I have a website that also has an API that is used by a mobile app and a Windows app with post/get requests. the website part is protected using Cloudflare proxies and standard js/interaction messages. Because the API is receiving get/post requests from Windows/android, there is no js or human interaction accepted so I added a WAF rule with this configuration.
When an API request is received, the response is
Just a moment...
Enable JavaScript and cookies to continue
How can I fix this?