API Support for Bot Fight Mode (On/Off)

It would be nice if the CF API supported toggling “Bot Fight Mode” on or off.
As an agency we have MANY sites that we use tools on to maintain that cannot function with Bot Fight Mode turned on. API support for the feature could allow a tool to toggle it off and on during and after its operations.

PUT https://api.cloudflare.com/client/v4/zones/:zone_id/bot_management seems to be the one you’re after.

{"fight_mode":true,"enable_js":false,"session_score":false,"auth_id_logging":false,"auth_id_headers":null}

fight_mode being Bot Fight Mode and enable_js being the JavaScript detections. This is on the free plan.

3 Likes

A Cloudflare support agent told me the feature didn’t currently exist.
Will investigate what you’ve provided.

https://dash.cloudflare.com/api/v4/zones/{ZONE_ID}/rulesets
{
   "kind":"zone",
   "name":"zone",
   "phase":"http_request_sbfm",
   "rules":[
      {
         "action":"execute",
         "action_parameters":{
            "id":"",
            "overrides":{
               "rules":[
                  {
                     "id":"",
                     "enabled":true,
                     "action":"{YOUR_ACTION}"
                  }
               ]
            }
         },
         "expression":"true"
      }
   ]
}

I believe the endpoint isn’t documented or at least I wasn’t able to find it in the docs.

They asked for SBFM though, not bot management.

2 Likes

This would explain some things.

‘Bots’ in general uses the same path. :person_shrugging:

Not sure on SBFM specific params but it works fine for BFM.

Do something on the dashboard with DevTools open and you can figure out the API route/request that’s expected - lots of endpoints are undocumented, sadly.

:frowning_face:

3 Likes

This works for me:

curl ‘https://api.cloudflare.com/client/v4/zones/:zone_id/bot_management
-X ‘PUT’
–data-raw ‘{“fight_mode”:true}’

requires Zone Bot Management permission.

1 Like