matcher-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-client-name-matcher-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Client Selector
+
+A [`client_selector`](#rule-list-rules-spec-client-selector) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-client-selector-expressions"></a>&#x2022; [`expressions`](#rule-list-rules-spec-client-selector-expressions) - Optional List<br>Selector Expression. expressions contains the kubernetes style label expression for selections
+
+#### Rule List Rules Spec Cookie Matchers
+
+A [`cookie_matchers`](#rule-list-rules-spec-cookie-matchers) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-cookie-matchers-check-not-present"></a>&#x2022; [`check_not_present`](#rule-list-rules-spec-cookie-matchers-check-not-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-cookie-matchers-check-present"></a>&#x2022; [`check_present`](#rule-list-rules-spec-cookie-matchers-check-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-cookie-matchers-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-cookie-matchers-invert-matcher) - Optional Bool<br>Invert Matcher. Invert Match of the expression defined
+
+<a id="rule-list-rules-spec-cookie-matchers-item"></a>&#x2022; [`item`](#rule-list-rules-spec-cookie-matchers-item) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Item](#rule-list-rules-spec-cookie-matchers-item) below.
+
+<a id="rule-list-rules-spec-cookie-matchers-name"></a>&#x2022; [`name`](#rule-list-rules-spec-cookie-matchers-name) - Optional String<br>Cookie Name. A case-sensitive cookie name
+
+#### Rule List Rules Spec Cookie Matchers Item
+
+An [`item`](#rule-list-rules-spec-cookie-matchers-item) block (within [`rule_list.rules.spec.cookie_matchers`](#rule-list-rules-spec-cookie-matchers)) supports the following:
+
+<a id="rule-list-rules-spec-cookie-matchers-item-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-cookie-matchers-item-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-cookie-matchers-item-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-cookie-matchers-item-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-cookie-matchers-item-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-cookie-matchers-item-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Domain Matcher
+
+A [`domain_matcher`](#rule-list-rules-spec-domain-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-domain-matcher-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-domain-matcher-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-domain-matcher-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-domain-matcher-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-domain-matcher-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-domain-matcher-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Headers
+
+A [`headers`](#rule-list-rules-spec-headers) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-headers-check-not-present"></a>&#x2022; [`check_not_present`](#rule-list-rules-spec-headers-check-not-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-headers-check-present"></a>&#x2022; [`check_present`](#rule-list-rules-spec-headers-check-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-headers-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-headers-invert-matcher) - Optional Bool<br>Invert Header Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-headers-item"></a>&#x2022; [`item`](#rule-list-rules-spec-headers-item) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Item](#rule-list-rules-spec-headers-item) below.
+
+<a id="rule-list-rules-spec-headers-name"></a>&#x2022; [`name`](#rule-list-rules-spec-headers-name) - Optional String<br>Header Name. A case-insensitive HTTP header name
+
+#### Rule List Rules Spec Headers Item
+
+An [`item`](#rule-list-rules-spec-headers-item) block (within [`rule_list.rules.spec.headers`](#rule-list-rules-spec-headers)) supports the following:
+
+<a id="rule-list-rules-spec-headers-item-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-headers-item-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-headers-item-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-headers-item-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-headers-item-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-headers-item-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec HTTP Method
+
+A [`http_method`](#rule-list-rules-spec-http-method) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-http-method-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-http-method-invert-matcher) - Optional Bool<br>Invert Method Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-http-method-methods"></a>&#x2022; [`methods`](#rule-list-rules-spec-http-method-methods) - Optional List  Defaults to `ANY`<br>Possible values are `ANY`, `GET`, `HEAD`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE`, `PATCH`, `COPY`<br>[Enum: ANY|GET|HEAD|POST|PUT|DELETE|CONNECT|OPTIONS|TRACE|PATCH|COPY] Method List. List of methods values to match against
+
+#### Rule List Rules Spec IP Matcher
+
+An [`ip_matcher`](#rule-list-rules-spec-ip-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-ip-matcher-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-ip-matcher-invert-matcher) - Optional Bool<br>Invert IP Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets"></a>&#x2022; [`prefix_sets`](#rule-list-rules-spec-ip-matcher-prefix-sets) - Optional Block<br>IP Prefix Sets. A list of references to ip_prefix_set objects<br>See [Prefix Sets](#rule-list-rules-spec-ip-matcher-prefix-sets) below.
