导航|地址|刷新
Functions

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






Ruleset Engine

/




Overview


About


Overview

Phases

Rulesets

Rules






Basic API operations


View rulesets

Add rules to phase entry point rulesets

Deploy rulesets






Work with managed rulesets


Overview

Deploy a managed ruleset

Override a managed ruleset


Override examples


Overview

Set WordPress rules to Block

Enable only Joomla rules

Enable only selected rules

Deploy a managed ruleset with ruleset, tag, and rule overrides

Adjust the sensitivity of an HTTP DDoS rule to Low

Adjust an L3/4 DDoS rule ↗





Create an exception






Work with custom rulesets


Overview

Create a custom ruleset

Add rules to a custom ruleset

Deploy a custom ruleset






Rules language


Overview


Expressions


Overview

Edit in the dashboard





Operators and grouping symbols

Values

Actions


Fields


Overview

Fields reference





Functions






Rulesets API


Overview

JSON objects

Endpoints

List and view rulesets

Create a ruleset

Update or deploy a ruleset

Add a rule to a ruleset

Update a rule in a ruleset

Delete a rule in a ruleset

Delete a ruleset






Reference


Phases list






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Ruleset Engine llms.txt ↗

Ruleset Engine llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/Ruleset Engine

/Rules language

/Functions



Functions


Last updated May 4, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewTransformation functions any all encode_base64 cidr cidr6 concat decode_base64 ends_with join has_key has_value is_jwt_present is_jwt_valid len lookup_json_integer lookup_json_string lower regex_replace remove_bytes remove_query_args sha256 split starts_with substring to_string upper url_decode uuidv4 wildcard_replaceCloudflare Network Firewall Functions bit_sliceHMAC validation Overview Usage MessageMACHMAC validation examples MessageMAC in a single field Concatenated MessageMAC argument




The Cloudflare Rules language provides functions for manipulating and validating values in an expression:

Transformation functions manipulate values extracted from an HTTP request.

The HMAC validation function tests the validity of an HMAC token. Use it to write expressions that target requests based on the presence of a valid HMAC token.


Transformation functions


The Rules language supports several functions that transform values extracted from HTTP requests. A common use case for transformation functions is the conversion of a string of characters to uppercase or lowercase, since by default, string evaluation is case-sensitive.

For example, the lower() function converts all uppercase characters in a string to lowercase.

In the expression below, the lower() function transforms http.host values to lowercase so that they match the target value "www.cloudflare.com":
lower(http.host) == "www.cloudflare.com"
Transformation functions that do not take arrays as an argument type require the [*] index notation. Refer to Arrays for more information.

The Rules language supports these transformation functions:


any


any(Array<Boolean>): Boolean

Returns true when the comparison operator in the argument returns true for any of the values in the argument array. Returns false otherwise.

Example:
any(url_decode(http.request.body.form.values[*])[*] contains "an xss attack")

all


all(Array<Boolean>): Boolean

Returns true when the comparison operator in the argument returns true for all values in the argument array. Returns false otherwise.

Example:
all(http.request.headers["content-type"][*] == "application/json")

encode_base64


encode_base64(input String | Bytes [, flags String]): String

Encodes an input string or byte array to Base64 format.

The flags parameter is optional. You can provide one or more flags as a single string. The available flags are the following:

u: Uses URL-safe Base64 encoding (uses - and _ instead of + and /).

p: Adds padding (appends = characters to make the output length a multiple of 4, as required by some systems).

By default, the output uses standard Base64 encoding without padding.

Examples:
encode_base64("hello world") will return "aGVsbG8gd29ybGQ"encode_base64("hello world", "p") will return "aGVsbG8gd29ybGQ="encode_base64("hello world", "u") will return "aGVsbG8gd29ybGQ"encode_base64("hello world", "up") will return "aGVsbG8gd29ybGQ="
You can combine encode_base64() with other functions to create signed request headers:
encode_base64(sha256(concat(to_string(ip.src), http.host, "my-secret")))

Note


You can only use the encode_base64() function in request/response header transform rules.




cidr


cidr(address IP address, ipv4_network_bits Integer, ipv6_network_bits Integer): IP address

Returns the network address corresponding to an IP address (IPv4 or IPv6), given the provided IPv4 and IPv6 network bits (which determine the corresponding netmasks).

