Export (OpenAPI)

What Is Export (OpenAPI)?

Export (OpenAPI) downloads all the page types (WAF rules) of the selected host group as a standard OpenAPI 3.0 document. While Export produces a rule list specific to TR7, this feature expresses the rule set with the common language of the API world: the document can be opened with the API documentation and test tools, can be shared with the API teams and can be restored to TR7 losslessly with Import (OpenAPI).

The Export Steps

1. The Export (OpenAPI) button on the toolbar is clicked. The operation is independent of the table selection; the whole of the group is always exported.
2. There is no confirmation window; the file is downloaded directly by the browser. While the operation is going on, the button icon turns into a spinning icon and the other operations on the toolbar become passive temporarily.

The name of the downloaded file consists of the protected vService name, the host group name, the openapi suffix and the date-time stamp (the spaces are replaced with _): for example Web_Servisi-DEFAULT_HOST_GROUP_openapi_20260828_1530.json. The output is always in the JSON format; a YAML output is not produced (Import (OpenAPI), on the other hand, accepts YAML files as well).

The export is a read-only operation; the WAF configuration does not change.

The Produced Document

The document is a valid OpenAPI 3.0 definition; every page type takes place as a path under paths:

• The paths: The exact paths are written as they are. Every * in the glob paths is converted into a template parameter in the {param1}, {param2} form in order: for example the /api/v*/login rule is seen in the document as /api/v{param1}/login.
• The operations: Among the methods in the Allowed Methods list of the rule, the ones that correspond to the standard HTTP methods are written as the operations of the path. The rules that have no method restriction are seen in the document representatively with a single get operation.
• The parameter and body schemas: Among the Check Fields inspections of the rule, the query and header fields are written as parameters (the required fields with the required mark), and the form/JSON/XML body fields as requestBody schemas; the length and pattern restrictions defined on the fields are reflected in the schema.
• Any Paths: The catch-all rule does not enter under paths; it is carried in the section of the document that is specific to TR7.

Lossless restoring, lossy standard view

The document also carries the full configuration of every rule in a field specific to TR7 (x-tr7-waf); thanks to this, restoring to TR7 with Import (OpenAPI) is lossless. The standard OpenAPI fields, on the other hand, reflect only a part of the rules: the inspections specific to TR7 such as Path Length, Path Depth and the OWASP scanning do not take place in the standard view. Processing the document with a third-party tool and importing it again may therefore lead to a loss of information.

The Comparison with the Plain Export

	Export	Export (OpenAPI)
Format	A JSON rule list specific to TR7	A standard OpenAPI 3.0 document
Purpose	Backup, moving between TR7s	Sharing with the API tools + restoring to TR7
Restoring	Import (full replacement)	Import (OpenAPI) (merging)

Operational Best Practices

• The plain Export should be preferred for backup. The standard way of backing up and restoring the rule set exactly is the Export + Import pair; the OpenAPI format is for sharing and for working together with the API tools.
• The content should be known before sharing. Besides the standard API definition, the document also carries all the details of the WAF rules in the sections specific to TR7; if it is to be shared outside the organization, it should be taken into account that these sections will have been shared as well.