The [Policies](/api-reference/waap#policies) endpoints manage the Invalid user agent and Unknown user agent rules. Both policies are enabled by default and belong to the Anti-automation and bot protection ruleset. Response examples include only the fields used in each step.
An [API token](/account-settings/api-tokens) is required, along with the ID of a [WAAP-protected domain](/waap/getting-started/configure-waap-for-a-domain) and the [Python](/developer-tools/sdks/python) or [Go](/developer-tools/sdks/go) SDK installed for SDK examples.
```bash theme={null}
export GCORE_API_KEY="{YOUR_API_KEY}"
export WAAP_DOMAIN_ID="{YOUR_DOMAIN_ID}"
```
## View policy states
Retrieve the current state of the Invalid user agent and Unknown user agent policies for a domain.
```python theme={null}
import gcore
import os
client = gcore.Gcore(api_key=os.environ["GCORE_API_KEY"])
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
TARGET_IDS = {"S3008869", "S3008870"}
rule_sets = client.waap.domains.list_rule_sets(domain_id)
aa_set = next(
rs for rs in rule_sets if rs.resource_slug == "anti-automation-bot-protection"
)
for policy in aa_set.rules:
if policy.id in TARGET_IDS:
status = "enabled" if policy.mode else "disabled"
print(f"{policy.name}: {status} ({policy.id})")
```
```go theme={null}
package main
import (
"context"
"fmt"
"os"
"strconv"
gcore "github.com/G-Core/gcore-go"
"github.com/G-Core/gcore-go/option"
)
func main() {
client := gcore.NewClient(option.WithAPIKey(os.Getenv("GCORE_API_KEY")))
domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
targetIDs := map[string]bool{"S3008869": true, "S3008870": true}
ruleSets, _ := client.Waap.Domains.ListRuleSets(context.Background(), domainID)
for _, rs := range *ruleSets {
if rs.ResourceSlug == "anti-automation-bot-protection" {
for _, policy := range rs.Rules {
if targetIDs[policy.ID] {
status := "disabled"
if policy.Mode {
status = "enabled"
}
fmt.Printf("%s: %s (%s)\n", policy.Name, status, policy.ID)
}
}
}
}
}
```
```bash theme={null}
curl -X GET "https://api.gcore.com/waap/v1/domains/${WAAP_DOMAIN_ID}/rule-sets" \
-H "Authorization: APIKey ${GCORE_API_KEY}" \
| jq '[.[] | select(.resource_slug == "anti-automation-bot-protection") | .rules[] | select(.id == "S3008869" or .id == "S3008870") | {name, id, mode}]'
```
The response lists both policies with their current state. `mode: true` means enabled; `mode: false` means disabled:
```json theme={null}
[
{
"name": "Invalid user agent",
"id": "S3008869",
"mode": false
// ...
}
// ...
]
```
## Toggle a policy
Switch a policy between enabled and disabled. Each call flips the current state. Use the policy ID from the View policy states response or from the table below.
This endpoint toggles the current state rather than setting a specific value. If the target state is unknown, retrieve the current policy state first using the View policy states request above.
```python theme={null}
import gcore
import os
client = gcore.Gcore(api_key=os.environ["GCORE_API_KEY"])
domain_id = int(os.environ["WAAP_DOMAIN_ID"])
# S3008869 = Invalid user agent, S3008870 = Unknown user agent
policy_id = "S3008869"
result = client.waap.domains.policies.toggle(policy_id, domain_id=domain_id)
status = "enabled" if result.mode else "disabled"
print(f"Invalid user agent is now {status}")
```
```go theme={null}
package main
import (
"context"
"fmt"
"os"
"strconv"
gcore "github.com/G-Core/gcore-go"
"github.com/G-Core/gcore-go/option"
"github.com/G-Core/gcore-go/waap"
)
func main() {
client := gcore.NewClient(option.WithAPIKey(os.Getenv("GCORE_API_KEY")))
domainID, _ := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
// S3008869 = Invalid user agent, S3008870 = Unknown user agent
policyID := "S3008869"
result, _ := client.Waap.Domains.Policies.Toggle(context.Background(), policyID, waap.DomainPolicyToggleParams{DomainID: domainID})
status := "disabled"
if result.Mode {
status = "enabled"
}
fmt.Printf("Invalid user agent is now %s\n", status)
}
```
```bash theme={null}
# Set POLICY_ID to S3008869 (Invalid user agent) or S3008870 (Unknown user agent)
export POLICY_ID="{POLICY_ID}"
curl -X PATCH "https://api.gcore.com/waap/v1/domains/${WAAP_DOMAIN_ID}/policies/${POLICY_ID}/toggle" \
-H "Authorization: APIKey ${GCORE_API_KEY}"
```
The API returns the updated policy state. `mode: true` confirms enabled; `mode: false` confirms disabled:
```json theme={null}
{"mode": true}
```
## Policy reference
| Policy | Description | Action | Default |
| ------------------ | ----------------------------------------------------------------------------------------------- | --------- | ------- |
| Invalid user agent | Blocks requests from user agents known to be associated with malicious activity. | Block | Enabled |
| Unknown user agent | Applies a transparent JavaScript-based browser check to requests from unrecognized user agents. | Handshake | Enabled |
Both policies belong to the [Anti-automation and bot protection](/waap/waap-policies/anti-automation-and-bot-protection) ruleset, which includes six additional policies for managing automated and bot traffic.