Create a custom ruleset

Use the Create an account or zone ruleset operation to create a custom ruleset, making sure that you:

• Set the kind field to custom.
• Specify the name of the phase where you want to create the custom ruleset in the phase field.

You can also specify the list of rules to include in the custom ruleset in the rules array. To add rules after creating the custom ruleset, refer to Add rules to a custom ruleset.

If you are using Terraform, refer to WAF custom rules configuration using Terraform for examples of creating and deploying custom rulesets.

If you are using the Cloudflare dashboard, refer to Work with custom rulesets in the dashboard.

The following request creates a new custom ruleset at the account level. The response will include the ID of the new custom ruleset in the id field.

Required API token permissions

• Mass URL Redirects Write
• Magic Firewall Write
• L4 DDoS Managed Ruleset Write
• Transform Rules Write
• Select Configuration Write
• Account WAF Write
• Account Rulesets Write
• Logs Write

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Custom Ruleset 1",
		"description": "My First Custom Ruleset (account)",
		"kind": "custom",
		"phase": "http_request_firewall_custom"
	}'

{
	"result": {
		"id": "f82ccda3d21f4a02825d3fe45b5e1c10",
		"name": "Custom Ruleset 1",
		"description": "My First Custom Ruleset (account)",
		"kind": "custom",
		"version": "1",
		"last_updated": "2025-08-09T10:27:30.636197Z",
		"phase": "http_request_firewall_custom"
	},
	"success": true,
	"errors": [],
	"messages": []
}

You can include a list of rules in the custom ruleset creation request. If you have not added any rules, refer to Add rules to a custom ruleset for more information.

The following request creates a new custom ruleset at the zone level. The response will include the ID of the new custom ruleset in the id field.

Required API token permissions

• Response Compression Write
• Config Settings Write
• Dynamic URL Redirects Write
• Cache Settings Write
• Custom Errors Write
• Origin Write
• Managed headers Write
• Zone Transform Rules Write
• Mass URL Redirects Write
• Magic Firewall Write
• L4 DDoS Managed Ruleset Write
• HTTP DDoS Managed Ruleset Write
• Sanitize Write
• Transform Rules Write
• Select Configuration Write
• Bot Management Write
• Zone WAF Write
• Account WAF Write
• Account Rulesets Write
• Logs Write
• Logs Write

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Custom Ruleset 1",
		"description": "My First Custom Ruleset (zone)",
		"kind": "custom",
		"phase": "http_request_firewall_custom"
	}'

{
	"result": {
		"id": "f82ccda3d21f4a02825d3fe45b5e1c10",
		"name": "Custom Ruleset 1",
		"description": "My First Custom Ruleset (zone)",
		"kind": "custom",
		"version": "1",
		"last_updated": "2025-08-09T10:27:30.636197Z",
		"phase": "http_request_firewall_custom"
	},
	"success": true,
	"errors": [],
	"messages": []
}

You can include a list of rules in the custom ruleset creation request. If you have not added any rules, refer to Add rules to a custom ruleset for more information.