> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Customizable YAML Rule Engine

> Build and modify custom API security rules using YAML — supporting transforms, response checks, and CWE-based detection logic.

![](https://mintcdn.com/snapsec-23724fa2/KMyQ-GXYMPFlHVaa/images/was/features/rule-engine.png?fit=max\&auto=format\&n=KMyQ-GXYMPFlHVaa\&q=85\&s=4dceaf724910f4a06311e3e204d3a351)

## Overview

The Customizable YAML Rule Engine empowers teams to define their own API security testing logic using a flexible YAML-based syntax.\
From request transforms and behavioral validations to CWE-driven response analysis, the engine enables deep, customizable, and highly targeted API vulnerability detection for any endpoint or workflow.

## Key Capabilities

> **Flexible YAML-Based Rules**
>
> Write and modify security rules using a clean YAML structure designed for clarity and extensibility.

> **Custom Transforms**
>
> Apply request transforms, payload modifications, or dynamic injections to simulate advanced attack patterns.

> **Response Validation Logic**
>
> Define expected or forbidden behaviors and validate API responses with custom matchers and conditions.

> **CWE & Category Mapping**
>
> Map rules to CWE categories to ensure structured, industry-aligned vulnerability classification.

> **Reusable Detection Modules**
>
> Build modular rules that can be shared across projects, collections, and environments.

> **Rule Activation & Versioning**
>
> Enable, disable, or version rules to maintain control over testing logic as APIs evolve.

## Value

Unlock complete flexibility in API security testing.\
The YAML rule engine enables precise control, deeper coverage, and tailored detection paths — ensuring your testing adapts to evolving API behaviors and business logic.

## Next Steps

> **[Explore Live Demo Now](https://suite.snapsec.co/demo)**
>
> See how YAML-based rules enable advanced, customizable API security testing.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.