Agent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey77 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Manage AWS WAF Classic Web ACLs, rules, and match conditions so an agent can block bad IPs, geo-restrict traffic, and add SQLi/XSS protection to CloudFront and ALB.
Use for: Block traffic from a list of malicious IP addresses, Create a geo-match rule that blocks requests from specific countries, Add a SQL injection match condition to my Web ACL, Set up a rate-based rule to throttle abusive clients
Not supported: Does not handle DDoS mitigation, network-layer firewall rules, or modern WAFv2 rule groups - use for managing AWS WAF Classic match conditions, rules, and Web ACLs only.
Jentic publishes the only available OpenAPI specification for AWS WAF Classic, keeping it validated and agent-ready. AWS WAF Classic protects CloudFront distributions and Application Load Balancers from common web exploits by matching incoming requests against rules built from byte-match, IP-set, geo-match, regex, size-constraint, SQL-injection, and XSS conditions. The 77 operations cover full CRUD on every match-condition type, on rules and rate-based rules, on rule groups, and on Web ACLs, along with the change-token workflow that AWS WAF Classic uses for consistency. Note: AWS recommends WAFv2 for new deployments; this API covers the original (Classic) version.
Install Jentic One Beta
Connect the AWS WAF Classic to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS WAF Classic, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fwaf" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Famazonaws.com%2Fwaf" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS WAF Classic API.
Build IP, geo, byte, regex, size, SQL injection, and XSS match conditions
Compose match conditions into rules and rate-based rules
Group rules into reusable rule groups
Assemble Web ACLs and order rules with explicit priority
Manage the change-token workflow that AWS WAF Classic uses for consistent updates
Enumerate Web ACLs, rules, and conditions across the account
Migrate Classic Web ACLs into WAFv2 stacks via CreateWebACLMigrationStack
Use Cases
Patterns agents use AWS WAF Classic API for, with concrete tasks.
★ IP Blocklist Automation
Automate response to abuse by syncing a threat-intel IP feed into an AWS WAF Classic IPSet. UpdateIPSet (with a change token from GetChangeToken) adds and removes /32 or /24 entries without recreating the set, and the IPSet is referenced by a rule in a Web ACL attached to CloudFront or an ALB. End-to-end, an agent can react to abuse signals in seconds without touching the underlying L7 protection layer.
Call GetChangeToken, then UpdateIPSet with IPSetId, ChangeToken, and Updates listing IPSetDescriptors with Action INSERT for each malicious /32 IP.
Rate-Based Throttling for Login Abuse
Create a RateBasedRule that triggers when a single IP exceeds a threshold (e.g. 2000 requests in 5 minutes) and pair it with byte-match conditions on /login. CreateRateBasedRule sets the RateLimit and RateKey; UpdateWebACL inserts the rule with a BLOCK action above other rules. This is the standard AWS WAF Classic pattern for stopping credential-stuffing without rolling your own rate limiter.
Call CreateRateBasedRule with Name 'login-rate-limit', MetricName 'loginRateLimit', RateKey 'IP', RateLimit 2000, then UpdateWebACL to add the new rule with Action BLOCK at Priority 1.
Migrating to WAFv2
AWS recommends migrating from WAF Classic to WAFv2 for richer rule constructs, managed rule groups, and JSON-based configuration. CreateWebACLMigrationStack generates a CloudFormation template that recreates an existing Classic Web ACL as a v2 ACL in a target S3 bucket; deploying that stack gives you a WAFv2 equivalent you can iterate on. List operations on Classic resources help inventory what still needs migrating.
Call CreateWebACLMigrationStack with WebACLId of the Classic ACL, S3BucketName for the generated CloudFormation, and IgnoreUnsupportedType=false.
Agent-Driven Web ACL Updates via Jentic
A security agent ingesting threat-intel events can update WAF Classic IP sets and rules through Jentic without ever holding AWS keys. The agent submits an intent like 'block these ten IPs in production WAF'; Jentic loads GetChangeToken, then UpdateIPSet, executes them in sequence, and returns the new ChangeToken status. All keys stay vaulted and the agent's context never sees a SecretAccessKey.
Through Jentic, search for 'add ips to an aws waf classic ip set', load GetChangeToken and UpdateIPSet, and execute the pair to insert a list of IPs.
Key Endpoints
77 endpoints — jentic publishes the only available openapi specification for aws waf classic, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/#X-Amz-Target=AWSWAF_20150824.CreateIPSet
Create an IP set used by a rule
POST
/#X-Amz-Target=AWSWAF_20150824.CreateRateBasedRule
Create a rate-based rule
POST
/#X-Amz-Target=AWSWAF_20150824.CreateWebACL
Create a Web ACL
POST
/#X-Amz-Target=AWSWAF_20150824.GetChangeToken
Fetch a change token before mutating resources
POST
/#X-Amz-Target=AWSWAF_20150824.CreateWebACLMigrationStack
Generate a CloudFormation stack to migrate to WAFv2
POST
/#X-Amz-Target=AWSWAF_20150824.CreateIPSet
Create an IP set used by a rule
POST
/#X-Amz-Target=AWSWAF_20150824.CreateRateBasedRule
Create a rate-based rule
POST
/#X-Amz-Target=AWSWAF_20150824.CreateWebACL
Create a Web ACL
POST
/#X-Amz-Target=AWSWAF_20150824.GetChangeToken
Fetch a change token before mutating resources
POST
/#X-Amz-Target=AWSWAF_20150824.CreateWebACLMigrationStack
Generate a CloudFormation stack to migrate to WAFv2
Jentic AI Readiness Score
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
A
AWS WAF
- AI-Aware (B-)60/100
99
Foundational Compliance62
Developer Experience & Jentic Compatibility37
AI-Readiness & Agent Experience90
Agent Usability50
Security100
AI DiscoverabilityPowered by JenticScoring Framework 1.0.0 | Scoring Engine 0.4.0
Show dimension breakdown
99
Foundational Compliance
Base layer of spec validity and structural soundness.
