When API Security and a manually uploaded OpenAPI document are enabled for an application, WafOpenApiRequestValidator validates requests before the OWASP CRS rule engine runs.
When to use it
- You have a maintained OpenAPI spec for critical API operations
- You need parameter type/required/enum enforcement at the edge
- Route learning alone is insufficient (it only covers Method + URL)
What is validated (in product)
- Path + HTTP method match against uploaded operations
- Query and path parameters: required, type, min/max, maxLength, enum
- JSON request bodies for
application/json - JWT bearer checks and BOLA path heuristics on the same API Security layer when configured
Pipeline position
OpenAPI validation (step 7) → virtual patches → detection modules → OWASP rule engine (step 11). Payload attacks can still be caught by CRS after schema passes.
Honest limits
- Manual upload only — no auto-discovery from Reporting traffic
- No full
$refresolution — inline schemas work best - Schema JSON stored in DB with size cap (~5000 characters)
- No JSON behavioral anomaly / schema drift detection (Level 4 — not implemented)
- Invalid schema JSON when configured → fail-closed on that layer
| Capability | Status |
|---|---|
| Parameter + JSON body enforcement | In product (opt-in) |
| Auto-discovery from traffic | Not in product |
| Per-operation rate limits from OpenAPI | Not in product |
| Advanced BOLA / object-level auth context | Heuristics only — not full L4 |