> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Advanced rule objects and attributes

> Reference for advanced rule objects and attributes, including operators for Dict-type attributes in Gcore filtering rules.

The following table contains all available objects and attributes you can use in your advanced rules.

| Object | Attribute | Arguments | Type | Description |
| - | - | - | - | - |
| client\_data | | | Container | |
| | fingerprint | | Dict | Client fingerprint object |
| response | | | Container | Container for response context |
| | headers | | Dict | A dictionary of the response headers. Header names are case-insensitive; header values are case-sensitive. |
| | status | | Var | Status code from the origin (integer) |
| request | | | Container | Container for request context |
| | rate\_limit | | Function | Returns `true` if the rate limit is exceeded |
| | | content\_type | String | A string with a maximum of 30 characters, case-insensitive (optional) |
| | | interval | Integer | An integer between 1 and +inf |
| | | ip\_list | List | A list of 0-10 items: a string representing an IP address (IPv4 or IPv6) |
| | | method\_list | List | A list of 0-9 items of: an HTTP method |
| | | requests | Integer | An integer between 20 and +inf |
| | | scope | Choice | One of the following values: IP or cluster |
| | | status\_list | List | A list of 0-20 items: an integer between 100 and 999 |
| | | url | URL | A valid URL |
| | ip\_in\_range | | Function | Returns true if the client IP is contained within the given range |
| | | from\_ip | IP | A string representing an IP address (IPv4 or IPv6) |
| | | to\_ip | IP | A string representing an IP address (IPv4 or IPv6) |
| | headers | | Dict | A dictionary of the request headers. Header names are case-insensitive; header values are case-sensitive. |
| | ip | | Var | A string representing the client IP |
| | ja3 | | Var | JA3 [TLS fingerprint](/waap/threat-intelligence/tls-fingerprinting) of the client (32-character hex string) |
| | ja4 | | Var | JA4 [TLS fingerprint](/waap/threat-intelligence/tls-fingerprinting) of the client (prefix\_hex12\_hex12 format) |
| | is\_ajax | | Function | Returns true if the request type is AJAX |
| | is\_api | | Function | Returns true if the request is an API call |
| | is\_static | | Function | Returns true if the request type is STATIC |
| | method | | Var | HTTP method (uppercase) |
| | origin\_ip | | Var | A string representing the client origin IP |
| | path | | Var | Path of the URL (case-sensitive) |
| | query\_params | | Var | Query params (case-sensitive) |
| | upload\_file\_content\_type | | Var | Content type of the uploaded file (case-insensitive, e.g., image/PNG) |
| | upload\_file\_extension | | Var | File extension of the uploaded file (case-insensitive, e.g., PNG) |
| | uri | | Var | A full URI string (case-sensitive) |
| | url | | Var | A full URL string (case-sensitive) |
| | all | | Function | Returns true if all the given tags exist |
| | any | | Function | Returns true if one or more of the given tags exist |
| | exists | | Function | Returns true if the given tag exists |
| | tag | | String | A string with a maximum of 30 characters |
| | tag\_list | | List | A list of 1-10 items of a string with max 30 characters |
| user\_agent | | | Container | The User-Agent header parsed into segments; all attribute values are lowercase, so write conditions using lowercase strings. |
| | client | | Var | Client name (lowercase). For example, chrome, firefox. |
| | client\_type | | Var | Client type. For example, major, lib. |
| | client\_version | | Var | Client version. For example, 47.1.23. |
| | client\_version\_float | | Var | Client version, major.minor part. For example, 47.1. |
| | cpu | | Var | CPU brand (lowercase). For example, intel. |
| | device | | Var | Device brand (lowercase). For example, iphone, playstation. |
| | device\_type | | Var | Device type. For example, mobile, console. |
| | engine | | Var | Engine type (lowercase). For example, gecko, applewebkit. |
| | os | | Var | Client's OS (lowercase). For example, linux, windows 8. |
| whois | | | Container | Container for WHOIS data of the client IP |
| | country | | Var | Country code (uppercase) |
| | org | | Var | Organization name (case-insensitive) |
| | owner\_type | | Var | Owner type (case-insensitive) |
| | asn | | Var | Autonomous system number |

## Operators for Dict-type attributes

Attributes of type `Dict` (`client_data.fingerprint`, `request.headers`, and `response.headers`) support a different set of operators than `Var`-type attributes. The following three operators are available for all Dict-type attributes:

| Operator | Description |
| - | - |
| key exists | Evaluates to `true` when the specified key is present in the dictionary. |
| key not exists | Evaluates to `true` when the specified key is absent from the dictionary. |
| value equals | Evaluates to `true` when the value for the specified key matches a given string. |

**Examples**

* **key exists** – match requests that include an `Authorization` header:

```
"Authorization" in request.headers
```

* **key not exists** – match requests that do not include a `User-Agent` header:

```
"User-Agent" not in request.headers
```

* **value equals** – match responses where the `Content-Type` header equals `application/json`:

```
response.headers["Content-Type"] == "application/json"
```