Grade: A+Signals: 4
94%
Lint Results
Aggregated quality score from linter diagnostics, weighted by severity.
100%
Resolution Completeness
Percentage of `$ref` references that resolve successfully.
100%
Specification Validity
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
100%
Structural Integrity
Structural correctness score based on schema issues using logarithmic dampening.
62
Developer Experience & Jentic Compatibility
Clarity, completeness, and ingestion readiness for developers and tooling.
Grade: B-Signals: 4
2%
Example Density
How richly the API is illustrated with examples.
97%
Example Validity
Percentage of examples that conform to their schemas.
50%
Response Coverage
Percentage of operations with complete response definitions (success, client error, server error).
100%
Tooling Readiness
Health of API ingestion, bundling, and resolution within Jentic pipelines.
37
AI-Readiness & Agent Experience
Semantic breadth, depth, and agent comprehension for AI systems.
Grade: FSignals: 4
49%
Description Coverage
Coverage of descriptions across API elements.
0%
Error Standardization
Coverage of RFC 9457 Problem Details for error responses.
100%
OperationId Quality
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
0%
Summary Coverage
Coverage of summaries across operations/tags/info.
90
Agent Usability
Functional utility, complexity comfort, and AI orchestration readiness.
Grade: ASignals: 1
90%
Complexity Comfort
Agent comfort level based on API operational and structural complexity.
50
Security
Trust, risk posture, and security compliance.
Grade: C-Signals: 1
50%
Authentication Strength
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
100
AI Discoverability
Findability, semantic richness, and reasoning readiness.
Grade: A+Signals: 1
100%
Descriptive Richness
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring AWS WAF Classic by hand means computing SigV4 signatures, managing the GetChangeToken concurrency step, and routing calls through the X-Amz-Target action header yourself. Through Jentic you install once, import WAF Classic from the API Directory, store the access keys once, and your agent calls it.
Permission scoping
WAF Classic routes its actions through one endpoint by X-Amz-Target rather than resource ids in the path, so scope the agent to the operations it needs, such as GetChangeToken and CreateIPSet. You choose the operations it may call, so a web ACL delete is not included unless you add it.
Credential isolation
Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to sign each WAF Classic request with SigV4 at execution time. They never enter the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'add IPs to a WAF Classic IP set' or 'create a rate-based rule', and Jentic returns the matching WAF Classic operation with its input schema so the agent calls the right endpoint without browsing the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS WAF Classic API through Jentic.
Why is there no official OpenAPI spec for AWS WAF Classic?
AWS does not publish an OpenAPI specification for AWS WAF Classic; it ships Smithy models and language-specific SDKs instead. Jentic generates and maintains this OpenAPI spec so that AI agents and developers can call AWS WAF Classic via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.
What authentication does AWS WAF Classic use?
AWS WAF Classic uses AWS SigV4 with X-Amz-Target identifying the action (e.g. AWSWAF_20150824.UpdateIPSet). It also requires the change-token workflow: every mutating call must include a fresh ChangeToken obtained from GetChangeToken. Through Jentic, your AWS keys remain in the vault and Jentic signs each request.
Can I block traffic by country with AWS WAF Classic?
Yes. Create a GeoMatchSet with GeoMatchConstraints listing ISO country codes, attach it to a rule via UpdateRule, and add the rule to a Web ACL with a BLOCK action. Combine with byte-match conditions to scope the block to specific paths or hosts.
What are the rate limits for AWS WAF Classic?
Management API throughput is modest - a few transactions per second per account - because most calls require a fresh change token. The data-plane (request inspection) is independent and scales with the protected service. Most quotas (rules per Web ACL, IP entries per set) are increasable via AWS Support.
How do I add IPs to a WAF IP set through Jentic?
Search Jentic with 'add ips to an aws waf classic ip set', load GetChangeToken, then UpdateIPSet, and execute the pair: GetChangeToken returns a ChangeToken, then UpdateIPSet uses it together with IPSetId and Updates listing IPSetDescriptors to insert.
Should I use WAF Classic or WAFv2 for new deployments?
AWS recommends WAFv2 for new work; it offers managed rule groups, JSON-style rule statements, and CloudFront and Regional integrations under one API. Use this Classic API when working with existing Classic Web ACLs or running CreateWebACLMigrationStack to upgrade them.
Can I attach a WAF Classic Web ACL to an Application Load Balancer?
Yes. Create the Web ACL with this API, then call AssociateWebACL to attach it to the ALB or CloudFront distribution. The Web ACL evaluates inbound requests in priority order and applies the matched rule's action (ALLOW, BLOCK, or COUNT).
Can I limit what my agent is allowed to do with the AWS WAF Classic API?
Yes. Because you run Jentic One yourself, your own rules decide which AWS WAF Classic operations and credentials the agent may use. AWS WAF Classic routes every action through a single endpoint by X-Amz-Target rather than by resource ids in the path, so you scope the agent to just the operations it needs, such as GetChangeToken and CreateIPSet. You choose the operations it may call, so a Web ACL delete is not available to the agent unless you explicitly add it.
GET STARTED