Application Profiles define application-specific expectations and classify requests against them. They add a positive-security model to your existing protections.
Schema Profile is the only current profile type. It models supported request fields, types, formats, ranges, and values.
A Schema Profile can come from observed traffic or an uploaded OpenAPI schema. Both sources produce the same profile type.
An operation is Cloudflare's term for an endpoint identified by HTTP method, hostname pattern, and path pattern. Web Assets continuously discovers operations, and you can add operations manually.
Discovery and manual creation only add operations to your inventory. Profiling starts when you select Learn profile for an operation.
After the profile becomes available, Cloudflare runs an always-on detection. The detection classifies requests but does not mitigate traffic.
Review results in Profile Analysis before creating a Custom Rule. This keeps detection, investigation, and mitigation as separate steps.
Positive security identifies requests outside your expected application structure. A non-conforming request does not need to match an attack signature.
Application Profiles complement Managed Rules, Attack Score, and other negative-security detections. You can combine these signals in Custom Rules.