---
description: Complete reference of all fields available in rule expressions.
title: Fields reference
image: https://developers.cloudflare.com/og-docs.png
---

[Skip to content](#main-content)

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt  
> Use this file to discover all available pages before exploring further.

# Fields reference

Last updated Sep 1, 2026|Copy as Markdown| [View as Markdown](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/index.md)| [Agent setup](https://0285ca83.previews.developers.cloudflare.com/agent-setup/)

CategoriesBodyBotsGeolocationHeadersJWT validationRaw fieldsRequestResponseSSL/TLSURImTLS

[cf.api\_gateway.auth\_id\_present Indicates whether the request contained an API session authentication token, as defined by API Shield's saved session identifiers. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.api_gateway.auth_id_present/) [cf.api\_gateway.fallthrough\_detected Indicates whether the request matched a saved endpoint in Endpoint Management.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.api_gateway.fallthrough_detected/) [cf.api\_gateway.request\_violates\_schema This field is deprecated. Use `cf.schema_validation.uploaded.violated` instead.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.api_gateway.request_violates_schema/) [cf.bot\_management.corporate\_proxy Indicates whether the incoming request comes from an identified Enterprise-only cloud-based corporate proxy or secure web gateway. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.corporate_proxy/) [cf.bot\_management.detection\_ids List of IDs that correlate to the Bot Management heuristic detections made on a request. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.detection_ids/) [cf.bot\_management.ja3\_hash Provides an SSL/TLS fingerprint to help you identify potential bot requests. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.ja3_hash/) [cf.bot\_management.ja4 Provides an SSL/TLS fingerprint to help you identify potential bot requests. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.ja4/) [cf.bot\_management.js\_detection.passed Indicates whether the visitor has previously passed a JS Detection. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.js_detection.passed/) [cf.bot\_management.score Represents the likelihood that a request originates from a bot using a score from 1–99. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.score/) [cf.bot\_management.signed\_agent Indicates whether or not the request originated from a known agent that self-identifies with Web Bot Auth, now classified as a verified bot or agent labeled as intermediary. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.signed_agent/) [cf.bot\_management.static\_resource Indicates whether static resources should be included when you create a rule using `cf.bot_management.score`. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.static_resource/) [cf.bot\_management.verified\_bot Indicates whether the request originated from a known good bot or crawler. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.verified_bot/) [cf.client.bot Indicates whether the request originated from a known good bot or crawler.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.client.bot/) [cf.edge.client\_tcp Indicates if the request was made over TCP.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.edge.client_tcp/) [cf.edge.l4.delivery\_rate The most recent data delivery rate estimate for the client connection, in bytes per second.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.edge.l4.delivery_rate/) [cf.edge.server\_ip Represents the global network's IP address to which the HTTP request has resolved.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.edge.server_ip/) [cf.edge.server\_port Represents the port number at which the Cloudflare global network received the request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.edge.server_port/) [cf.hostname.metadata Returns the string representation of the per-hostname custom metadata JSON object set by SSL for SaaS customers.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.hostname.metadata/) [cf.llm.prompt.custom\_topic\_categories A map of custom topic labels to relevance scores (1–99) for the LLM prompt in the request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.custom_topic_categories/) [cf.llm.prompt.detected Indicates whether Cloudflare detected an LLM prompt in the incoming request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.detected/) [cf.llm.prompt.injection\_score A score from 1–99 that represents the likelihood that the LLM prompt in the request is trying to perform a prompt injection attack. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.injection_score/) [cf.llm.prompt.pii\_categories Array of string values with the personally identifiable information (PII) categories found in the LLM prompt included in the request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_categories/) [cf.llm.prompt.pii\_detected Indicates whether any personally identifiable information (PII) has been detected in the LLM prompt included in the request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.pii_detected/) [cf.llm.prompt.token\_count An estimated token count for the LLM prompt in the request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.token_count/) [cf.llm.prompt.unsafe\_topic\_categories Array of string values with the type of unsafe topics detected in the LLM prompt. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_categories/) [cf.llm.prompt.unsafe\_topic\_detected Indicates whether the incoming request includes any unsafe topic category in the LLM prompt. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.llm.prompt.unsafe_topic_detected/) [cf.random\_seed Returns per-request random bytes that you can use in the `uuidv4()` function.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.random_seed/) [cf.ray\_id The Ray ID of the current request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.ray_id/) [cf.response.1xxx\_code Contains the specific code for 1XXX Cloudflare errors.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.response.1xxx_code/) [cf.response.error\_type A string with the type of error in the response being returned.