--- title: Common API calls description: Example API requests for managing Programmable Flow Protection programs and rules. image: https://edgetunnel-b2h.pages.dev/core-services-preview.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/ddos-protection/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Common API calls The following sections contain example requests for common API calls. For a list of available API endpoints, refer to [Endpoints](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/#endpoints). ## List all programs This example fetches all Programmable Flow Protection programs in the account. **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/programs" \ --header "Authorization: Bearer " ``` **Response** ```json { "result": [ { "id": "", "name": "rate-limiter", "status": "success", "created_on": "", "modified_on": "" } ], "success": true, "errors": [], "messages": [] } ``` ## Upload a program This example uploads a new eBPF program written in C. The program source code is sent as the request body with `Content-Type: text/plain`. Include the optional `X-Program-Name` header to specify a human-readable program name. If omitted, the API generates a UUID as the program name. **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/programs" \ --header "Authorization: Bearer " \ --header "Content-Type: text/plain" \ --header "X-Program-Name: my-rate-limiter" \ --data-binary "@/path/to/program.c" ``` **Response** ```json { "result": { "id": "", "name": "my-rate-limiter", "status": "success", "created_on": "", "modified_on": "" }, "success": true, "errors": [], "messages": [] } ``` If the program fails compilation or verification, the API returns a detailed error message: **Example error response** ```json { "result": null, "success": false, "errors": [ { "code": 1001, "message": "Program verification failed: invalid memory access at line 42" } ], "messages": [] } ``` ## Update a program This example updates an existing program with new source code. You can update a program even if it is currently in use by one or more rules. If the new program fails compilation or verification, the update fails and the existing program remains active. **Request** ```bash curl --request PATCH \ "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/programs/{program_id}" \ --header "Authorization: Bearer " \ --header "Content-Type: text/plain" \ --data-binary "@/path/to/updated-program.c" ``` **Response** ```json { "result": { "id": "", "name": "program", "status": "success", "created_on": "", "modified_on": "" }, "success": true, "errors": [], "messages": [] } ``` ## Delete a program This example deletes a program. You cannot delete a program that is currently referenced by an active rule. **Request** ```bash curl --request DELETE \ "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/programs/{program_id}" \ --header "Authorization: Bearer " ``` **Response** ```json { "result": null, "success": true, "errors": [], "messages": [] } ``` ## List all rules This example fetches all Programmable Flow Protection rules in the account. **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/rules" \ --header "Authorization: Bearer " ``` **Response** ```json { "result": [ { "id": "", "program_id": "", "scope": "global", "name": "global", "mode": "enabled", "expression": "", "created_on": "", "modified_on": "" } ], "success": true, "errors": [], "messages": [] } ``` ## Create a rule This example creates a Programmable Flow Protection rule with a global scope in monitoring mode. **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/rules" \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{ "program_id": "", "scope": "global", "name": "global", "mode": "monitoring" }' ``` **Response** ```json { "result": { "id": "", "program_id": "", "scope": "global", "name": "global", "mode": "monitoring", "expression": "", "created_on": "", "modified_on": "" }, "success": true, "errors": [], "messages": [] } ``` Refer to [JSON objects](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/json-objects/) for more information on the fields in the JSON body. ## Create a rule with regional scope This example creates a rule scoped to the Western Europe region with an expression filter. **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/rules" \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{ "program_id": "", "scope": "region", "name": "WEUR", "mode": "enabled", "expression": "ip.dst in { 192.0.2.0/24 }" }' ``` **Response** ```json { "result": { "id": "", "program_id": "", "scope": "region", "name": "WEUR", "mode": "enabled", "expression": "ip.dst in { 192.0.2.0/24 }", "created_on": "", "modified_on": "" }, "success": true, "errors": [], "messages": [] } ``` Refer to [JSON objects](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/json-objects/) for more information on the fields in the JSON body. ## Update a rule This example updates an existing rule. You can update the mode, scope, and expression, but not the program. To change the program, delete the rule and create a new one. **Request** ```bash curl --request PATCH \ "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/rules/{rule_id}" \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{ "mode": "enabled" }' ``` **Response** ```json { "result": { "id": "", "program_id": "", "scope": "global", "name": "global", "mode": "enabled", "expression": "", "created_on": "", "modified_on": "" }, "success": true, "errors": [], "messages": [] } ``` Refer to [JSON objects](https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/json-objects/) for more information on the fields in the JSON body. ## Delete a rule This example deletes an existing rule. **Request** ```bash curl --request DELETE \ "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/rules/{rule_id}" \ --header "Authorization: Bearer " ``` **Response** ```json { "result": null, "success": true, "errors": [], "messages": [] } ``` ## Debug a program with PCAP This example runs a program against a PCAP file for debugging. The API returns an annotated PCAP file with the program verdict for each packet. The request body must contain the PCAP file in binary format. The API automatically detects the IP header offset based on the input PCAP. To override automatic detection, use the optional `ip_offset` query parameter to specify the number of bytes the IP header is offset by in each packet (for example, `14` for Ethernet frames). **Request** ```bash curl "https://api.cloudflare.com/client/v4/accounts/{account_id}/magic/programmable_flow_protection/configs/programs/{program_id}/pcap" \ --header "Authorization: Bearer " \ --header "Content-Type: application/vnd.tcpdump.pcap" \ --data-binary "@/path/to/input.pcap" \ --output output.pcap ``` The output PCAP file contains the same packets as the input file, but with annotations on each packet. The Packet Comment annotation may contain: * Program return value: `CF_EBPF_PASS` or `CF_EBPF_DROP` * `Ignored`: if the incoming packet is not UDP * `Analytics tag`: the custom network analytics tag set by the program on this packet, if any * `Challenge packet`: the challenge packet emitted from the program back to the client, if any ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/examples/#page","headline":"Common API calls ยท Cloudflare DDoS Protection docs","description":"Example API requests for managing Programmable Flow Protection programs and rules.","url":"https://edgetunnel-b2h.pages.dev/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/examples/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/core-services-preview.png","dateModified":"2026-06-23","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"},"keywords":["REST API"]} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ddos-protection/","name":"DDoS Protection"}},{"@type":"ListItem","position":3,"item":{"@id":"/ddos-protection/advanced-ddos-systems/","name":"Advanced DDoS systems"}},{"@type":"ListItem","position":4,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/","name":"API configuration"}},{"@type":"ListItem","position":5,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/","name":"Programmable Flow Protection"}},{"@type":"ListItem","position":6,"item":{"@id":"/ddos-protection/advanced-ddos-systems/api/programmable-flow-protection/examples/","name":"Common API calls"}}]} ```