Skip to content

Schema learning

Last updated View as MarkdownAgent setup

Schema Learning observes qualifying traffic for selected operations. It learns expected request fields and constraints for a Schema Profile.

Start profile learning

  1. In the Cloudflare dashboard, go to Web Assets > Operations.

    Go to Web assets ↗

  2. Open the operation overflow menu and select Learn profile.

  3. After the profile becomes available, select View details.

  4. Review the learned schema under Security overview.

Cloudflare runs an always-on detection after the learned profile becomes available. The detection does not mitigate requests by itself.

To investigate results, refer to Analyze profile detections. To mitigate violations, refer to Enforce profiles with Custom Rules.

Meet learning requirements

Learning runs weekly using qualifying traffic from the previous seven days. Only requests that received a 2xx response contribute.

The field-learning threshold requires 1,000 qualifying requests. The boundary-learning threshold requires 10,000 qualifying requests.

The first profile appears after the next weekly learning run. This can take up to seven days after meeting the relevant threshold.

For supported request components, constraints, and limitations, refer to Schema Profiles.

Export a schema

Export creates a separate OpenAPI file from the current learned profile. It does not change the profile or its detection.

  1. In the Cloudflare dashboard, go to the Web Assets page.

    Go to Web assets ↗

  2. Go to the Operations tab.

  3. Select Export schema and choose a hostname to export.

  4. Select whether to include learned parameters and rate limit recommendations.

  5. Select Export schema and choose a location to save the file.

Learned schema contents

Exported schemas include the listed hostname in the servers section. They also include operations by hostname, method, and path.

For operations that receive sufficient traffic, exported schemas also include:

  • Detected path variables and formats
  • Detected query parameters and formats
  • Detected POST, PUT, and PATCH body variable names and formats for application/json content types

Exported schemas can optionally include API Shield rate limit recommendations.

For a fixed Schema Profile, upload the exported file through Schema validation.

Was this helpful?