The address parameter must be a field, that is, it cannot be a literal String.

The ipv4_network_bits value must be between 1 and 32, and the ipv6_network_bits value must be between 1 and 128.

Examples:

If ip.src is 113.10.0.2, cidr(ip.src, 24, 24) will return 113.10.0.0.

If ip.src is 2001:0000:130F:0000:0000:09C0:876A:130B, cidr(ip.src, 24, 24) will return 2001:0000:0000:0000:0000:0000:0000:0000.


Note


You can only use the cidr() function in custom rules and rate limiting rules.




cidr6


cidr6(address IP address, ipv6_network_bits Integer): IP address

Returns the IPv6 network address corresponding to an IPv6 address, given the provided network bits (which determine the netmask). If you provide an IPv4 address in the first parameter, it will be returned unchanged.

The address parameter must be a field, that is, it cannot be a literal String.

The ipv6_network_bits value must be between 1 and 128.

This function is equivalent to: cidr(<address>, 32, <ipv6_network_bits>).

Examples:

If ip.src is 2001:0000:130F:0000:0000:09C0:876A:130B, cidr6(ip.src, 24) will return 2001:0000:0000:0000:0000:0000:0000:0000.

If ip.src is 113.10.0.2, cidr6(ip.src, 24) will return 113.10.0.2 (unchanged).


Note


You can only use the cidr6() function in custom rules and rate limiting rules.




concat


concat(String | Bytes | Array): String | Array

Takes a comma-separated list of values. Concatenates the argument values into a single String or array.

The return type depends on the type of input arguments. For example, if you concatenate arrays, the function will return an array.

For example, concat("String1", " ", "String", "2") will return "String1 String2".


decode_base64


decode_base64(source String): String

Decodes a Base64-encoded String specified in source.

source must be a field, that is, it cannot be a literal String.

For example, with the following HTTP request header: client_id: MTIzYWJj, (any(decode_base64(http.request.headers["client_id"][*])[*] eq "123abc")) would return true.


Note


You can only use the decode_base64() function in Transform Rules, custom rules, and rate limiting rules.




ends_with


ends_with(source String, substring String): Boolean

Returns true when the source ends with a given substring. Returns false otherwise. The source cannot be a literal value (like "foo").

For example, if http.request.uri.path is "/welcome.html", then ends_with(http.request.uri.path, ".html") will return true.


join


join(items Array<String>, separator String): String

Returns a string which is the concatenation of the strings in items with the separator between each item.

If any of the arguments is nil, the returned value will be nil.
If the items array is empty, the returned value will be an empty string.
If the items array contains a single item, then no concatenation occurs and the (single) item will be returned as is.

This function does the opposite of the split() function.

Example:
# Joins all HTTP request header names into a single string, with names separated by commasjoin(http.request.headers.names, ",")

Note


The join() function is only available in Transform Rules, custom rules, and Custom Error Rules.




has_key


has_key(map: Map<T>, key: String): Boolean

Returns true if the key specified in the second argument, which can be a literal or a dynamic string, is an existing key in the map provided as first argument; returns false otherwise.

The data type of the values in map (indicated by T) can be any type.

If any of the arguments is nil, the returned value will be nil.

Examples:
# Check if an HTTP request header exists:has_key(http.request.headers, "x-my-header")# Check if a request header exists based on the name of the first query argument:has_key(http.request.headers, lower(http.request.uri.args.names[0]))

has_value


has_value(collection: Map<T> | Array<T>, value: T): Boolean

Returns true if the value specified in the second argument, which can be a literal or a dynamic value, is found in the collection provided as first argument; returns false otherwise.

The data type of the values in the collection (indicated by T) must match the data type of the provided value. Additionally, T must be a primitive data type, that is, it must be one of Boolean, Integer, String, Bytes, or IP address.

If any of the arguments is nil, the returned value will be nil.

Examples:
# Check if there is an HTTP request header with the exact name 'X-My-Header'has_value(http.request.headers.names, "X-My-Header")# Check if there is a request header with the exact name provided as the first query argument:has_value(http.request.headers.names, http.request.uri.args.names[0])

is_jwt_present


is_jwt_present(token_configuration_id: String): Boolean

Returns true if the request has a token as configured in the token configuration with the ID token_configuration_id.

token_configuration_id must be the ID of an existing token configuration.

