# WAF baseline guidelines

Request requirements, security checks and what to send support when an API request is blocked.

These guidelines apply to all API requests. A web application firewall (WAF) checks requests for potentially unsafe content and can reject them with `403 Forbidden`.

## Request requirements

| Requirement | What to send | If not met |
| - | - | - |
| Request body | No larger than 25 MB | `403 Forbidden` |
| URL query string | No longer than 2,048 bytes | `403 Forbidden` |
| URL path | No longer than 1,024 bytes | `403 Forbidden` |
| Cookie header | No larger than 10,240 bytes | `403 Forbidden` |
| User-Agent | A `User-Agent` header identifying your application or HTTP client | `403 Forbidden` when the header is missing |
| API specification | The documented endpoint, HTTP method, headers, parameters and body structure | An error response; check the endpoint’s error reference |

Size limits are measured in bytes, not characters. The body limit applies to the complete request body, not to each invoice in a batch. Endpoint-specific format requirements still apply: see the [Unify XML request requirements](https://docs.complyance.io/api-reference/unify/submit-and-retrieve/#xml-requests).

### User-Agent header

Most standard HTTP clients send this header by default. Check that your custom client sends it and that any proxy you use preserves it. Use an application name and version, such as `Acme-Invoice-Integration/1.0`.

```bash title="Send an explicit User-Agent"
curl 'https://prod.gets.complyance.io/v3/connect/companies?limit=20' \
  --header "X-API-Key: ${COMPLYANCE_API_KEY}" \
  --header 'Accept: application/json' \
  --header 'User-Agent: Acme-Invoice-Integration/1.0'
```

The `User-Agent` header does not replace your API key. Use the [authentication header](https://docs.complyance.io/api-reference/authentication/#headers) required by the endpoint.

## Baseline security checks

The baseline contains 33 blocking rules across core checks, administrative path protection and known bad inputs. Each row below represents one rule. Passing these checks does not guarantee that the API accepts the request.

### Core checks

| Check | Request part | What triggers a block |
| - | - | - |
| Missing User-Agent | `User-Agent` header | The header is missing. |
| Scanner identification | `User-Agent` header | The value identifies a known malicious bot or vulnerability scanner. |
| Query string size | URL query string | The [query string limit](https://docs.complyance.io/api-reference/waf-guidelines/#request-requirements) is exceeded. |
| Cookie size | Cookie header | The [cookie header limit](https://docs.complyance.io/api-reference/waf-guidelines/#request-requirements) is exceeded. |
| Body size | Body | The [body limit](https://docs.complyance.io/api-reference/waf-guidelines/#request-requirements) is exceeded. |
| Path size | URL path | The [path limit](https://docs.complyance.io/api-reference/waf-guidelines/#request-requirements) is exceeded. |
| Private metadata access | Body | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | Cookies | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | URL path | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | Query parameters | A pattern indicates an attempt to access private service metadata. |
| Local file inclusion | Query parameters | A pattern indicates directory traversal or an attempt to read local files. |
| Local file inclusion | URL path | A pattern indicates directory traversal or an attempt to read local files. |
| Local file inclusion | Body | A pattern indicates directory traversal or an attempt to read local files. |
| Restricted file extensions | URL path | A system-file extension indicates a file that is unsafe to read or run. |
| Restricted file extensions | Query parameters | A system-file extension indicates a file that is unsafe to read or run. |
| Remote file inclusion | Query parameters | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Remote file inclusion | Body | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Remote file inclusion | URL path | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Cross-site scripting (XSS) | Cookies | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | Query parameters | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | Body | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | URL path | Content matches a script-injection pattern. |

### Administrative path protection

| Check | Request part | What triggers a block |
| - | - | - |
| Administrative paths | URL path | The path resembles a server or application administration page. |

### Known bad inputs

Remote code execution (RCE) means an attempt to make a server run an attacker’s code. These checks match known exploit patterns, not every mention of the named software.

| Check | Request part | What triggers a block |
| - | - | - |
| Java deserialization RCE | Header names and values | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | Body | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | URL path | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | URL query string | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Local host | `Host` header | The host points to the local machine rather than the published API host. |
| PROPFIND method | HTTP method | The request uses `PROPFIND`. |
| Exploitable paths | URL path | The path matches a known exploitable web application path. |
| Log4j RCE | Header names and values | A pattern indicates a Log4j RCE exploit. |
| Log4j RCE | URL query string | A pattern indicates a Log4j RCE exploit. |
| React RCE | Body | A pattern indicates the React vulnerability CVE-2025-55182. |

Use the published API host, documented paths and the method specified for the operation. Identify your application accurately. Send URLs only in fields that accept them, and omit unrelated cookies and executable script content. If legitimate invoice data is blocked, ask support to review it.

A valid API key and a body below the maximum size do not guarantee acceptance. Follow the endpoint’s request specification as well as these guidelines. Do not encode or alter legitimate invoice values to try to bypass a security check.

## Report a blocked request

A `403 Forbidden` or `Access Denied` response does not always indicate an API key problem. Check the request requirements above and any permissions or environment error described in [authentication failures](https://docs.complyance.io/api-reference/authentication/#authentication-failures).

For a blocked request, contact <support@complyance.io> with:

- **API endpoint:** the URL and path, with sensitive query values removed.
- **Request timestamp:** the date and time, including the time zone; use UTC if possible.
- **HTTP method:** for example, `POST` or `GET`.
- **Response details:** the HTTP status, response body and relevant response headers. Include a request identifier if one is present.

Remove API keys, authorization headers, cookies, signing secrets and customer data before sharing diagnostics. Do not assume a blocked response uses the endpoint’s usual JSON error format; check its status and `Content-Type` before parsing it.

Last updated 11 November 2026

Source: https://docs.complyance.io/api-reference/waf-guidelines/