Cloudflare API Shield: request schema learning on demand
Cloudflare added on-demand API schema learning. What an advertiser’s technical team should verify before using the result to protect an integration.
What was announced
On October 12, 2026, Cloudflare announced on-demand API Shield schema learning. It processes observed traffic across a zone while retaining existing data requirements. This is an external service update for API owners, not a change to AffiliateCore financial logic.
It concerns advertiser technical teams maintaining their own forms or integrations. A domain using Cloudflare does not establish feature access: check account capabilities and permissions. Region and business category also require checking service terms.
Apply it without false confidence
Our workflow: compare your documented API contract with actual request variants first. In an authorized test environment, check required and optional fields, empty values, retries and valid errors. Do not generate fictitious payable conversions to populate observations.
Next review documented learning requirements. Manual runs generate no requests and bypass no thresholds; usable observations determine the result. Completion does not prove that a rare but legitimate request appeared in the data.
Save the schema, date and tested scenarios. Before introducing blocking rules, reconcile it against the contract and safe examples. If legitimate requests fail, stop the protection change and investigate; do not blindly disable existing protection.
Success means an explainable match with permitted scenarios, not merely a green status. Learned structure does not establish client authenticity, amount correctness or payout entitlement. Those remain separate checks.
For AffiliateCore work, document supported events and statuses. An advertiser's API Shield deployment does not mean it is automatically integrated into the platform.
Sources: October 12 announcement, requirements and manual runs.