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.response.error_type/) [cf.schema\_validation.learned.violated Returns `true` when an evaluated request violates the learned profile.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.schema_validation.learned.violated/) [cf.schema\_validation.uploaded.violated Returns `true` when an evaluated request violates the supplied schema.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.schema_validation.uploaded.violated/) [cf.threat\_score Represents a Cloudflare threat score.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.threat_score/) [cf.timings.client\_quic\_rtt\_msec The smoothed QUIC round-trip time (RTT) between Cloudflare and the client in milliseconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.timings.client_quic_rtt_msec/) [cf.timings.client\_tcp\_rtt\_msec The smoothed TCP round-trip time (RTT) between Cloudflare and the client in milliseconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.timings.client_tcp_rtt_msec/) [cf.timings.edge\_msec The time spent processing a request within the Cloudflare global network in milliseconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.timings.edge_msec/) [cf.timings.origin\_ttfb\_msec The round-trip time (RTT) between the Cloudflare global network and the origin server in milliseconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.timings.origin_ttfb_msec/) [cf.timings.worker\_msec The time spent executing a Cloudflare Worker in milliseconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.timings.worker_msec/) [cf.tls\_cipher The cipher for the connection to Cloudflare.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_cipher/) [cf.tls\_ciphers\_sha1 The SHA-1 fingerprint of the client TLS cipher list in received order, encoded in Base64 using big-endian format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_ciphers_sha1/) [cf.tls\_client\_auth.cert\_chain\_rfc9440 The mTLS client certificate chain (excluding the leaf certificate) encoded as a structured field list per RFC 9440.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_chain_rfc9440/) [cf.tls\_client\_auth.cert\_chain\_rfc9440\_too\_large Returns `true` when the RFC 9440 encoded client certificate chain exceeds the 16 KiB size limit.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_chain_rfc9440_too_large/) [cf.tls\_client\_auth.cert\_fingerprint\_sha1 The SHA-1 fingerprint of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_fingerprint_sha1/) [cf.tls\_client\_auth.cert\_fingerprint\_sha256 The SHA-256 fingerprint of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_fingerprint_sha256/) [cf.tls\_client\_auth.cert\_issuer\_dn The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_issuer_dn/) [cf.tls\_client\_auth.cert\_issuer\_dn\_legacy The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate in a legacy format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_issuer_dn_legacy/) [cf.tls\_client\_auth.cert\_issuer\_dn\_rfc2253 The Distinguished Name (DN) of the Certificate Authority (CA) that issued the mTLS client certificate in RFC 2253 format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_issuer_dn_rfc2253/) [cf.tls\_client\_auth.cert\_issuer\_serial Serial number of the direct issuer of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_issuer_serial/) [cf.tls\_client\_auth.cert\_issuer\_ski The Subject Key Identifier (SKI) of the direct issuer of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_issuer_ski/) [cf.tls\_client\_auth.cert\_not\_after The mTLS client certificate is not valid after this date.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_not_after/) [cf.tls\_client\_auth.cert\_not\_before The mTLS client certificate is not valid before this date.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_not_before/) [cf.tls\_client\_auth.cert\_presented Returns `true` when an mTLS client presents a certificate (valid or not).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_presented/) [cf.tls\_client\_auth.cert\_revoked Indicates whether the mTLS client presented a valid but revoked client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_revoked/) [cf.tls\_client\_auth.cert\_rfc9440 The mTLS client certificate encoded as a Structured Fields Byte Sequence per RFC 9440.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_rfc9440/) [cf.tls\_client\_auth.cert\_rfc9440\_too\_large Returns `true` when the RFC 9440 encoded mTLS client certificate exceeds the 10 KiB size limit.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_rfc9440_too_large/) [cf.tls\_client\_auth.cert\_serial Serial number of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_serial/) [cf.tls\_client\_auth.cert\_ski The Subject Key Identifier (SKI) of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_ski/) [cf.tls\_client\_auth.cert\_subject\_dn The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_subject_dn/) [cf.tls\_client\_auth.cert\_subject\_dn\_legacy The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate in a legacy format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_subject_dn_legacy/) [cf.tls\_client\_auth.cert\_subject\_dn\_rfc2253 The Distinguished Name (DN) of the owner (or requester) of the mTLS client certificate in RFC 2253 format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_subject_dn_rfc2253/) [cf.tls\_client\_auth.cert\_verified Returns `true` when an mTLS client presents a valid client certificate.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_auth.cert_verified/) [cf.tls\_client\_extensions\_sha1 The SHA-1 fingerprint of TLS client extensions, encoded in Base64 using big-endian format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_extensions_sha1/) [cf.tls\_client\_extensions\_sha1\_le The SHA-1 fingerprint of TLS client extensions, encoded in Base64 using little-endian format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_extensions_sha1_le/) [cf.tls\_client\_hello\_length The length of the client hello message sent in a TLS handshake.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_hello_length/) [cf.tls\_client\_random The value of the 32-byte random value provided by the client in a TLS handshake, encoded in Base64.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_client_random/) [cf.tls\_version The TLS version of the connection to Cloudflare.