ai_agents.endpoints protects up to 20 of your own AI endpoints, such as /api/chat. For each request to an endpoint path, the edge reads the body (and forwards it intact), runs 27 deterministic detectors in English and Spanish, checks the spend parameters and applies per-IP and per-session limits. For MCP servers, use MCP Shield instead.
What is detected
- Injection: instruction overrides, system prompt extraction, jailbreak personas ("DAN", "developer mode"), fake system or compliance notices, chat template tokens (
<|im_start|>), runs of zero-width characters, HTML comments with orders, base64 that decodes to orders and exfiltration patterns (curl … | sh,env | grep KEY). - Cost limits (denial of wallet): more than 65,536 output tokens (
max_tokensand equivalents), more than 8 completions (n,best_of…), more than 1,000 messages or more than 128 tools.
Each detection is recorded as {id, label, snippet}, with a snippet of at most 160 bytes of the request, shown as plain text in the dashboard and the CLI.
Endpoint fields
| Field | Rules |
|---|---|
path_prefix | Starts with /, at most 256 bytes, unique. |
methods | Any of POST, PUT, PATCH, GET. |
max_body_bytes | 1–1,048,576. A larger body is a limit violation. |
rpm_per_ip | Requests per minute per IP; 0 = no limit; at most 100,000. |
rpm_per_session | Requests per minute per session; 0 = no limit; at most 100,000. |
session_header / session_cookie | Where the session value comes from. |
injection_action | log or block. |
limit_action | log or block, for rate, size and cost limits. |
Answers in enforce mode
| Violation | Answer |
|---|---|
Over rpm_per_ip or rpm_per_session | 429 {"error":"rate limit exceeded"} with Retry-After |
Body over max_body_bytes | 413 {"error":"request body too large"} |
| Injection detected | 403 {"error":"request rejected"} |
| Cost limit exceeded | 400 {"error":"request exceeds cost limits"} |
In log mode, or with the action log, the request continues and an injection or cost_limit event is recorded.
Add an endpoint
AI Crawl Control → AI endpoints.
openwaf-cloud ctl zones set example.com ai_agents.endpoints:='[{"path_prefix":"/api/chat","methods":["POST"],
"max_body_bytes":32768,"rpm_per_ip":30,"rpm_per_session":0,"session_header":"","session_cookie":"",
"injection_action":"block","limit_action":"log"}]' --reason "Protect the chat API"PATCH …/edge with {"ai_agents": {"endpoints": [...]}}; the list is replaced whole.
ai_agents_settings with "patch": {"endpoints": [...]}.
The AI endpoints report (--view endpoints) shows injections, limits, blocks and detections per endpoint.