Cloudflare API Shield
API security layer with endpoint discovery, schema validation, mTLS and volumetric abuse detection.
- Provider
- cloudflare
- Kind
- API gateway
- Category
- Edge
- Official docs
- https://developers.cloudflare.com/api-shield/
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| apiDiscovery | boolean | — | no | true | inherited |
| auth | enum | none | api-key | jwt | oauth2 | mtls | no | none | inherited |
| concurrencyLimit | boolean | — | no | false | inherited |
| idempotencyKeys | boolean | — | no | false | inherited |
| instances | integer | — | no | — | inherited |
| keyTtlHours | integer | — | no | — | inherited |
| managed | boolean | — | no | false | ▸ true |
| mutualTls | boolean | — | no | false | inherited |
| protocol | enum | http | grpc | websocket | fix | ouch | no | http | ▸ http |
| rateLimiting | boolean | — | no | false | ▸ true |
| schemaValidation | boolean | — | no | false | inherited |
| sequenceAnalytics | boolean | — | no | false | inherited |
| tls | boolean | — | no | true | ▸ true |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
sync-chain-too-deep
Every consecutive synchronous hop from this entry point spends part of the stated p95 latency budget, and the chain's failures multiply. More than three hops is a budget nobody is tracking.
- — all of these hold:
- — the design requirement `latency.p95Ms` has a value
- — the longest chain of synchronous calls starting at the node is more than 3 hops long
nodes:
- { id: "api-shield", component: "cloudflare-api-shield" }API Gatewayalibaba-api-gatewayAmazon API Gatewayaws-api-gatewayAWS AppSync GraphQL APIaws-appsyncAzure API Managementazure-api-managementAI Gatewaycloudflare-ai-gatewayMCP Server Portalcloudflare-mcp-portalCloudflare Privacy Gatewaycloudflare-privacy-gatewayGeneric API gatewayapi-gatewayApache APISIXapisixApollo GraphOSapollo-graphosEasegresseasegressEmissary-ingressemissaryEnvoy Gatewayenvoy-gatewayGloo GatewayglooHasurahasuraHelicone AI Gatewayhelicone-gatewayHigresshigressKong GatewaykongKong AI Gatewaykong-ai-gatewayKong Konnectkong-konnectKrakenDkrakendLiteLLM ProxylitellmMartian GatewaymartianNot Diamondnot-diamondPortkey AI GatewayportkeyRequestyrequestySpring Cloud Gatewayspring-cloud-gatewayTyk GatewaytykUnifyunify-aiVercel AI Gatewayvercel-ai-gatewayWSO2 API Managerwso2-api-managerZuulzuulApigeeapigeeAgent Gatewaygoogle-agent-gatewayAPI Gatewaygoogle-api-gatewayApigee hybridgoogle-apigee-hybridCloud Endpointsgoogle-cloud-endpointsFirebase Data Connectgoogle-firebase-data-connectIBM API Connectibm-api-connectOCI API Gatewayoci-api-gateway
# yaml-language-server: $schema=../../schema/component.schema.json # Cloudflare API Shield: an Enterprise add-on in front of API hostnames that discovers endpoints, # validates them against an OpenAPI schema, enforces mTLS client certificates and detects # volumetric abuse per endpoint ("API Shield overview"). schemaVersion: "1" type: "component" id: "cloudflare-api-shield" kind: "api-gateway" provider: "cloudflare" docs: "https://developers.cloudflare.com/api-shield/" defaults: managed: true tls: true protocol: "http" rateLimiting: true properties: apiDiscovery: type: "boolean" default: true schemaValidation: type: "boolean" default: false mutualTls: type: "boolean" default: false sequenceAnalytics: type: "boolean" default: false