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.tls_version/) [cf.verified\_bot\_category Provides the type and purpose of a verified bot.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.verified_bot_category/) [cf.waf.auth\_detected Indicates whether the Cloudflare WAF detected authentication credentials in the request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.auth_detected/) [cf.waf.content\_scan.has\_failed Indicates whether the file scanner was unable to scan any of the content objects detected in the request. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_failed/) [cf.waf.content\_scan.has\_malicious\_obj Indicates whether the request contains at least one malicious content object. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_malicious_obj/) [cf.waf.content\_scan.has\_obj Indicates whether the request contains at least one content object. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_obj/) [cf.waf.content\_scan.num\_malicious\_obj The number of malicious content objects detected in the request (zero or greater). - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.num_malicious_obj/) [cf.waf.content\_scan.num\_obj The number of content objects detected in the request (zero or greater). - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.num_obj/) [cf.waf.content\_scan.obj\_results An array of scan results in the order the content objects were detected in the request. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.obj_results/) [cf.waf.content\_scan.obj\_sizes An array of file sizes in bytes, in the order the content objects were detected in the request. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.obj_sizes/) [cf.waf.content\_scan.obj\_types An array of file types in the order the content objects were detected in the request. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.obj_types/) [cf.waf.credential\_check.password\_leaked Indicates whether the password detected in the request was previously leaked.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.password_leaked/) [cf.waf.credential\_check.username\_and\_password\_leaked Indicates whether the auth credentials detected in the request (username-password pair) were previously leaked. - Pro or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.username_and_password_leaked/) [cf.waf.credential\_check.username\_leaked Indicates whether the username detected in the request was previously leaked. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.username_leaked/) [cf.waf.credential\_check.username\_password\_similar Indicates whether a similar version of the username and password credentials detected in the request were previously leaked. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.username_password_similar/) [cf.waf.score A global score from 1–99 that combines the score of each WAF attack vector into a single score. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score/) [cf.waf.score.class The attack score class of the current request, based on the WAF attack score. - Business or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.class/) [cf.waf.score.rce An attack score from 1–99 classifying the command injection or Remote Code Execution (RCE) attack vector. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.rce/) [cf.waf.score.sqli An attack score from 1–99 classifying the SQL injection (SQLi) attack vector. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.sqli/) [cf.waf.score.xss An attack score from 1–99 classifying the cross-site scripting (XSS) attack vector. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.waf.score.xss/) [cf.worker.upstream\_zone Identifies whether a request comes from a worker or not.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.worker.upstream_zone/) [http.cookie The entire cookie as a string.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.cookie/) [http.host The hostname used in the full request URI.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.host/) [http.referer The HTTP `Referer` request header, which contains the address of the web page that linked to the currently requested page.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.referer/) [http.request.accepted\_languages List of language tags provided in the `Accept-Language` HTTP request header.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.accepted_languages/) [http.request.body.form The HTTP request body of a form represented as a Map (or associative array). - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.form/) [http.request.body.form.names The names of the form fields in an HTTP request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.form.names/) [http.request.body.form.values The values of the form fields in an HTTP request. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.form.values/) [http.request.body.mime The MIME type of the request detected from the request body.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.mime/) [http.request.body.multipart A Map (or associative array) representation of multipart names to multipart values in the request body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart/) [http.request.body.multipart.content\_dispositions List of `Content-Disposition` headers for each part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.content_dispositions/) [http.request.body.multipart.content\_transfer\_encodings List of `Content-Transfer-Encoding` headers for each part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.content_transfer_encodings/) [http.request.body.multipart.content\_types List of `Content-Type` headers for each part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.content_types/) [http.request.body.multipart.filenames List of filenames for each part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.filenames/) [http.request.body.multipart.names List of multipart names for every part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.names/) [http.request.body.multipart.values List of multipart values for every part in the multipart body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.multipart.values/) [http.request.body.raw The unaltered HTTP request body. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.raw/) [http.request.body.size The total size of the HTTP request body (in bytes). - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.size/) [http.request.body.truncated Indicates whether the HTTP request body is truncated. - Enterprise](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.body.truncated/) [http.request.cookies The `Cookie` HTTP header associated with a request represented as a Map (associative array). - Pro or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.cookies/) [http.request.full\_uri The full URI as received by the web server.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.full_uri/) [http.request.headers The HTTP request headers represented as a Map (or associative array).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers/) [http.request.headers.names The names of the headers in the HTTP request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers.names/) [http.request.headers.truncated Indicates whether the HTTP request contains too many headers.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers.truncated/) [http.request.headers.values The values of the headers in the HTTP request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers.values/) [http.request.jwt.claims.aud The `aud` (audience) claim identifies the recipients that the JSON Web Token (JWT) is intended for. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.aud/) [http.request.jwt.claims.aud.names The `aud` (audience) claim identifies the recipients that the JSON Web Token (JWT) is intended for. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.aud.names/) [http.request.jwt.claims.aud.values The `aud` (audience) claim identifies the recipients that the JSON Web Token (JWT) is intended for. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.aud.values/) [http.request.jwt.claims.iat.sec The `iat` (issued at) claim identifies the time (number of seconds) at which the JWT was issued. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iat.sec/) [http.request.jwt.claims.iat.sec.names The `iat` (issued at) claim identifies the time (number of seconds) at which the JWT was issued. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iat.sec.names/) [http.request.jwt.claims.iat.sec.values The `iat` (issued at) claim identifies the time (number of seconds) at which the JWT was issued. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iat.sec.values/) [http.request.jwt.claims.iss The `iss` (issuer) claim identifies the principal that issued the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iss/) [http.request.jwt.claims.iss.names The `iss` (issuer) claim identifies the principal that issued the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iss.names/) [http.request.jwt.claims.iss.values The `iss` (issuer) claim identifies the principal that issued the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.iss.values/) [http.request.jwt.claims.jti The `jti` (JWT ID) claim provides a unique identifier for the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.jti/) [http.request.jwt.claims.jti.names The `jti` (JWT ID) claim provides a unique identifier for the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.jti.names/) [http.request.jwt.claims.jti.values The `jti` (JWT ID) claim provides a unique identifier for the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.jti.values/) [http.request.jwt.claims.nbf.sec The `nbf` (not before) claim identifies the time (number of seconds) before which the JWT must not be accepted for processing. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.nbf.sec/) [http.request.jwt.claims.nbf.sec.names The `nbf` (not before) claim identifies the time (number of seconds) before which the JWT must not be accepted for processing. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.nbf.sec.names/) [http.request.jwt.claims.nbf.sec.values The `nbf` (not before) claim identifies the time (number of seconds) before which the JWT must not be accepted for processing. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.nbf.sec.values/) [http.request.jwt.claims.sub The `sub` (subject) claim identifies the principal that is the subject of the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.sub/) [http.request.jwt.claims.sub.names The `sub` (subject) claim identifies the principal that is the subject of the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.sub.names/) [http.request.jwt.claims.sub.values The `sub` (subject) claim identifies the principal that is the subject of the JWT. - Enterprise add-on](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.jwt.claims.sub.values/) [http.request.method The HTTP method, returned as a string of uppercase characters.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.method/) [http.request.timestamp.msec The millisecond when Cloudflare received the request, between 0–999.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.timestamp.msec/) [http.request.timestamp.sec The timestamp when Cloudflare received the request, expressed as UNIX time in seconds.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.timestamp.sec/) [http.request.uri The URI path and query string of the request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri/) [http.request.uri.args The HTTP URI arguments associated with a request represented as a Map (associative array).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.args/) [http.request.uri.args.names The names of the arguments in the HTTP URI query string.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.args.names/) [http.request.uri.args.values The values of arguments in the HTTP URI query string.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.args.values/) [http.request.uri.path The URI path of the request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.path/) [http.request.uri.path.extension The lowercased file extension in the URI path without the dot (`.`) character.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.path.extension/) [http.request.uri.query The entire query string, without the `?` delimiter.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.uri.query/) [http.request.version The version of the HTTP protocol used. Use this field when different checks are needed for different versions.