WAF allow-listing & agent identity

If your WAF blocks our agent, every column fails at step 1 (itself a useful finding). For deliberate tests, let us through.

How our requests identify themselves

Signal	Value
User-Agent	`altqa-agent/1.0 (+https://alt.qa/bot)`
Signature	Web Bot Auth (HTTP Message Signatures, Ed25519); key directory at `/.well-known/http-message-signatures-directory`
Header	`X-Alt-Test: true` on customer runs

Prefer verifying the signature: user agents and headers can be copied; signatures cannot. Full details: /bot.

Cloudflare

(http.user_agent contains "altqa-agent" and any(http.request.headers["x-alt-test"][*] == "true"))
→ Action: Skip · Super Bot Fight Mode rules (Pro plan and above)

Scope the rule to the hostnames in your Test Authorization. Once alt.qa is a Cloudflare verified bot, you can allow it by category instead.

Akamai Bot Manager

Create a custom bot category “alt.qa (authorised testing)” matching the user agent and header, action Allow, scoped to staging hostnames.

Fastly

if (req.http.User-Agent ~ "altqa-agent" && req.http.X-Alt-Test == "true") {
  set req.http.X-Bot-Allowed = "altqa";
}

Test it

In the app: Property → WAF allow-list → Test my rule sends one signed GET and reports the status.