+
+#### Rule List Rules Spec IP Matcher Prefix Sets
+
+A [`prefix_sets`](#rule-list-rules-spec-ip-matcher-prefix-sets) block (within [`rule_list.rules.spec.ip_matcher`](#rule-list-rules-spec-ip-matcher)) supports the following:
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets-kind"></a>&#x2022; [`kind`](#rule-list-rules-spec-ip-matcher-prefix-sets-kind) - Optional String<br>Kind. When a configuration object(e.g. virtual_host) refers to another(e.g route) then kind will hold the referred object's kind (e.g. 'route')
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets-name"></a>&#x2022; [`name`](#rule-list-rules-spec-ip-matcher-prefix-sets-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets-namespace"></a>&#x2022; [`namespace`](#rule-list-rules-spec-ip-matcher-prefix-sets-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets-tenant"></a>&#x2022; [`tenant`](#rule-list-rules-spec-ip-matcher-prefix-sets-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+<a id="rule-list-rules-spec-ip-matcher-prefix-sets-uid"></a>&#x2022; [`uid`](#rule-list-rules-spec-ip-matcher-prefix-sets-uid) - Optional String<br>UID. When a configuration object(e.g. virtual_host) refers to another(e.g route) then uid will hold the referred object's(e.g. route's) uid
+
+#### Rule List Rules Spec IP Prefix List
+
+An [`ip_prefix_list`](#rule-list-rules-spec-ip-prefix-list) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-ip-prefix-list-invert-match"></a>&#x2022; [`invert_match`](#rule-list-rules-spec-ip-prefix-list-invert-match) - Optional Bool<br>Invert Match Result. Invert the match result
+
+<a id="rule-list-rules-spec-ip-prefix-list-ip-prefixes"></a>&#x2022; [`ip_prefixes`](#rule-list-rules-spec-ip-prefix-list-ip-prefixes) - Optional List<br>IPv4 Prefix List. List of IPv4 prefix strings
+
+#### Rule List Rules Spec IP Threat Category List
+
+An [`ip_threat_category_list`](#rule-list-rules-spec-ip-threat-category-list) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-ip-threat-category-list-ip-threat-categories"></a>&#x2022; [`ip_threat_categories`](#rule-list-rules-spec-ip-threat-category-list-ip-threat-categories) - Optional List  Defaults to `SPAM_SOURCES`<br>Possible values are `SPAM_SOURCES`, `WINDOWS_EXPLOITS`, `WEB_ATTACKS`, `BOTNETS`, `SCANNERS`, `REPUTATION`, `PHISHING`, `PROXY`, `MOBILE_THREATS`, `TOR_PROXY`, `DENIAL_OF_SERVICE`, `NETWORK`<br>[Enum: SPAM_SOURCES|WINDOWS_EXPLOITS|WEB_ATTACKS|BOTNETS|SCANNERS|REPUTATION|PHISHING|PROXY|MOBILE_THREATS|TOR_PROXY|DENIAL_OF_SERVICE|NETWORK] List of IP Threat Categories to choose. The IP threat categories is obtained from the list and is used to auto-generate equivalent label selection expressions
+
+#### Rule List Rules Spec Ja4 TLS Fingerprint
+
+A [`ja4_tls_fingerprint`](#rule-list-rules-spec-ja4-tls-fingerprint) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-ja4-tls-fingerprint-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-ja4-tls-fingerprint-exact-values) - Optional List<br>Exact Values. A list of exact JA4 TLS fingerprint to match the input JA4 TLS fingerprint against
+
+#### Rule List Rules Spec JWT Claims
+
+A [`jwt_claims`](#rule-list-rules-spec-jwt-claims) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-jwt-claims-check-not-present"></a>&#x2022; [`check_not_present`](#rule-list-rules-spec-jwt-claims-check-not-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-jwt-claims-check-present"></a>&#x2022; [`check_present`](#rule-list-rules-spec-jwt-claims-check-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-jwt-claims-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-jwt-claims-invert-matcher) - Optional Bool<br>Invert Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-jwt-claims-item"></a>&#x2022; [`item`](#rule-list-rules-spec-jwt-claims-item) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Item](#rule-list-rules-spec-jwt-claims-item) below.
+
+<a id="rule-list-rules-spec-jwt-claims-name"></a>&#x2022; [`name`](#rule-list-rules-spec-jwt-claims-name) - Optional String<br>JWT Claim Name. JWT claim name
+
+#### Rule List Rules Spec JWT Claims Item
+
+An [`item`](#rule-list-rules-spec-jwt-claims-item) block (within [`rule_list.rules.spec.jwt_claims`](#rule-list-rules-spec-jwt-claims)) supports the following:
+
+<a id="rule-list-rules-spec-jwt-claims-item-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-jwt-claims-item-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-jwt-claims-item-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-jwt-claims-item-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-jwt-claims-item-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-jwt-claims-item-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Label Matcher
+
+A [`label_matcher`](#rule-list-rules-spec-label-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-label-matcher-keys"></a>&#x2022; [`keys`](#rule-list-rules-spec-label-matcher-keys) - Optional List<br>Keys. The list of label key names that have to match
+
+#### Rule List Rules Spec Mum Action
+
+A [`mum_action`](#rule-list-rules-spec-mum-action) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-mum-action-default"></a>&#x2022; [`default`](#rule-list-rules-spec-mum-action-default) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-mum-action-skip-processing"></a>&#x2022; [`skip_processing`](#rule-list-rules-spec-mum-action-skip-processing) - Optional Block<br>Enable this option
+
+#### Rule List Rules Spec Path
+
+A [`path`](#rule-list-rules-spec-path) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-path-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-path-exact-values) - Optional List<br>Exact Values. A list of exact path values to match the input HTTP path against
+
+<a id="rule-list-rules-spec-path-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-path-invert-matcher) - Optional Bool<br>Invert Path Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-path-prefix-values"></a>&#x2022; [`prefix_values`](#rule-list-rules-spec-path-prefix-values) - Optional List<br>Prefix Values. A list of path prefix values to match the input HTTP path against
+
+<a id="rule-list-rules-spec-path-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-path-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input HTTP path against
+
+<a id="rule-list-rules-spec-path-suffix-values"></a>&#x2022; [`suffix_values`](#rule-list-rules-spec-path-suffix-values) - Optional List<br>Suffix Values. A list of path suffix values to match the input HTTP path against
+
+<a id="rule-list-rules-spec-path-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-path-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Port Matcher
+
+A [`port_matcher`](#rule-list-rules-spec-port-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-port-matcher-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-port-matcher-invert-matcher) - Optional Bool<br>Invert Port Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-port-matcher-ports"></a>&#x2022; [`ports`](#rule-list-rules-spec-port-matcher-ports) - Optional List<br>Port Ranges. A list of strings, each of which is a single port value or a tuple of start and end port values separated by '-'. The start and end values are considered to be part of the range
+
+#### Rule List Rules Spec Query Params
+
+A [`query_params`](#rule-list-rules-spec-query-params) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-query-params-check-not-present"></a>&#x2022; [`check_not_present`](#rule-list-rules-spec-query-params-check-not-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-query-params-check-present"></a>&#x2022; [`check_present`](#rule-list-rules-spec-query-params-check-present) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-query-params-invert-matcher"></a>&#x2022; [`invert_matcher`](#rule-list-rules-spec-query-params-invert-matcher) - Optional Bool<br>Invert Query Parameter Matcher. Invert the match result
+
+<a id="rule-list-rules-spec-query-params-item"></a>&#x2022; [`item`](#rule-list-rules-spec-query-params-item) - Optional Block<br>Matcher. A matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions<br>See [Item](#rule-list-rules-spec-query-params-item) below.
