Ruleset format

Top-level fields

JSON rules

Use camelCase property names and enum names such as RequestMetadata, never numeric enum values. Unknown properties and duplicate properties reject the document. The maximum JSON nesting depth is 64. A signed envelope is limited to 16 MiB; its decoded payload is also bounded. Local draft JSON is limited to 16 MiB of UTF-8. Compiler collection and text limits can reject a smaller document.

Profiles

A ruleset with rules requires both standard and management, with distinct names. Each profile has an id, positive revision, name, positive maximumRequestBodyBytes, ruleIds and limits. Omitted body size and work limits use the engine defaults in Facts and limits. A route’s profile choice applies to every participating ruleset. Profiles contain no score threshold.

Exclusion rulesets require empty profiles and rules arrays. They refer to rules in another ruleset and apply only through route opt-in.

Rules

A rule has a positive id and revision, a message of at most 500 characters, a description of at most 2,000 characters and a lowercase identifier category, such as sql-injection. Rule identity is the pair of ruleset ID and rule ID, so custom rules can use small positive IDs.

severity and score must agree: Critical 5, Error 4, Warning 3 or Notice 2. paranoiaLevel is 1–4 and defaults to 1. action defaults to Score; Challenge still carries a valid severity/score pair but contributes zero at runtime. See Scoring and integrity tests.

inspectionStage is RequestMetadata, RequestBody, WebSocketMessage or Response. A rule has 1–16 conditions; their targets must belong to that stage. tags label rules for review and exclusions. diagnosticMetadata carries bounded descriptive key/value pairs.

Rule provenance includes kind, source and license. ClearplaneOriginal records original work. OwaspCrsAdapted also requires sourceVersion, sourceRuleId and sourceUri. PublishedTechniqueDerived requires sourceUri.

A complete local ruleset

This compact adaptation of the editor’s starter ruleset scores a query value containing <script, ignoring case. Both profiles use default work limits. The two integrity vectors check a matching and a clean query. It is a syntax example, not a replacement for an XSS ruleset.

{
  "rulesetId": "local",
  "version": "1.0.0",
  "schemaVersion": 1,
  "kind": "Application",
  "minimumClearplaneVersion": "1.0.0-alpha4",
  "releasedAt": "2026-09-12T00:00:00+00:00",
  "provenance": {
    "source": "Operator",
    "license": "Proprietary"
  },
  "profiles": [
    {
      "id": "standard",
      "revision": 1,
      "name": "Standard",
      "ruleIds": [
        1
      ],
      "limits": {}
    },
    {
      "id": "management",
      "revision": 1,
      "name": "Management",
      "ruleIds": [
        1
      ],
      "limits": {}
    }
  ],
  "rules": [
    {
      "id": 1,
      "revision": 1,
      "message": "Custom inspection example",
      "description": "A small example for the WAF rule language reference.",
      "category": "custom",
      "severity": "Critical",
      "score": 5,
      "paranoiaLevel": 1,
      "action": "Score",
      "provenance": {
        "kind": "ClearplaneOriginal",
        "source": "Operator",
        "license": "Proprietary"
      },
      "inspectionStage": "RequestMetadata",
      "conditions": [
        {
          "targets": [
            {
              "target": "QueryValue"
            }
          ],
          "operator": {
            "kind": "Contains",
            "value": "<script"
          },
          "transformations": [
            "Lowercase"
          ]
        }
      ]
    }
  ],
  "integrityTests": [
    {
      "id": "script-query",
      "profileId": "standard",
      "fields": [
        {
          "target": "QueryValue",
          "name": "q",
          "value": "<SCRIPT>alert(1)</SCRIPT>"
        }
      ],
      "expectedMatchedRuleIds": [
        1
      ]
    },
    {
      "id": "clean-query",
      "profileId": "management",
      "fields": [
        {
          "target": "QueryValue",
          "name": "q",
          "value": "hello"
        }
      ],
      "expectedMatchedRuleIds": []
    }
  ]
}