Microsoft Azure WebApplicationFirewallManagement

Can I create a Front Door WAF policy with this API?

Yes. Use PUT on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName} (Policies_CreateOrUpdate) to create or update a policy, including custom rules and managed rule set references.

What are the rate limits for this API?

The spec does not declare explicit rate limits. Calls go through Azure Resource Manager, which applies standard ARM throttling per subscription. Inspect the x-ms-ratelimit-remaining-subscription-writes and -reads headers to track remaining quota.

How do I list all WAF policies in my subscription through Jentic?

Search Jentic for 'list azure front door waf policies', load the schema for the Policies_List operation on /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies, and execute it. Install with `pip install jentic` and use the async search/load/execute pattern.

Does this API protect Application Gateway WAFs as well?

No. This API only manages Front Door WAF policies under the FrontDoorWebApplicationFirewallPolicies resource type. Application Gateway WAF policies are managed through a separate Azure Network resource and are out of scope here.

Can I see which managed rule sets are available before assigning one?

Yes. GET /subscriptions/{subscriptionId}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallManagedRuleSets (ManagedRuleSets_List) returns each Microsoft-managed rule set and its versions so you can pin a policy to a specific version.

Can I limit what my agent is allowed to do with the Microsoft Azure Front Door WAF Management API?

Yes. Because you run Jentic One yourself, your own rules decide which of the five operations your agent may call and which Azure AD credential it uses, so you can allow it to create or read WAF policies and list managed rule sets while withholding Policies_Delete. Since this API carries the subscription, resource group, and policy name in the request path, you can pin the agent to a single WAF policy or one resource group and nothing beyond it. The Azure AD token is stored once by your own instance and injected only at execution time, so it never reaches the agent's prompt or logs.