+
+<a id="rule-list-rules-spec-query-params-key"></a>&#x2022; [`key`](#rule-list-rules-spec-query-params-key) - Optional String<br>Query Parameter Name. A case-sensitive HTTP query parameter name
+
+#### Rule List Rules Spec Query Params Item
+
+An [`item`](#rule-list-rules-spec-query-params-item) block (within [`rule_list.rules.spec.query_params`](#rule-list-rules-spec-query-params)) supports the following:
+
+<a id="rule-list-rules-spec-query-params-item-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-query-params-item-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-query-params-item-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-query-params-item-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+<a id="rule-list-rules-spec-query-params-item-transformers"></a>&#x2022; [`transformers`](#rule-list-rules-spec-query-params-item-transformers) - Optional List  Defaults to `TRANSFORMER_NONE`<br>Possible values are `LOWER_CASE`, `UPPER_CASE`, `BASE64_DECODE`, `NORMALIZE_PATH`, `REMOVE_WHITESPACE`, `URL_DECODE`, `TRIM_LEFT`, `TRIM_RIGHT`, `TRIM`<br>[Enum: LOWER_CASE|UPPER_CASE|BASE64_DECODE|NORMALIZE_PATH|REMOVE_WHITESPACE|URL_DECODE|TRIM_LEFT|TRIM_RIGHT|TRIM] Transformers. An ordered list of transformers (starting from index 0) to be applied to the path before matching
+
+#### Rule List Rules Spec Request Constraints
+
+A [`request_constraints`](#rule-list-rules-spec-request-constraints) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-count-exceeds"></a>&#x2022; [`max_cookie_count_exceeds`](#rule-list-rules-spec-request-constraints-max-cookie-count-exceeds) - Optional Number<br>Match on the Count for all Cookies that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-count-none"></a>&#x2022; [`max_cookie_count_none`](#rule-list-rules-spec-request-constraints-max-cookie-count-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-key-size-exceeds"></a>&#x2022; [`max_cookie_key_size_exceeds`](#rule-list-rules-spec-request-constraints-max-cookie-key-size-exceeds) - Optional Number<br>Match on the Name Size per Cookie that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-key-size-none"></a>&#x2022; [`max_cookie_key_size_none`](#rule-list-rules-spec-request-constraints-max-cookie-key-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-value-size-exceeds"></a>&#x2022; [`max_cookie_value_size_exceeds`](#rule-list-rules-spec-request-constraints-max-cookie-value-size-exceeds) - Optional Number<br>Match on the Value Size per Cookie that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-cookie-value-size-none"></a>&#x2022; [`max_cookie_value_size_none`](#rule-list-rules-spec-request-constraints-max-cookie-value-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-header-count-exceeds"></a>&#x2022; [`max_header_count_exceeds`](#rule-list-rules-spec-request-constraints-max-header-count-exceeds) - Optional Number<br>Match on the Count for all Headers that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-header-count-none"></a>&#x2022; [`max_header_count_none`](#rule-list-rules-spec-request-constraints-max-header-count-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-header-key-size-exceeds"></a>&#x2022; [`max_header_key_size_exceeds`](#rule-list-rules-spec-request-constraints-max-header-key-size-exceeds) - Optional Number<br>Match on the Name Size per Header that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-header-key-size-none"></a>&#x2022; [`max_header_key_size_none`](#rule-list-rules-spec-request-constraints-max-header-key-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-header-value-size-exceeds"></a>&#x2022; [`max_header_value_size_exceeds`](#rule-list-rules-spec-request-constraints-max-header-value-size-exceeds) - Optional Number<br>Match on the Value Size per Header that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-header-value-size-none"></a>&#x2022; [`max_header_value_size_none`](#rule-list-rules-spec-request-constraints-max-header-value-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-count-exceeds"></a>&#x2022; [`max_parameter_count_exceeds`](#rule-list-rules-spec-request-constraints-max-parameter-count-exceeds) - Optional Number<br>Match on the Parameter Count that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-count-none"></a>&#x2022; [`max_parameter_count_none`](#rule-list-rules-spec-request-constraints-max-parameter-count-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-name-size-exceeds"></a>&#x2022; [`max_parameter_name_size_exceeds`](#rule-list-rules-spec-request-constraints-max-parameter-name-size-exceeds) - Optional Number<br>Match on the Parameter Name Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-name-size-none"></a>&#x2022; [`max_parameter_name_size_none`](#rule-list-rules-spec-request-constraints-max-parameter-name-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-value-size-exceeds"></a>&#x2022; [`max_parameter_value_size_exceeds`](#rule-list-rules-spec-request-constraints-max-parameter-value-size-exceeds) - Optional Number<br>Match on