Priority_
Learn how Appwrite Firewall evaluates rules by priority and first-match behavior.
2 min read
Priority sets the order Appwrite evaluates rules in. Lower numbers run first. The first rule that matches applies its action, and no later rule runs for that request.
Priority ranges from -100000 to 100000. The Console's stepper stops at 0, so type a negative number to go below it.
How evaluation works
- Appwrite loads enabled rules for the project, ordered by priority ascending (for example
10before100). - Appwrite skips rules that do not apply to the request's resource type.
- For each remaining rule in order, Appwrite checks whether all conditions match.
- On the first match, the rule action runs (deny, bypass, challenge, rate limit, or redirect).
- Appwrite ignores later rules for that request.
If no rule matches, the request continues.
Bypass stops evaluation, and so does rate limit while the request is under the quota. Neither lets a later deny rule run.
One case is different. A rate limit rule with Limit by set to userId cannot apply to a signed-out visitor, so Appwrite skips it and continues to the rules below.
Choosing priority values
The Console create wizard defaults priority to 100, while the API defaults to 0 when you omit the parameter. Common patterns:
| Pattern | Approach |
|---|---|
| Allowlist then deny | Bypass at 10, deny at 100 |
| Tight path before broad rate limit | Path-specific deny at 20, broad rate limit at 200 |
| Temporary override | Insert a new rule at a lower number than existing policies |
| Attack mode on a site | Catch-all challenge at 0. Bypass allowlists must use a negative priority to run first |
Leave gaps between priorities (for example 10, 20, 30) so you can insert rules later without renumbering everything.
To change a rule's priority, open its actions menu in the rules list and choose Update. The change applies to new requests within moments.
Was this page helpful?
Share what worked or what we should fix. Once approved, our agents automatically apply suggested updates to the docs.