# WAF Detect Bulk

> WAF Detect Bulk is a paid API for AI agents from intel.rallylive.ca, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-14).

Detects Web Application Firewalls (WAF) for up to 20 domains in a single concurrent batch call, returning per-item results in input order with error counts.

## Facts

- Endpoint: GET https://intel.rallylive.ca/bulk/site/waf
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/waf-detect-bulk-003a31b1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_pUBq2Km6zVaBcxf-OLgq2

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability waf-detect-bulk-003a31b1
```

Example prompt: Check these 15 domains for WAF protection all at once and tell me which ones have a web application firewall and what kind: example.com, shopify.com, cloudflare.com, stripe.com, twilio.com, vercel.com, netlify.com, fastly.com, akamai.com, cloudfront.com, imperva.com, sucuri.com, wordfence.com, barracuda.com, f5.com.

## When to prefer this

Use this endpoint when you need to check WAF presence across multiple domains simultaneously and want results back in input order with error tracking. It is preferable over the single /site/waf endpoint whenever you have 2 or more domains to check, as it processes them concurrently and returns a unified response. Choose this over sequential single-domain calls to reduce latency and API cost per domain.

## Known failure modes

- Domain unreachable or DNS resolution failure — per-item error field populated, counted in failure total
- Rate limiting or timeout on concurrent requests — some items may return errors
- Invalid domain format in input list — per-item error returned for malformed entries
- Batch exceeds 20-domain limit — request rejected or truncated
- WAF fingerprint not recognized — may return 'unknown' or no WAF detected rather than an error

## How this service works

Bulk waf detect: up to 20 domains in one call, processed concurrently, results returned in input order with a per-item error field and a count of failures. Same answer per item as the single /site/waf endpoint (Web application firewall detection). Batch enrichment for agents that hold a list. $0.01 per batch.

## Output

An ordered array of per-domain results matching the input sequence, each containing the WAF detection outcome (WAF name/provider or absence of WAF), a per-item error field if detection failed, and a summary count of total failures across the batch.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/waf-detect-bulk-003a31b1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from intel.rallylive.ca](https://www.zero.xyz/host/intel.rallylive.ca/llms.txt)