the Parameter Value Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-parameter-value-size-none"></a>&#x2022; [`max_parameter_value_size_none`](#rule-list-rules-spec-request-constraints-max-parameter-value-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-query-size-exceeds"></a>&#x2022; [`max_query_size_exceeds`](#rule-list-rules-spec-request-constraints-max-query-size-exceeds) - Optional Number<br>Match on the URL Query Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-query-size-none"></a>&#x2022; [`max_query_size_none`](#rule-list-rules-spec-request-constraints-max-query-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-request-line-size-exceeds"></a>&#x2022; [`max_request_line_size_exceeds`](#rule-list-rules-spec-request-constraints-max-request-line-size-exceeds) - Optional Number<br>Match on the Request Line Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-request-line-size-none"></a>&#x2022; [`max_request_line_size_none`](#rule-list-rules-spec-request-constraints-max-request-line-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-request-size-exceeds"></a>&#x2022; [`max_request_size_exceeds`](#rule-list-rules-spec-request-constraints-max-request-size-exceeds) - Optional Number<br>Match on the Request Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-request-size-none"></a>&#x2022; [`max_request_size_none`](#rule-list-rules-spec-request-constraints-max-request-size-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-request-constraints-max-url-size-exceeds"></a>&#x2022; [`max_url_size_exceeds`](#rule-list-rules-spec-request-constraints-max-url-size-exceeds) - Optional Number<br>Match on the URL Size that exceed this value
+
+<a id="rule-list-rules-spec-request-constraints-max-url-size-none"></a>&#x2022; [`max_url_size_none`](#rule-list-rules-spec-request-constraints-max-url-size-none) - Optional Block<br>Enable this option
+
+#### Rule List Rules Spec Segment Policy
+
+A [`segment_policy`](#rule-list-rules-spec-segment-policy) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-segment-policy-dst-any"></a>&#x2022; [`dst_any`](#rule-list-rules-spec-segment-policy-dst-any) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-segment-policy-dst-segments"></a>&#x2022; [`dst_segments`](#rule-list-rules-spec-segment-policy-dst-segments) - Optional Block<br>Segment List. List of references to Segments<br>See [Dst Segments](#rule-list-rules-spec-segment-policy-dst-segments) below.
+
+<a id="rule-list-rules-spec-segment-policy-intra-segment"></a>&#x2022; [`intra_segment`](#rule-list-rules-spec-segment-policy-intra-segment) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-segment-policy-src-any"></a>&#x2022; [`src_any`](#rule-list-rules-spec-segment-policy-src-any) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-segment-policy-src-segments"></a>&#x2022; [`src_segments`](#rule-list-rules-spec-segment-policy-src-segments) - Optional Block<br>Segment List. List of references to Segments<br>See [Src Segments](#rule-list-rules-spec-segment-policy-src-segments) below.
+
+#### Rule List Rules Spec Segment Policy Dst Segments
+
+A [`dst_segments`](#rule-list-rules-spec-segment-policy-dst-segments) block (within [`rule_list.rules.spec.segment_policy`](#rule-list-rules-spec-segment-policy)) supports the following:
+
+<a id="rule-list-rules-spec-segment-policy-dst-segments-segments"></a>&#x2022; [`segments`](#rule-list-rules-spec-segment-policy-dst-segments-segments) - Optional Block<br>Segments. Select list of segments<br>See [Segments](#rule-list-rules-spec-segment-policy-dst-segments-segments) below.
+
+#### Rule List Rules Spec Segment Policy Dst Segments Segments
+
+A [`segments`](#rule-list-rules-spec-segment-policy-dst-segments-segments) block (within [`rule_list.rules.spec.segment_policy.dst_segments`](#rule-list-rules-spec-segment-policy-dst-segments)) supports the following:
+
+<a id="rule-list-rules-spec-segment-policy-dst-segments-segments-name"></a>&#x2022; [`name`](#rule-list-rules-spec-segment-policy-dst-segments-segments-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="rule-list-rules-spec-segment-policy-dst-segments-segments-namespace"></a>&#x2022; [`namespace`](#rule-list-rules-spec-segment-policy-dst-segments-segments-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="rule-list-rules-spec-segment-policy-dst-segments-segments-tenant"></a>&#x2022; [`tenant`](#rule-list-rules-spec-segment-policy-dst-segments-segments-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Rule List Rules Spec Segment Policy Src Segments
+
+A [`src_segments`](#rule-list-rules-spec-segment-policy-src-segments) block (within [`rule_list.rules.spec.segment_policy`](#rule-list-rules-spec-segment-policy)) supports the following:
+
+<a id="rule-list-rules-spec-segment-policy-src-segments-segments"></a>&#x2022; [`segments`](#rule-list-rules-spec-segment-policy-src-segments-segments) - Optional Block<br>Segments. Select list of segments<br>See [Segments](#rule-list-rules-spec-segment-policy-src-segments-segments) below.
