close
Skip to content
Image Cloudflare API
Start here
API Reference

Fraud

Get Fraud Detection Settings
GET/zones/{zone_id}/fraud_detection/settings
Update Fraud Detection Settings
PUT/zones/{zone_id}/fraud_detection/settings
ModelsExpand Collapse
FraudSettings object { authentication_settings, user_profiles, username_expressions }
authentication_settings: optional object { failure_criteria, success_criteria }

Configuration for classifying login authentication outcomes based on the origin response. Requires user_profiles to be enabled.

  • Success and failure criteria are independently updatable — sending only success_criteria leaves failure codes untouched, and vice versa.
  • Omit authentication_settings entirely to leave both unchanged.
  • Status codes must not overlap between success and failure criteria.
failure_criteria: optional object { kind, status_codes }

Criterion for identifying failed login responses.

kind: "status_code"

The type of criterion. Currently only status_code is supported.

status_codes: optional array of number

HTTP status codes to match against the origin response.

  • Maximum of 10 codes per criterion.
  • Each code must be a valid HTTP status code (100-599).
  • Codes are deduplicated and sorted on save.
  • Omit to leave unchanged on update.
  • Provide an empty array [] to clear codes on update.
success_criteria: optional object { kind, status_codes }

Criterion for identifying successful login responses.

kind: "status_code"

The type of criterion. Currently only status_code is supported.

status_codes: optional array of number

HTTP status codes to match against the origin response.

  • Maximum of 10 codes per criterion.
  • Each code must be a valid HTTP status code (100-599).
  • Codes are deduplicated and sorted on save.
  • Omit to leave unchanged on update.
  • Provide an empty array [] to clear codes on update.
user_profiles: optional "enabled" or "disabled"

Whether Fraud User Profiles is enabled for the zone.

One of the following:
"enabled"
"disabled"
username_expressions: optional array of string

List of expressions to detect usernames in write HTTP requests.

  • Maximum of 10 expressions.
  • Omit or set to null to leave unchanged on update.
  • Provide an empty array [] to clear all expressions on update.
  • Invalid expressions will result in a 10400 Bad Request with details in the messages array.