# UpdateXssMatchSet **Note** AWS WAF Classic support will end on September 30, 2025. This is ** AWS WAF Classic** documentation. For more information, see [AWS WAF Classic](https://docs.aws.amazon.com/waf/latest/developerguide/classic-waf-chapter.html) in the developer guide. **For the latest version of AWS WAF **, use the AWS WAFV2 API and see the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html). With the latest version, AWS WAF has a single set of endpoints for regional and global use. Inserts or deletes [XssMatchTuple](API_wafRegional_XssMatchTuple.md) objects (filters) in an [XssMatchSet](API_wafRegional_XssMatchSet.md). For each `XssMatchTuple` object, you specify the following values: + `Action`: Whether to insert the object into or delete the object from the array. To change an `XssMatchTuple`, you delete the existing object and add a new one. + `FieldToMatch`: The part of web requests that you want AWS WAF to inspect and, if you want AWS WAF to inspect a header or custom query parameter, the name of the header or parameter. + `TextTransformation`: Which text transformation, if any, to perform on the web request before inspecting the request for cross-site scripting attacks. You can only specify a single type of TextTransformation. You use `XssMatchSet` objects to specify which Amazon CloudFront requests that you want to allow, block, or count. For example, if you're receiving requests that contain cross-site scripting attacks in the request body and you want to block the requests, you can create an `XssMatchSet` with the applicable settings, and then configure AWS WAF to block the requests. To create and configure an `XssMatchSet`, perform the following steps: 1. Submit a [CreateXssMatchSet](API_wafRegional_CreateXssMatchSet.md) request. 1. Use [GetChangeToken](API_wafRegional_GetChangeToken.md) to get the change token that you provide in the `ChangeToken` parameter of an [UpdateIPSet](API_wafRegional_UpdateIPSet.md) request. 1. Submit an `UpdateXssMatchSet` request to specify the parts of web requests that you want AWS WAF to inspect for cross-site scripting attacks. For more information about how to use the AWS WAF API to allow or block HTTP requests, see the [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/). ## Request Syntax ``` { "ChangeToken": "string", "Updates": [ { "Action": "string", "XssMatchTuple": { "FieldToMatch": { "Data": "string", "Type": "string" }, "TextTransformation": "string" } } ], "XssMatchSetId": "string" } ``` ## Request Parameters For information about the parameters that are common to all actions, see [Common Parameters](CommonParameters.md). The request accepts the following data in JSON format. ** [ChangeToken](#API_wafRegional_UpdateXssMatchSet_RequestSyntax) ** The value returned by the most recent call to [GetChangeToken](API_wafRegional_GetChangeToken.md). Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Pattern: `.*\S.*` Required: Yes ** [Updates](#API_wafRegional_UpdateXssMatchSet_RequestSyntax) ** An array of `XssMatchSetUpdate` objects that you want to insert into or delete from an [XssMatchSet](API_wafRegional_XssMatchSet.md). For more information, see the applicable data types: + [XssMatchSetUpdate](API_wafRegional_XssMatchSetUpdate.md): Contains `Action` and `XssMatchTuple` + [XssMatchTuple](API_wafRegional_XssMatchTuple.md): Contains `FieldToMatch` and `TextTransformation` + [FieldToMatch](API_wafRegional_FieldToMatch.md): Contains `Data` and `Type` Type: Array of [XssMatchSetUpdate](API_wafRegional_XssMatchSetUpdate.md) objects Array Members: Minimum number of 1 item. Required: Yes ** [XssMatchSetId](#API_wafRegional_UpdateXssMatchSet_RequestSyntax) ** The `XssMatchSetId` of the `XssMatchSet` that you want to update. `XssMatchSetId` is returned by [CreateXssMatchSet](API_wafRegional_CreateXssMatchSet.md) and by [ListXssMatchSets](API_wafRegional_ListXssMatchSets.md). Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Pattern: `.*\S.*` Required: Yes ## Response Syntax ``` { "ChangeToken": "string" } ``` ## Response Elements If the action is successful, the service sends back an HTTP 200 response. The following data is returned in JSON format by the service. ** [ChangeToken](#API_wafRegional_UpdateXssMatchSet_ResponseSyntax) ** The `ChangeToken` that you used to submit the `UpdateXssMatchSet` request. You can also use this value to query the status of the request. For more information, see [GetChangeTokenStatus](API_wafRegional_GetChangeTokenStatus.md). Type: String Length Constraints: Minimum length of 1. Maximum length of 128. Pattern: `.