+
+#### Rule List Rules Spec Segment Policy Src Segments Segments
+
+A [`segments`](#rule-list-rules-spec-segment-policy-src-segments-segments) block (within [`rule_list.rules.spec.segment_policy.src_segments`](#rule-list-rules-spec-segment-policy-src-segments)) supports the following:
+
+<a id="rule-list-rules-spec-segment-policy-src-segments-segments-name"></a>&#x2022; [`name`](#rule-list-rules-spec-segment-policy-src-segments-segments-name) - Optional String<br>Name. When a configuration object(e.g. virtual_host) refers to another(e.g route) then name will hold the referred object's(e.g. route's) name
+
+<a id="rule-list-rules-spec-segment-policy-src-segments-segments-namespace"></a>&#x2022; [`namespace`](#rule-list-rules-spec-segment-policy-src-segments-segments-namespace) - Optional String<br>Namespace. When a configuration object(e.g. virtual_host) refers to another(e.g route) then namespace will hold the referred object's(e.g. route's) namespace
+
+<a id="rule-list-rules-spec-segment-policy-src-segments-segments-tenant"></a>&#x2022; [`tenant`](#rule-list-rules-spec-segment-policy-src-segments-segments-tenant) - Optional String<br>Tenant. When a configuration object(e.g. virtual_host) refers to another(e.g route) then tenant will hold the referred object's(e.g. route's) tenant
+
+#### Rule List Rules Spec TLS Fingerprint Matcher
+
+A [`tls_fingerprint_matcher`](#rule-list-rules-spec-tls-fingerprint-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-tls-fingerprint-matcher-classes"></a>&#x2022; [`classes`](#rule-list-rules-spec-tls-fingerprint-matcher-classes) - Optional List  Defaults to `TLS_FINGERPRINT_NONE`<br>Possible values are `TLS_FINGERPRINT_NONE`, `ANY_MALICIOUS_FINGERPRINT`, `ADWARE`, `ADWIND`, `DRIDEX`, `GOOTKIT`, `GOZI`, `JBIFROST`, `QUAKBOT`, `RANSOMWARE`, `TROLDESH`, `TOFSEE`, `TORRENTLOCKER`, `TRICKBOT`<br>[Enum: TLS_FINGERPRINT_NONE|ANY_MALICIOUS_FINGERPRINT|ADWARE|ADWIND|DRIDEX|GOOTKIT|GOZI|JBIFROST|QUAKBOT|RANSOMWARE|TROLDESH|TOFSEE|TORRENTLOCKER|TRICKBOT] TLS fingerprint classes. A list of known classes of TLS fingerprints to match the input TLS JA3 fingerprint against
+
+<a id="rule-list-rules-spec-tls-fingerprint-matcher-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-tls-fingerprint-matcher-exact-values) - Optional List<br>Exact Values. A list of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against
+
+<a id="rule-list-rules-spec-tls-fingerprint-matcher-excluded-values"></a>&#x2022; [`excluded_values`](#rule-list-rules-spec-tls-fingerprint-matcher-excluded-values) - Optional List<br>Excluded Values. A list of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one or more known TLS fingerprint classes in the enclosing matcher
+
+#### Rule List Rules Spec User Identity Matcher
+
+An [`user_identity_matcher`](#rule-list-rules-spec-user-identity-matcher) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-user-identity-matcher-exact-values"></a>&#x2022; [`exact_values`](#rule-list-rules-spec-user-identity-matcher-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="rule-list-rules-spec-user-identity-matcher-regex-values"></a>&#x2022; [`regex_values`](#rule-list-rules-spec-user-identity-matcher-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+#### Rule List Rules Spec WAF Action
+
+A [`waf_action`](#rule-list-rules-spec-waf-action) block (within [`rule_list.rules.spec`](#rule-list-rules-spec)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control"></a>&#x2022; [`app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control) - Optional Block<br>App Firewall Detection Control. Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria<br>See [App Firewall Detection Control](#rule-list-rules-spec-waf-action-app-firewall-detection-control) below.
+
+<a id="rule-list-rules-spec-waf-action-none"></a>&#x2022; [`none`](#rule-list-rules-spec-waf-action-none) - Optional Block<br>Enable this option
+
+<a id="rule-list-rules-spec-waf-action-waf-skip-processing"></a>&#x2022; [`waf_skip_processing`](#rule-list-rules-spec-waf-action-waf-skip-processing) - Optional Block<br>Enable this option
+
+#### Rule List Rules Spec WAF Action App Firewall Detection Control
+
+An [`app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control) block (within [`rule_list.rules.spec.waf_action`](#rule-list-rules-spec-waf-action)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts"></a>&#x2022; [`exclude_attack_type_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts) - Optional Block<br>Attack Types. Attack Types to be excluded for the defined match criteria<br>See [Exclude Attack Type Contexts](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts) below.
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts"></a>&#x2022; [`exclude_bot_name_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts) - Optional Block<br>Bot Names. Bot Names to be excluded for the defined match criteria<br>See [Exclude Bot Name Contexts](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts) below.
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts"></a>&#x2022; [`exclude_signature_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts) - Optional Block<br>Signature IDs. Signature IDs to be excluded for the defined match criteria<br>See [Exclude Signature Contexts](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts) below.
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts"></a>&#x2022; [`exclude_violation_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts) - Optional Block<br>Violations. Violations to be excluded for the defined match criteria<br>See [Exclude Violation Contexts](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts) below.
