Runtime and CLI Reference

How AIWAF works: system architecture

AIWAF exposes language-specific middleware, engine, and CLI APIs. There is no shared /api/v1 bearer-token management service in the current repo.

Python

# Bare help selects the single installed framework
aiwaf --help

# Explicit Flask policy commands
aiwaf flask blocklist migrate
aiwaf flask status

# Django management commands
python manage.py detect_and_train
python manage.py regenerate_model
python manage.py aiwaf_reset --keywords --confirm
python manage.py aiwaf_logging --status
python manage.py geo_block_country list

# Explicit adapter dispatch
aiwaf django aiwaf_list --all
aiwaf flask --help
aiwaf fastapi --help

Bare Python commands detect the single installed framework. With multiple frameworks, use the explicit prefixes above. Django keeps management-command names, and fast is an alias for fastapi. Use --framework and --app with aiwaf init for route discovery; FastAPI training separately uses --app.

Node.js

cd js

AIWAF_ACCESS_LOG=/path/to/access.log npm run train
npm run aiwaf -- status
npm run aiwaf -- list blocklist
npm run aiwaf -- add blocklist 203.0.113.9 "manual block"
npm run aiwaf -- add ip-exemption 203.0.113.10 "trusted monitor"
npm run aiwaf -- geo summary
npm run aiwaf -- model info
npm run aiwaf -- export aiwaf-export.json

Use Redis or another shared cache for consistent rate limiting across multiple Node processes. Without shared state, the in-memory fallback is process-local.

In an application with the npm package installed, use npx aiwaf --help; the source commands above run from js/.

These Node CLI commands operate on legacy stores. The explicit native engine has dedicated event files and model snapshots; its state is not managed or imported automatically by the legacy CLI. See native operations.

Java

aiwaf-cli status
aiwaf-cli diagnose --model model.json
aiwaf-cli blocked
aiwaf-cli unblock 203.0.113.10
aiwaf-cli train --events events.json --out model.json --backend java
aiwaf-cli model status --path model.json

Adapter and binding references

• Python adapters
• Node.js entry points
• Java engine
• Rust/Python and WASM functions

Website endpoints

This Flask documentation application defines its own /health, /aiwaf/status, /aiwaf/allowlist, /aiwaf/blocklist, and /aiwaf/keywords routes. Those are website-specific handlers, not a portable AIWAF API. Their implementation does not provide the bearer-token authentication previously described here.