*\S.*` ## Errors For information about the errors that are common to all actions, see [Common Error Types](CommonErrors.md). ** WAFInternalErrorException ** The operation failed because of a system problem, even though the request was valid. Retry your request. HTTP Status Code: 500 ** WAFInvalidAccountException ** The operation failed because you tried to create, update, or delete an object by using an invalid account identifier. HTTP Status Code: 400 ** WAFInvalidOperationException ** The operation failed because there was nothing to do. For example: + You tried to remove a `Rule` from a `WebACL`, but the `Rule` isn't in the specified `WebACL`. + You tried to remove an IP address from an `IPSet`, but the IP address isn't in the specified `IPSet`. + You tried to remove a `ByteMatchTuple` from a `ByteMatchSet`, but the `ByteMatchTuple` isn't in the specified `WebACL`. + You tried to add a `Rule` to a `WebACL`, but the `Rule` already exists in the specified `WebACL`. + You tried to add a `ByteMatchTuple` to a `ByteMatchSet`, but the `ByteMatchTuple` already exists in the specified `WebACL`. HTTP Status Code: 400 ** WAFInvalidParameterException ** The operation failed because AWS WAF didn't recognize a parameter in the request. For example: + You specified an invalid parameter name. + You specified an invalid value. + You tried to update an object (`ByteMatchSet`, `IPSet`, `Rule`, or `WebACL`) using an action other than `INSERT` or `DELETE`. + You tried to create a `WebACL` with a `DefaultAction` `Type` other than `ALLOW`, `BLOCK`, or `COUNT`. + You tried to create a `RateBasedRule` with a `RateKey` value other than `IP`. + You tried to update a `WebACL` with a `WafAction` `Type` other than `ALLOW`, `BLOCK`, or `COUNT`. + You tried to update a `ByteMatchSet` with a `FieldToMatch` `Type` other than HEADER, METHOD, QUERY\$1STRING, URI, or BODY. + You tried to update a `ByteMatchSet` with a `Field` of `HEADER` but no value for `Data`. + Your request references an ARN that is malformed, or corresponds to a resource with which a web ACL cannot be associated. HTTP Status Code: 400 ** WAFLimitsExceededException ** The operation exceeds a resource limit, for example, the maximum number of `WebACL` objects that you can create for an AWS account. For more information, see [AWS WAF Classic quotas](https://docs.aws.amazon.com/waf/latest/developerguide/classic-limits.html) in the * AWS WAF Developer Guide*. HTTP Status Code: 400 ** WAFNonexistentContainerException ** The operation failed because you tried to add an object to or delete an object from another object that doesn't exist. For example: + You tried to add a `Rule` to or delete a `Rule` from a `WebACL` that doesn't exist. + You tried to add a `ByteMatchSet` to or delete a `ByteMatchSet` from a `Rule` that doesn't exist. + You tried to add an IP address to or delete an IP address from an `IPSet` that doesn't exist. + You tried to add a `ByteMatchTuple` to or delete a `ByteMatchTuple` from a `ByteMatchSet` that doesn't exist. HTTP Status Code: 400 ** WAFNonexistentItemException ** The operation failed because the referenced object doesn't exist. HTTP Status Code: 400 ** WAFStaleDataException ** The operation failed because you tried to create, update, or delete an object by using a change token that has already been used. HTTP Status Code: 400 ## See Also For more information about using this API in one of the language-specific AWS SDKs, see the following: + [AWS Command Line Interface V2](https://docs.aws.amazon.com/goto/cli2/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for .NET V4](https://docs.aws.amazon.com/goto/DotNetSDKV4/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for C\$1\$1](https://docs.aws.amazon.com/goto/SdkForCpp/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for Go v2](https://docs.aws.amazon.com/goto/SdkForGoV2/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for Java V2](https://docs.aws.amazon.com/goto/SdkForJavaV2/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for JavaScript V3](https://docs.aws.amazon.com/goto/SdkForJavaScriptV3/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for Kotlin](https://docs.aws.amazon.com/goto/SdkForKotlin/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for PHP V3](https://docs.aws.amazon.com/goto/SdkForPHPV3/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for Python](https://docs.aws.amazon.com/goto/boto3/waf-regional-2016-11-28/UpdateXssMatchSet) + [AWS SDK for Ruby V3](https://docs.aws.amazon.com/goto/SdkForRubyV3/waf-regional-2016-11-28/UpdateXssMatchSet)