+
+#### Rule List Rules Spec WAF Action App Firewall Detection Control Exclude Attack Type Contexts
+
+An [`exclude_attack_type_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts) block (within [`rule_list.rules.spec.waf_action.app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-context"></a>&#x2022; [`context`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-context) - Optional String  Defaults to `CONTEXT_ANY`<br>Possible values are `CONTEXT_ANY`, `CONTEXT_BODY`, `CONTEXT_REQUEST`, `CONTEXT_RESPONSE`, `CONTEXT_PARAMETER`, `CONTEXT_HEADER`, `CONTEXT_COOKIE`, `CONTEXT_URL`, `CONTEXT_URI`<br>[Enum: CONTEXT_ANY|CONTEXT_BODY|CONTEXT_REQUEST|CONTEXT_RESPONSE|CONTEXT_PARAMETER|CONTEXT_HEADER|CONTEXT_COOKIE|CONTEXT_URL|CONTEXT_URI] WAF Exclusion Context Options. The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE: CONTEXT_RESPONSE - CONTEXT_PARAMETER: CONTEXT_PARAMETER Detection will be excluded for the parameters. The parameter name is required in the Context name field. If the field is left empty, the detection will be excluded for all parameters. - CONTEXT_HEADER: CONTEXT_HEADER Detection will be excluded for the headers. The header name is required in the Context name field. If the field is left empty, the detection will be excluded for all headers. - CONTEXT_COOKIE: CONTEXT_COOKIE Detection will be excluded for the cookies. The cookie name is required in the Context name field. If the field is left empty, the detection will be excluded for all cookies. - CONTEXT_URL: CONTEXT_URL Detection will be excluded for the request URL. - CONTEXT_URI: CONTEXT_URI
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-context-name"></a>&#x2022; [`context_name`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-context-name) - Optional String<br>Context Name. Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*)
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-exclude-attack-type"></a>&#x2022; [`exclude_attack_type`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-attack-type-contexts-exclude-attack-type) - Optional String  Defaults to `ATTACK_TYPE_NONE`<br>Possible values are `ATTACK_TYPE_NONE`, `ATTACK_TYPE_NON_BROWSER_CLIENT`, `ATTACK_TYPE_OTHER_APPLICATION_ATTACKS`, `ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE`, `ATTACK_TYPE_DETECTION_EVASION`, `ATTACK_TYPE_VULNERABILITY_SCAN`, `ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY`, `ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS`, `ATTACK_TYPE_BUFFER_OVERFLOW`, `ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION`, `ATTACK_TYPE_INFORMATION_LEAKAGE`, `ATTACK_TYPE_DIRECTORY_INDEXING`, `ATTACK_TYPE_PATH_TRAVERSAL`, `ATTACK_TYPE_XPATH_INJECTION`, `ATTACK_TYPE_LDAP_INJECTION`, `ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION`, `ATTACK_TYPE_COMMAND_EXECUTION`, `ATTACK_TYPE_SQL_INJECTION`, `ATTACK_TYPE_CROSS_SITE_SCRIPTING`, `ATTACK_TYPE_DENIAL_OF_SERVICE`, `ATTACK_TYPE_HTTP_PARSER_ATTACK`, `ATTACK_TYPE_SESSION_HIJACKING`, `ATTACK_TYPE_HTTP_RESPONSE_SPLITTING`, `ATTACK_TYPE_FORCEFUL_BROWSING`, `ATTACK_TYPE_REMOTE_FILE_INCLUDE`, `ATTACK_TYPE_MALICIOUS_FILE_UPLOAD`, `ATTACK_TYPE_GRAPHQL_PARSER_ATTACK`<br>[Enum: ATTACK_TYPE_NONE|ATTACK_TYPE_NON_BROWSER_CLIENT|ATTACK_TYPE_OTHER_APPLICATION_ATTACKS|ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE|ATTACK_TYPE_DETECTION_EVASION|ATTACK_TYPE_VULNERABILITY_SCAN|ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY|ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS|ATTACK_TYPE_BUFFER_OVERFLOW|ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION|ATTACK_TYPE_INFORMATION_LEAKAGE|ATTACK_TYPE_DIRECTORY_INDEXING|ATTACK_TYPE_PATH_TRAVERSAL|ATTACK_TYPE_XPATH_INJECTION|ATTACK_TYPE_LDAP_INJECTION|ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION|ATTACK_TYPE_COMMAND_EXECUTION|ATTACK_TYPE_SQL_INJECTION|ATTACK_TYPE_CROSS_SITE_SCRIPTING|ATTACK_TYPE_DENIAL_OF_SERVICE|ATTACK_TYPE_HTTP_PARSER_ATTACK|ATTACK_TYPE_SESSION_HIJACKING|ATTACK_TYPE_HTTP_RESPONSE_SPLITTING|ATTACK_TYPE_FORCEFUL_BROWSING|ATTACK_TYPE_REMOTE_FILE_INCLUDE|ATTACK_TYPE_MALICIOUS_FILE_UPLOAD|ATTACK_TYPE_GRAPHQL_PARSER_ATTACK] Attack Types. List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE ATTACK_TYPE_DETECTION_EVASION ATTACK_TYPE_VULNERABILITY_SCAN ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS ATTACK_TYPE_BUFFER_OVERFLOW ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION ATTACK_TYPE_INFORMATION_LEAKAGE ATTACK_TYPE_DIRECTORY_INDEXING ATTACK_TYPE_PATH_TRAVERSAL ATTACK_TYPE_XPATH_INJECTION ATTACK_TYPE_LDAP_INJECTION ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION ATTACK_TYPE_COMMAND_EXECUTION ATTACK_TYPE_SQL_INJECTION ATTACK_TYPE_CROSS_SITE_SCRIPTING ATTACK_TYPE_DENIAL_OF_SERVICE ATTACK_TYPE_HTTP_PARSER_ATTACK ATTACK_TYPE_SESSION_HIJACKING ATTACK_TYPE_HTTP_RESPONSE_SPLITTING ATTACK_TYPE_FORCEFUL_BROWSING ATTACK_TYPE_REMOTE_FILE_INCLUDE ATTACK_TYPE_MALICIOUS_FILE_UPLOAD ATTACK_TYPE_GRAPHQL_PARSER_ATTACK
