List available managed rulesets for your account by calling GET /accounts/{account_id}/rulesets and filtering for phase http_request_firewall_managed; note the ruleset IDs for the Cloudflare Managed Ruleset and the Cloudflare OWASP Core Ruleset.
Deploy a managed ruleset to a zone by creating an execute rule in the zone's http_request_firewall_managed phase entry-point ruleset: POST to /zones/{zone_id}/rulesets/{entrypoint_ruleset_id}/rules with action=execute and the managed ruleset ID in action_parameters.id.
Set overrides in the action_parameters.overrides object to change individual rule actions or sensitivity: specify rules by ID with a list in rules[], setting each rule's action or enabled field; use categories[] to override entire rule categories.
Create an exception (skip rule) by adding a rule with action=skip before the execute rule; in the action_parameters.ruleset field set the value to current, or target specific rulesets in action_parameters.rulesets[]; the position object (before: EXECUTE_RULE_ID) ensures the skip evaluates first.
Add a filter expression to the skip rule so it only exempts specific traffic (for example a known-good IP range or a specific URL path used by an internal tool) rather than disabling protection broadly.
Retrieve the phase entry-point ruleset ID for a zone with GET /zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint if you do not already have it.
Known gotchas
Exceptions have higher priority than overrides; if both a skip rule and an override apply to the same request, the skip takes effect and the override is ignored—order exception rules carefully.
The Cloudflare OWASP Core Ruleset sensitivity (low, medium, high) is set via action_parameters.overrides.categories at deploy time; the default sensitivity may be too aggressive for APIs that send large JSON payloads and should be tuned after observing false positives.
Each managed ruleset can be deployed at most once per zone but multiple times at the account level with different configurations; if you need different exception sets for different subdomains, use account-level deployment scoped by hostname expressions.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp