# pw platform firewall rules create

> Source: https://parallelworks.com/docs/cli/pw/platform/firewall/rules/create

## pw platform firewall rules create

Add a rule that denies, or only logs, matching requests

```
pw platform firewall rules create --variable field... --operator op [--argument value] --message text [--action deny|log] [flags]
```

### Examples

```
  # Try a rule in log-only mode first; switch it to deny once block logs show only what it should match
  pw platform firewall rules create --action log --phase 1 --variable REQUEST_HEADERS:User-Agent --operator contains --argument badbot --transform lowercase --message "Bad bot"
  
  # Patch a field on one route until a fix ships
  pw platform firewall rules create --path /api/users/{user} --method POST --variable ARGS:json.name --operator rx --argument '[<>]' --message "Markup in a name" --for 72h
```

### Options

```
      --action string          deny blocks a matching request; log only reports it (default "deny")
      --argument string        What the operator compares with; no double quotes (write \x22 in a regular expression)
      --for duration           How long it applies, such as 72h; absent applies until deleted
  -h, --help                   help for create
      --message string         What block logs report when it matches
      --method strings         HTTP method it applies to; repeat for more. Absent applies to every method
      --note string            Why it is needed
      --operator string        rx, pm, streq, beginsWith, endsWith, contains, within, ipMatch, eq, gt, ge, lt, le, detectSQLi or detectXSS
      --path string            Route, such as /api/users/{user}; {param} is one path segment and a trailing /* covers every path below. Absent applies to every route
      --phase int              1 inspects the request line and headers, and also runs on routes whose shipped exemption turns the rest of the firewall off; 2 also inspects the body (default 2)
      --status int             Status a denied request gets (default 403)
      --transform strings      Transformation applied to each field first, such as lowercase or urlDecodeUni; repeat for more, in order
      --variable stringArray   Request field to inspect, such as ARGS:json.name or REQUEST_HEADERS:User-Agent; repeat for more
```

### Options inherited from parent commands

```
      --context string         The context to use. Overrides PW_CONTEXT environment variable and current context from config.
      --platform-host string   The Parallel Works ACTIVATE platform host to use. Overrides PW_PLATFORM_HOST environment variable and the current context's server.
  -v, --verbose                Enable verbose logging
```

### SEE ALSO

* [pw platform firewall rules](/docs/cli/pw/platform/firewall/rules)	 - Manage the platform's own firewall rules, to answer attacks the shipped rules miss