+
+#### Rule List Rules Spec WAF Action App Firewall Detection Control Exclude Bot Name Contexts
+
+An [`exclude_bot_name_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts) block (within [`rule_list.rules.spec.waf_action.app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts-bot-name"></a>&#x2022; [`bot_name`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-bot-name-contexts-bot-name) - Optional String<br>Bot Name
+
+#### Rule List Rules Spec WAF Action App Firewall Detection Control Exclude Signature Contexts
+
+An [`exclude_signature_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts) block (within [`rule_list.rules.spec.waf_action.app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-context"></a>&#x2022; [`context`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-context) - Optional String  Defaults to `CONTEXT_ANY`<br>Possible values are `CONTEXT_ANY`, `CONTEXT_BODY`, `CONTEXT_REQUEST`, `CONTEXT_RESPONSE`, `CONTEXT_PARAMETER`, `CONTEXT_HEADER`, `CONTEXT_COOKIE`, `CONTEXT_URL`, `CONTEXT_URI`<br>[Enum: CONTEXT_ANY|CONTEXT_BODY|CONTEXT_REQUEST|CONTEXT_RESPONSE|CONTEXT_PARAMETER|CONTEXT_HEADER|CONTEXT_COOKIE|CONTEXT_URL|CONTEXT_URI] WAF Exclusion Context Options. The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE: CONTEXT_RESPONSE - CONTEXT_PARAMETER: CONTEXT_PARAMETER Detection will be excluded for the parameters. The parameter name is required in the Context name field. If the field is left empty, the detection will be excluded for all parameters. - CONTEXT_HEADER: CONTEXT_HEADER Detection will be excluded for the headers. The header name is required in the Context name field. If the field is left empty, the detection will be excluded for all headers. - CONTEXT_COOKIE: CONTEXT_COOKIE Detection will be excluded for the cookies. The cookie name is required in the Context name field. If the field is left empty, the detection will be excluded for all cookies. - CONTEXT_URL: CONTEXT_URL Detection will be excluded for the request URL. - CONTEXT_URI: CONTEXT_URI
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-context-name"></a>&#x2022; [`context_name`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-context-name) - Optional String<br>Context Name. Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*)
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-signature-id"></a>&#x2022; [`signature_id`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-signature-contexts-signature-id) - Optional Number<br>SignatureID. The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context
+
+#### Rule List Rules Spec WAF Action App Firewall Detection Control Exclude Violation Contexts
+
+An [`exclude_violation_contexts`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts) block (within [`rule_list.rules.spec.waf_action.app_firewall_detection_control`](#rule-list-rules-spec-waf-action-app-firewall-detection-control)) supports the following:
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-context"></a>&#x2022; [`context`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-context) - Optional String  Defaults to `CONTEXT_ANY`<br>Possible values are `CONTEXT_ANY`, `CONTEXT_BODY`, `CONTEXT_REQUEST`, `CONTEXT_RESPONSE`, `CONTEXT_PARAMETER`, `CONTEXT_HEADER`, `CONTEXT_COOKIE`, `CONTEXT_URL`, `CONTEXT_URI`<br>[Enum: CONTEXT_ANY|CONTEXT_BODY|CONTEXT_REQUEST|CONTEXT_RESPONSE|CONTEXT_PARAMETER|CONTEXT_HEADER|CONTEXT_COOKIE|CONTEXT_URL|CONTEXT_URI] WAF Exclusion Context Options. The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE: CONTEXT_RESPONSE - CONTEXT_PARAMETER: CONTEXT_PARAMETER Detection will be excluded for the parameters. The parameter name is required in the Context name field. If the field is left empty, the detection will be excluded for all parameters. - CONTEXT_HEADER: CONTEXT_HEADER Detection will be excluded for the headers. The header name is required in the Context name field. If the field is left empty, the detection will be excluded for all headers. - CONTEXT_COOKIE: CONTEXT_COOKIE Detection will be excluded for the cookies. The cookie name is required in the Context name field. If the field is left empty, the detection will be excluded for all cookies. - CONTEXT_URL: CONTEXT_URL Detection will be excluded for the request URL. - CONTEXT_URI: CONTEXT_URI
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-context-name"></a>&#x2022; [`context_name`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-context-name) - Optional String<br>Context Name. Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*)
+