Example:
is_jwt_present("51231d16-01f1-48e3-93f8-91c99e81288e")

Note


This function is only available in API JWT validation rules.




is_jwt_valid


is_jwt_valid(token_configuration_id: String): Boolean

Returns true if the request has a valid token according to the token configuration with the ID token_configuration_id.

token_configuration_id must be the ID of an existing token configuration. The function returns false if the token is missing from the request.
is_jwt_valid("51231d16-01f1-48e3-93f8-91c99e81288e")

Note


This function is only available in API JWT validation rules.




len


len(String | Bytes | Array): Integer

Returns the byte length of a String or Bytes value, or the number of elements in an array.

For example, if the value of http.host is "example.com", then len(http.host) will return 11.


lookup_json_integer


lookup_json_integer(field String, key String | Integer, key String | Integeroptional, ...): Integer

Returns the integer value associated with the supplied key in field.

The field must be a string representation of a valid JSON document.

The key can be an attribute name, a zero-based position number in a JSON array, or a combination of these two options (as extra function parameters), while following the hierarchy of the JSON document to obtain a specific integer value.


Note: This function only works for plain integers. For example, it will not work for floating numbers with a zero decimal part such as 42.0.

Examples:


Given the following JSON object contained in the http.request.body.raw field:
{ "record_id": "aed53a", "version": 2 }
Then lookup_json_integer(http.request.body.raw, "version") will return 2.



Given the following nested object:
{ "product": { "id": 356 } }
Then lookup_json_integer(http.request.body.raw, "product", "id") will return 356.



Given the following JSON array at the root level:
["first_item", -234]
Then lookup_json_integer(http.request.body.raw, 1) will return -234.



Given the following array in a JSON object attribute:
{ "network_ids": [123, 456] }
Then lookup_json_integer(http.request.body.raw, "network_ids", 0) will return 123.



Given the following root-level array of JSON objects:
[{ "product_id": 123 }, { "product_id": 456 }]
Then lookup_json_integer(http.request.body.raw, 1, "product_id") will return 456.



lookup_json_string


lookup_json_string(field String, key String | Integer, key String | Integeroptional, ...): String

Returns the string value associated with the supplied key in field.

The field must be a string representation of a valid JSON document.

The key can be an attribute name, a zero-based position number in a JSON array, or a combination of these two options (as extra function parameters), while following the hierarchy of the JSON document to obtain a specific value.

Examples:


Given the following JSON object contained in the http.request.body.raw field:
{ "company": "cloudflare", "product": "rulesets" }
Then lookup_json_string(http.request.body.raw, "company") == "cloudflare" will return true.



Given the following nested object:
{ "network": { "name": "cloudflare" } }
Then lookup_json_string(http.request.body.raw, "network", "name") == "cloudflare" will return true.



Given the following JSON array at the root level:
["other_company", "cloudflare"]
Then lookup_json_string(http.request.body.raw, 1) == "cloudflare" will return true.



Given the following array in a JSON object attribute:
{ "networks": ["other_company", "cloudflare"] }
Then lookup_json_string(http.request.body.raw, "networks", 1) == "cloudflare" will return true.



Given the following root-level array of JSON objects:
[{ "network": "other_company" }, { "network": "cloudflare" }]
Then lookup_json_string(http.request.body.raw, 1, "network") == "cloudflare" will return true.



lower


lower(String): String

Converts a string field to lowercase. Only uppercase ASCII bytes are converted. All other bytes are unaffected.

For example, if http.host is "WWW.cloudflare.com", then lower(http.host) == "www.cloudflare.com" will return true.


regex_replace


regex_replace(source String, regular_expression String, replacement String): String

Replaces a part of a source string matched by a regular expression with a replacement string, returning the result. The replacement string can contain references to regular expression capture groups (for example, ${1} and ${2}), up to eight replacement references.

Examples:


Literal match replace:
regex_replace("/foo/bar", "/bar$", "/baz") == "/foo/baz"



If there is no match, the input string does not change:
regex_replace("/x", "^/y$", "/mumble") == "/x"



Match is case-sensitive by default:
regex_replace("/foo", "^/FOO$", "/x") == "/foo"



When there are multiple matches, only one replacement occurs (the first one):
regex_replace("/a/a", "/a", "/b") == "/b/a"
…(内容过长已截断)

------
导航页 打开网址