From e7674b5369d1f4f81d5a252635a95c4dd6ac2024 Mon Sep 17 00:00:00 2001 From: Daniel Harper <529730+djhworld@users.noreply.github.com> Date: Fri, 25 Sep 2026 12:56:24 +0100 Subject: [PATCH] [API Shield] Update API Shield phase definition in rulesets-engine phase list --- src/content/docs/ruleset-engine/reference/phases-list.mdx | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/content/docs/ruleset-engine/reference/phases-list.mdx b/src/content/docs/ruleset-engine/reference/phases-list.mdx index e23e1c5f8ee..5fef48759fa 100644 --- a/src/content/docs/ruleset-engine/reference/phases-list.mdx +++ b/src/content/docs/ruleset-engine/reference/phases-list.mdx @@ -38,13 +38,13 @@ The phases execute in the order they appear in the table. | `http_request_sanitize` | [URL normalization](/rules/normalization/) | | `http_request_transform` | [URL Rewrite Rules](/rules/transform/url-rewrite/) | | _N/A_ (internal phase) | [Waiting Room Rules](/waiting-room/additional-options/waiting-room-rules/) | -| `http_request_api_gateway_early`\* | [API Shield](/api-shield/) | +| _N/A_ (internal detection phase)† | [API Shield](/api-shield/) | | `http_config_settings` | [Configuration Rules](/rules/configuration-rules/) | | `http_request_origin` | [Origin Rules](/rules/origin-rules/) | | `ddos_l7`\* | [HTTP DDoS Attack Protection](/ddos-protection/managed-rulesets/http/) | | `http_request_firewall_custom` | [Custom rules (Web Application Firewall)](/waf/custom-rules/) | | `http_ratelimit` | [Rate limiting rules (WAF)](/waf/rate-limiting-rules/) | -| `http_request_api_gateway_late` | [API Shield](/api-shield/) | +| _N/A_ (internal mitigation phase)‡ | [API Shield](/api-shield/) | | `http_request_firewall_managed` | [WAF Managed Rules](/waf/managed-rules/) | | `http_request_sbfm` | [Super Bot Fight Mode](/bots/get-started/super-bot-fight-mode/) | | _N/A_ (internal phase) | [Cloudflare Access](/cloudflare-one/access-controls/policies/) application check | @@ -57,6 +57,10 @@ The phases execute in the order they appear in the table. \* _This phase is for configuration purposes only — the corresponding rules will not be executed at this stage in the request handling process._ +† _Detections run at this phase. Detection results are available to later phases._ + +‡ _Mitigation actions can run at this stage if configured._ + For Cloudflare Access, the `Cloudflare Access` row refers to Access application checking. Access enforcement and handling run in later internal phases, after Bulk Redirects.