# WAF exceptions

> Switch off one WAF rule, every WAF rule or one shield on a path when it blocks legitimate traffic, without lowering the level for the whole site.

A WAF exception is a rule of kind `waf_exception`: a `rule_id` and a `path_pattern`, optionally limited to some names of the zone. On matching paths, that rule adds no points to the anomaly score; the other rules that matched the same request still count.

## Find the rule id

Open the blocked (or, in log-only mode, logged) request in [security events](https://developers.openwaf.dev/analytics/security-events/). Its `rule_id` is the WAF rule that decided it, for example `942100` (a CRS SQL injection rule), `10002` (an OpenWAF rule) or `1003` (the open redirect shield).

## Values of rule_id

| `rule_id` | Effect on the path |
|---|---|
| `0` | Every WAF rule (OWASP CRS and OpenWAF's rules). Not the shields. |
| `1001`–`1008` | That [shield](https://developers.openwaf.dev/waf/shields/) only. |
| any other id | That rule only. |

## Values of path_pattern

| `path_pattern` | Matches |
|---|---|
| empty or `*` | every path |
| ends in `*`, e.g. `/api/upload/*` | every path that starts with `/api/upload/` |
| anything else, e.g. `/contact` | exactly that path |

The path is compared without the query string, after cleaning `//` and `.` segments.

## Add an exception

**Dashboard**

Domain → **Security → Firewall → Rules → WAF exceptions** → **Add WAF exception**. Enter the **WAF rule** (`0`, a shield id or the rule id), the **Path**, optionally the names it **Applies to** and a **Note**.
**CLI**

```sh
openwaf-cloud ctl rules add example.com kind=waf_exception rule_id=942100 path_pattern='/search' \
  note="Search box accepts SQL-like text" --reason "False positive on /search"
```
**API**

```sh
curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/example.com/rules" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "X-Change-Reason: False positive on /search" \
  -H "Content-Type: application/json" \
  -d '{"kind": "waf_exception", "rule_id": 942100, "path_pattern": "/search", "note": "Search box accepts SQL-like text"}'
```
**MCP**

`add_rule` with `{"zone": "example.com", "kind": "waf_exception", "rule_id": 942100, "path_pattern": "/search", "reason": "…"}`; simulate, then confirm.


Add `hosts` (`hosts:='["shop.example.com"]'` in the CLI) to limit the exception to some names. Rules can't be edited: remove the rule and add it again.

> **Caution**
>
> Keep exceptions narrow. A `rule_id` 0 exception on `*` disables the WAF for the whole site; prefer the exact rule on the exact path.