Route learning vs OpenAPI validation — what the WAF actually does

Enterprise buyers often assume a WAF “learns the application” automatically — parameters, headers, JSON shapes, and API inventory. FLY Enterprise WAF does not do full application profiling from traffic. Here is an honest split of what is implemented.

Reporting mode: Method + URL only

In Reporting mode, WafPositiveSecurityService records legitimate routes as HTTP method + URL path (for example POST /api/login). When you switch to Protection, Positive Security can block requests to paths that were never seen during Reporting.

It does not automatically learn:

• Query or path parameter schemas
• JSON body structure or required fields
• Header profiles from live traffic
• OpenAPI documents generated from traffic

OpenAPI validation: separate, opt-in layer

When you enable API Security and upload an OpenAPI document manually, WafOpenApiRequestValidator validates:

• Path + HTTP method match
• Query/path parameters (required, type, min/max, maxLength, enum)
• JSON request bodies for application/json

This runs in the inspection pipeline before the OWASP rule engine — it is not the same subsystem as route learning.

Known limits (as of 2026.06)

• Manual schema upload — no auto-discovery from Reporting traffic
• No full $ref resolution in the validator
• Schema stored in database with a size cap (~5000 characters)
• JSON anomaly / drift detection — not in product

Practical rollout

1. Run Reporting to build Method + URL baseline
2. Review “would block” visibility before enforcement
3. Upload OpenAPI only for APIs where you need parameter/body enforcement
4. Switch to Protection when tuning is acceptable

Back to Trust Center