Availability
Cloudflare API Security products are available to Enterprise customers only, though anyone can set up Mutual TLS with a Cloudflare-managed certificate authority.
The full API Shield security suite is available as an Enterprise-only paid add-on, but all customers can access Endpoint Management and Schema Validation functionalities.






cf-placement: local- header? there's no popsubdomain.domain.com, what should I see?((http.request.uri.path matches "^/abcd/efgh" or http.request.uri.path matches "^/hijk/") and http.request.uri.path matches "\.xml|\.json|\.js|\.css")cf-placement: local-subdomain.domain.com