+<a id="rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-exclude-violation"></a>&#x2022; [`exclude_violation`](#rule-list-rules-spec-waf-action-app-firewall-detection-control-exclude-violation-contexts-exclude-violation) - Optional String  Defaults to `VIOL_NONE`<br>Possible values are `VIOL_NONE`, `VIOL_FILETYPE`, `VIOL_METHOD`, `VIOL_MANDATORY_HEADER`, `VIOL_HTTP_RESPONSE_STATUS`, `VIOL_REQUEST_MAX_LENGTH`, `VIOL_FILE_UPLOAD`, `VIOL_FILE_UPLOAD_IN_BODY`, `VIOL_XML_MALFORMED`, `VIOL_JSON_MALFORMED`, `VIOL_ASM_COOKIE_MODIFIED`, `VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS`, `VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE`, `VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT`, `VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST`, `VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION`, `VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS`, `VIOL_EVASION_DIRECTORY_TRAVERSALS`, `VIOL_MALFORMED_REQUEST`, `VIOL_EVASION_MULTIPLE_DECODING`, `VIOL_DATA_GUARD`, `VIOL_EVASION_APACHE_WHITESPACE`, `VIOL_COOKIE_MODIFIED`, `VIOL_EVASION_IIS_UNICODE_CODEPOINTS`, `VIOL_EVASION_IIS_BACKSLASHES`, `VIOL_EVASION_PERCENT_U_DECODING`, `VIOL_EVASION_BARE_BYTE_DECODING`, `VIOL_EVASION_BAD_UNESCAPE`, `VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST`, `VIOL_ENCODING`, `VIOL_COOKIE_MALFORMED`, `VIOL_GRAPHQL_FORMAT`, `VIOL_GRAPHQL_MALFORMED`, `VIOL_GRAPHQL_INTROSPECTION_QUERY`<br>[Enum: VIOL_NONE|VIOL_FILETYPE|VIOL_METHOD|VIOL_MANDATORY_HEADER|VIOL_HTTP_RESPONSE_STATUS|VIOL_REQUEST_MAX_LENGTH|VIOL_FILE_UPLOAD|VIOL_FILE_UPLOAD_IN_BODY|VIOL_XML_MALFORMED|VIOL_JSON_MALFORMED|VIOL_ASM_COOKIE_MODIFIED|VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS|VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE|VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT|VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST|VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION|VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS|VIOL_EVASION_DIRECTORY_TRAVERSALS|VIOL_MALFORMED_REQUEST|VIOL_EVASION_MULTIPLE_DECODING|VIOL_DATA_GUARD|VIOL_EVASION_APACHE_WHITESPACE|VIOL_COOKIE_MODIFIED|VIOL_EVASION_IIS_UNICODE_CODEPOINTS|VIOL_EVASION_IIS_BACKSLASHES|VIOL_EVASION_PERCENT_U_DECODING|VIOL_EVASION_BARE_BYTE_DECODING|VIOL_EVASION_BAD_UNESCAPE|VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST|VIOL_ENCODING|VIOL_COOKIE_MALFORMED|VIOL_GRAPHQL_FORMAT|VIOL_GRAPHQL_MALFORMED|VIOL_GRAPHQL_INTROSPECTION_QUERY] App Firewall Violation Type. List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION VIOL_HTTP_PROTOCOL_CRLF_CHARACTERS_BEFORE_REQUEST_START VIOL_HTTP_PROTOCOL_NO_HOST_HEADER_IN_HTTP_1_1_REQUEST VIOL_HTTP_PROTOCOL_BAD_MULTIPART_PARAMETERS_PARSING VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS VIOL_HTTP_PROTOCOL_CONTENT_LENGTH_SHOULD_BE_A_POSITIVE_NUMBER VIOL_EVASION_DIRECTORY_TRAVERSALS VIOL_MALFORMED_REQUEST VIOL_EVASION_MULTIPLE_DECODING VIOL_DATA_GUARD VIOL_EVASION_APACHE_WHITESPACE VIOL_COOKIE_MODIFIED VIOL_EVASION_IIS_UNICODE_CODEPOINTS VIOL_EVASION_IIS_BACKSLASHES VIOL_EVASION_PERCENT_U_DECODING VIOL_EVASION_BARE_BYTE_DECODING VIOL_EVASION_BAD_UNESCAPE VIOL_HTTP_PROTOCOL_BAD_MULTIPART_FORMDATA_REQUEST_PARSING VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST VIOL_HTTP_PROTOCOL_HIGH_ASCII_CHARACTERS_IN_HEADERS VIOL_ENCODING VIOL_COOKIE_MALFORMED VIOL_GRAPHQL_FORMAT VIOL_GRAPHQL_MALFORMED VIOL_GRAPHQL_INTROSPECTION_QUERY
+
+#### Server Name Matcher
+
+A [`server_name_matcher`](#server-name-matcher) block supports the following:
+
+<a id="server-name-matcher-exact-values"></a>&#x2022; [`exact_values`](#server-name-matcher-exact-values) - Optional List<br>Exact Values. A list of exact values to match the input against
+
+<a id="server-name-matcher-regex-values"></a>&#x2022; [`regex_values`](#server-name-matcher-regex-values) - Optional List<br>Regex Values. A list of regular expressions to match the input against
+
+#### Server Selector
+
+A [`server_selector`](#server-selector) block supports the following:
+
+<a id="server-selector-expressions"></a>&#x2022; [`expressions`](#server-selector-expressions) - Optional List<br>Selector Expression. expressions contains the kubernetes style label expression for selections
+
+#### Timeouts
+
+A [`timeouts`](#timeouts) block supports the following:
+
+<a id="timeouts-create"></a>&#x2022; [`create`](#timeouts-create) - Optional String (Defaults to `10 minutes`)<br>Used when creating the resource
+
+<a id="timeouts-delete"></a>&#x2022; [`delete`](#timeouts-delete) - Optional String (Defaults to `10 minutes`)<br>Used when deleting the resource
+
+<a id="timeouts-read"></a>&#x2022; [`read`](#timeouts-read) - Optional String (Defaults to `5 minutes`)<br>Used when retrieving the resource
+
+<a id="timeouts-update"></a>&#x2022; [`update`](#timeouts-update) - Optional String (Defaults to `10 minutes`)<br>Used when updating the resource
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import using namespace/name format
+terraform import f5xc_service_policy.example system/example
+```