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.version/) [http.response.code The HTTP status code returned to the client, either set by a Cloudflare product or returned by the origin server.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.response.code/) [http.response.content\_type.media\_type The lowercased content type (including subtype and suffix) without any extra parameters, based on the response's `Content-Type` header.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.response.content_type.media_type/) [http.response.headers The HTTP response headers represented as a Map (or associative array).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.response.headers/) [http.response.headers.names The names of the headers in the HTTP response.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.response.headers.names/) [http.response.headers.values The values of the headers in the HTTP response.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.response.headers.values/) [http.user\_agent The HTTP `User-Agent` request header, which contains a characteristic string to identify the client operating system and web browser.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.user_agent/) [http.x\_forwarded\_for The full value of the `X-Forwarded-For` HTTP header.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.x_forwarded_for/) [ip.src The client TCP IP address, which may be adjusted to reflect the actual address of the client using HTTP headers such as `X-Forwarded-For` or `X-Real-IP`.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src/) [ip.src.asnum The 16-bit or 32-bit integer representing the Autonomous System (AS) number associated with the client IP address.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.asnum/) [ip.src.city The city associated with the client IP address.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.city/) [ip.src.continent The continent code associated with the client IP address.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.continent/) [ip.src.country The 2-letter country code in ISO 3166-1 Alpha 2 format.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.country/) [ip.src.is\_in\_european\_union Whether the request originates from a country in the European Union (EU). - Business or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.is_in_european_union/) [ip.src.lat The latitude associated with the client IP address.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.lat/) [ip.src.lon The longitude associated with the client IP address.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.lon/) [ip.src.metro\_code The metro code or Designated Market Area (DMA) code associated with the incoming request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.metro_code/) [ip.src.postal\_code The postal code associated with the incoming request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.postal_code/) [ip.src.region The region name associated with the incoming request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.region/) [ip.src.region\_code The region code associated with the incoming request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.region_code/) [ip.src.subdivision\_1\_iso\_code The ISO 3166-2 code for the first-level region associated with the IP address. - Business or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.subdivision_1_iso_code/) [ip.src.subdivision\_2\_iso\_code The ISO 3166-2 code for the second-level region associated with the IP address. - Business or above](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.subdivision_2_iso_code/) [ip.src.timezone.name The name of the timezone associated with the incoming request.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ip.src.timezone.name/) [raw.http.request.full\_uri The raw full URI as received by the web server without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.full_uri/) [raw.http.request.uri The URI path and query string of the request without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri/) [raw.http.request.uri.args The raw HTTP URI arguments associated with a request represented as a Map (associative array).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.args/) [raw.http.request.uri.args.names The raw names of the arguments in the HTTP URI query string.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.args.names/) [raw.http.request.uri.args.values The raw values of arguments in the HTTP URI query string.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.args.values/) [raw.http.request.uri.path The raw URI path of the request without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.path/) [raw.http.request.uri.path.extension The raw file extension in the request URI path without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.path.extension/) [raw.http.request.uri.query The entire query string without the `?` delimiter and without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.request.uri.query/) [raw.http.response.headers The HTTP response headers without any transformation represented as a Map (or associative array).](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.response.headers/) [raw.http.response.headers.names The names of the headers in the HTTP response without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.response.headers.names/) [raw.http.response.headers.values The values of the headers in the HTTP response without any transformation.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/raw.http.response.headers.values/) [ssl Returns `true` when the HTTP connection to the client is encrypted.](https://0285ca83.previews.developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/ssl/)

Was this helpful?

YesNo

## On this page

[![](https://0285ca83.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://0285ca83.previews.developers.cloudflare.com/)

```json
{"@context":"https://schema.org","@type":"WebPage","@id":"https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/#page","headline":"Fields reference · Cloudflare Ruleset Engine docs","description":"Complete reference of all fields available in rule expressions.","url":"https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-09-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
```