WAF baseline guidelines
Request requirements, security checks and what to send support when an API request is blocked.
These guidelines apply to all API requests. A web application firewall (WAF) checks requests for potentially unsafe content and can reject them with 403 Forbidden.
Request requirements
| Requirement | What to send | If not met |
|---|---|---|
| Request body | No larger than 25 MB | 403 Forbidden |
| URL query string | No longer than 2,048 bytes | 403 Forbidden |
| URL path | No longer than 1,024 bytes | 403 Forbidden |
| Cookie header | No larger than 10,240 bytes | 403 Forbidden |
| User-Agent | A User-Agent header identifying your application or HTTP client | 403 Forbidden when the header is missing |
| API specification | The documented endpoint, HTTP method, headers, parameters and body structure | An error response; check the endpoint’s error reference |
Size limits are measured in bytes, not characters. The body limit applies to the complete request body, not to each invoice in a batch. Endpoint-specific format requirements still apply: see the Unify XML request requirements.
User-Agent header
Most standard HTTP clients send this header by default. Check that your custom client sends it and that any proxy you use preserves it. Use an application name and version, such as Acme-Invoice-Integration/1.0.
curl 'https://prod.gets.complyance.io/v3/connect/companies?limit=20' \
--header "X-API-Key: ${COMPLYANCE_API_KEY}" \
--header 'Accept: application/json' \
--header 'User-Agent: Acme-Invoice-Integration/1.0'The User-Agent header does not replace your API key. Use the authentication header required by the endpoint.
Baseline security checks
The baseline contains 33 blocking rules across core checks, administrative path protection and known bad inputs. Each row below represents one rule. Passing these checks does not guarantee that the API accepts the request.
Core checks
| Check | Request part | What triggers a block |
|---|---|---|
| Missing User-Agent | User-Agent header | The header is missing. |
| Scanner identification | User-Agent header | The value identifies a known malicious bot or vulnerability scanner. |
| Query string size | URL query string | The query string limit is exceeded. |
| Cookie size | Cookie header | The cookie header limit is exceeded. |
| Body size | Body | The body limit is exceeded. |
| Path size | URL path | The path limit is exceeded. |
| Private metadata access | Body | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | Cookies | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | URL path | A pattern indicates an attempt to access private service metadata. |
| Private metadata access | Query parameters | A pattern indicates an attempt to access private service metadata. |
| Local file inclusion | Query parameters | A pattern indicates directory traversal or an attempt to read local files. |
| Local file inclusion | URL path | A pattern indicates directory traversal or an attempt to read local files. |
| Local file inclusion | Body | A pattern indicates directory traversal or an attempt to read local files. |
| Restricted file extensions | URL path | A system-file extension indicates a file that is unsafe to read or run. |
| Restricted file extensions | Query parameters | A system-file extension indicates a file that is unsafe to read or run. |
| Remote file inclusion | Query parameters | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Remote file inclusion | Body | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Remote file inclusion | URL path | A URL with an IPv4-address host resembles an attempt to load a remote file. |
| Cross-site scripting (XSS) | Cookies | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | Query parameters | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | Body | Content matches a script-injection pattern. |
| Cross-site scripting (XSS) | URL path | Content matches a script-injection pattern. |
Administrative path protection
| Check | Request part | What triggers a block |
|---|---|---|
| Administrative paths | URL path | The path resembles a server or application administration page. |
Known bad inputs
Remote code execution (RCE) means an attempt to make a server run an attacker’s code. These checks match known exploit patterns, not every mention of the named software.
| Check | Request part | What triggers a block |
|---|---|---|
| Java deserialization RCE | Header names and values | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | Body | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | URL path | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Java deserialization RCE | URL query string | A pattern indicates a Java deserialization or Spring RCE exploit. |
| Local host | Host header | The host points to the local machine rather than the published API host. |
| PROPFIND method | HTTP method | The request uses PROPFIND. |
| Exploitable paths | URL path | The path matches a known exploitable web application path. |
| Log4j RCE | Header names and values | A pattern indicates a Log4j RCE exploit. |
| Log4j RCE | URL query string | A pattern indicates a Log4j RCE exploit. |
| React RCE | Body | A pattern indicates the React vulnerability CVE-2025-55182. |
Use the published API host, documented paths and the method specified for the operation. Identify your application accurately. Send URLs only in fields that accept them, and omit unrelated cookies and executable script content. If legitimate invoice data is blocked, ask support to review it.
A valid API key and a body below the maximum size do not guarantee acceptance. Follow the endpoint’s request specification as well as these guidelines. Do not encode or alter legitimate invoice values to try to bypass a security check.
Report a blocked request
A 403 Forbidden or Access Denied response does not always indicate an API key problem. Check the request requirements above and any permissions or environment error described in authentication failures.
For a blocked request, contact support@complyance.io with:
- API endpoint: the URL and path, with sensitive query values removed.
- Request timestamp: the date and time, including the time zone; use UTC if possible.
- HTTP method: for example,
POSTorGET. - Response details: the HTTP status, response body and relevant response headers. Include a request identifier if one is present.
Remove API keys, authorization headers, cookies, signing secrets and customer data before sharing diagnostics. Do not assume a blocked response uses the endpoint’s usual JSON error format; check its status and Content-Type before parsing it.
Last updated