openwaf-cloud ctl is OpenWAF's command-line client. It talks only to the public API with an API token, so it has exactly the permissions of that token and goes through the same validation, versioning and audit log as the dashboard. It is built for scripted, repeatable operations: every change takes a reason, is simulated first and shows its diff, and can wait until every edge node has applied it.
export OPENWAF_API_URL=https://dash.openwaf.dev
export OPENWAF_TOKEN_FILE=~/.config/openwaf/token
openwaf-cloud ctl zones list
openwaf-cloud ctl zones set example.com waf_level=high --reason "Raise WAF level" --waitGet startedget the CLI, give it a token and run your first command.Changes: simulation and confirmation
--reason, --dry-run, --yes and --wait.Arguments, output and exit codeskey=value arguments, --json and what each exit code means.Environment and global optionsOPENWAF_API_URL, OPENWAF_TOKEN, OPENWAF_TOKEN_FILE, OPENWAF_ORG.zonesadd, inspect, configure, merge, revert and delete zones.recordsDNS records, including BIND imports.Commands
| Command family | What it covers |
|---|---|
zones | Zones, their edge settings, history, diffs, reverts, propagation and merges. |
records | DNS records. |
rules | Edge rules: IP, country, WAF exceptions and simple rate limits. |
ratelimit | Per-path rate limiting rules of a zone or a name. |
certs | Edge certificates and the certificate status of each site. |
origin-certs and origin-tls | Origin certificates from the OpenWAF Origin CA and TLS to the origin. |
cache | Cache purges. |
ai | AI agents and crawlers, MCP Shield, the AI bot catalog and agent readiness. |
rum | Real user monitoring (Core Web Vitals). |
dns | What the edge DNS answers for a delegated zone. |
audit | The organisation's audit log. |
clients | An agency's end clients. |
brand | The organisation's brand. |
whitelabel | Your own dashboard domain and name servers. |