Configure App/API Exceptions
Last update：2026-08-20 19:01:13
Reading time: About 2 minutes
Prerequisites: A hostname has been onboarded, and a managed rule with the DDoS Managed Challenge action has been enabled
When You Need to Configure an App/API Exception
Managed rules with the DDoS Managed Challenge action issue a Cookie or JavaScript challenge to requests, which only works for Web/H5 website types. If your website serves the following types of business, you need to configure an exception based on your APP/API request characteristics:
- Native APP
- Hybrid APP
- Callback API or other server-side API
Once an exception is configured, matching requests skip protection from managed rules that use the DDoS Managed Challenge action and proceed directly to the next stage of processing.
Business Category Reference
When configuring an exception, choose the appropriate match condition based on your business type:
| Business Category | Exception Needed? | Recommended Match Condition |
|---|---|---|
| Native APP (native iOS/Android development, no WebView) | Generally not needed, unless a browser User-Agent is used | If a browser UA is used, configure the exception based on the User-Agent characteristic |
| Hybrid APP (native + H5 hybrid, some pages use WebView) | Needed, but only for the native layer’s interfaces | Configure based on a characteristic that distinguishes native requests (e.g., User-Agent contains the app name/version) |
| Callback API (third-party system callbacks, such as payment callbacks) | Needed | Configure based on the callback path characteristic (e.g., URI=/api/callback) |
| Other server-side API (backend-only calls that don’t support JS verification) | Needed | Configure based on the API path or a custom request header |
Configuration Steps
- Go to Security Settings > Configurations > Shared Configurations.
- Under the App/API Exceptions tab, click Create.
- Select the Type based on your business requirements, enter the App/API Name, and define the Match Conditions. Once configured, click Confirm.
- In the App/API Exceptions list, click the association icon for the exception, select the hostnames to apply the exception to in the hostname association dialog that appears, and click Confirm to complete the association.