Prove Akamai is serving — first tool + proof field

1. Why “is Akamai serving?” is five questions

Operators collapse five failures into one sentence. The hostname never CNAME’d to an edge hostname. Production still serves property v18 while the student saved v19. App & API Protector denied /api/orders. The origin returned 500 and the edge just forwarded it. The object is a TCP_HIT of last night’s HTML. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught the two objects — property version versus security config version, save versus activate, staging versus production. Here you learn the five tools you actually open, in order, when someone asks you to prove Akamai is serving — or why it blocked.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you ship Fast Fallback — or disable WAF — at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open the WAF rule editor until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to Control Center. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves the delivery object: which property version is on which network, and whether this Host and CP code belong to it. Side B proves the protection object: the security event. Side C proves what the edge actually returned. On a messy Sev-2, do them in this order until a field lights up.

Side A — Property, hostname, CP code (delivery)

1. Open the property, not the WAF editor

   Path: Content delivery → CDN → Properties. Filter by property or hostname. Open the property. Official: Activate on staging / Activate on production. You are hunting Activation History, not a rule tree edit. You cannot edit a version that is already active — create a new version if you must change delivery.

2. Quote version + network + status

   Click the version, then the Activate tab. Proof field: which version is Active on Production. If the ship is only Active on Staging, stop — there is no production WAF story yet. If status is Pending - Full Rollout, live servers already have the new version; the rest of the network is still catching up. Fast Fallback exists only for 60 minutes after full rollout, and only to the last active property version.

3. Prove this Host is on this property

   In the Property Manager Editor, read the Property Hostnames panel. Quote property hostname (what the user types) and edge hostname (the CNAME target — typically *.edgesuite.net Standard TLS or *.edgekey.net Enhanced TLS). Confirm DNS with Test & troubleshoot → Edge Diagnostics → Get Domain Details (DIG). No CNAME to that edge hostname means Akamai is not serving, no matter what Activation History says.

4. Read the CP code on the Default Rule

   Behavior: Content Provider Code. Traffic must be served through an active CP code. Official caveat: a newly created CP code can take up to two hours to be recognized; activating production before that can disrupt service. GREP and DataStream both key off this CP code — if you grep the wrong one, the log is empty and you will invent a WAF story.

Side B — WAF / Security event (protection)

1. Open Web Security Analytics, not the rule editor

   Path: Security → Security analytics → Security Center. Left menu: Analysis → Web Security Analytics. Select the security configuration that covers this hostname. Set the UTC window on the ticket (samples are retained 38 days; query up to 31 days). Official: Navigate Web Security Analytics.

2. Filter, then switch Statistics → Samples

   Start in Statistics to see the spike. Filter Hostname + Path + time. Then open Samples — individual requests with Headers, Client Information, and Rules, including contributing rules that Statistics may hide. Samples are a random hundred in the window. Empty Samples is not proof that WAF never fired — it is a sample.

3. Read Action Applied, then Rule, then Hostname

   Proof field: Action Applied (Alert, Deny, Monitor — Alert records; Deny blocks). Then the rule that fired, the security policy, and the hostname. Official widgets include Action Applied and Rule Action. Rule Action is per-rule; Action Applied is what the request actually got. Do not treat an Alert sample as a 403.

4. If Samples is empty, do not invent a custom rule

   Empty usually means this Host is not on this security configuration, the request never reached the edge, or you filtered the wrong config / time. Go back to Side A (hostname + CP + Production Active) or forward to Side C GREP. App & API Protector: one hostname is covered by only one active security configuration at a time. Activate is Security → Web app & API protection → Web Security → configuration → Activate + Network (Staging to test, Production to go live).

Side C — GREP log + Edge diagnostic (what the edge returned)

1. GREP the Host or the CP code, not “the whole contract”

   Path: Test & troubleshoot → Edge Diagnostics → View logs (GREP). Filter by Host headers or CP codes (up to 10). You need an Edge server IP — get it from User Diagnostic Data or Get Domain Details (DIG). Log record type: r = client → edge, f = edge → origin, or Both. Time: last 6 or 24 hours depending on the server; official recommendation is a 10-minute window. Up to 5,000 lines.

2. Read Status on r, then Status on f

   Proof field: Status (HTTP response code) + Host header + log type. An r line 403 with an f line 200 means the origin was fine and the edge (WAF, metadata, or an access control) denied. An f line 500 means you do not have a WAF ticket. Also quote Error, Time taken / turnaround, and ARL when they are populated.

3. If the ticket is “200 but wrong / stale / slow,” switch to CURL

   Path: Edge Diagnostics → Request Content (CURL). Enter the fully qualified URL. Pick location or edge server IP. Click Add Pragma headers. Official pair: request Pragma: akamai-x-cache-on, akamai-x-get-cache-key, akamai-x-get-request-id (and akamai-x-check-cacheable if you need YES/NO). Results: HTTP status + Headers.

4. Quote X-Cache and X-Cache-Key, not “looks fine”

   X-Cache values include TCP_HIT (fresh from disk cache), TCP_MISS (fetched from origin), TCP_REFRESH_HIT, TCP_MEM_HIT, TCP_NEGATIVE_HIT. X-Cache-Key returns the cache key including serial, CP code, and TTL — that is how you prove the request landed on the CP you think it did. X-Akamai-Request-ID is the join key back into GREP. Content Problems runs CURL + GREP on one URL if you want both tabs at once.

Property:     shop-ion  v18  Production  Active
Hostname:     www.shop.example  →  www.shop.example.edgekey.net
CP code:      7654321   (Default Rule · Content Provider Code)
WSA Sample:   Hostname=www.shop.example  Path=/api/orders
              Action Applied=Deny  Rule=API-schema (lab)  Policy=api-policy
GREP:         r Status=403  ·  f Status=200  ·  Host header=www.shop.example
CURL:         HTTP 403  ·  X-Cache=TCP_MISS  ·  X-Cache-Key contains 7654321
If empty WSA: prove Production Active + hostname on this property, then GREP
If Staging only: do not hunt Production Samples — Activate v# on Production first

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

AKEVD-01 — Prove the live property (Activate tab)

01:42 · P2. Priya on a hotel network. Day team said they “shipped v19.” L1 already drafted Fast Fallback. CIO asks if Akamai is even serving.

First tool: Content delivery → CDN → Properties → shop-ion → Activate tab.

If Staging only: v19 is Active on Staging; v18 is still Active on Production. Quote both rows. End users never hit ESN. Next act is Activate v19 on Production (after staging tests) — or tell the channel the live version is still v18. That is not a WAF ticket.

If Production Active: you proved the delivery object. You have not proved hostname, WAF, or cache. Now you are allowed to open Property Hostnames and WSA.

AKEVD-02 — Prove the block (WSA Samples)

02:05 · P2. Mobile shipped a new /api/orders body at 10:00. Checkout 403 after last night’s security-config activate. Someone wants App & API Protector set to Alert for the tenant.

First tool: Security → Security analytics → Security Center → Analysis → Web Security Analytics → Samples. Security configuration = shop-waf. Filter Hostname = www.shop.example, Path contains /api/orders, last hour.

Proof field: Action Applied = Deny, Rule = API-schema (lab), Policy = api-policy. /login in the same window is Alert — that is not this 403. The rule name is the ticket. Change that one control (or the API constraint), Activate the security config on Production, then re-read the same three columns. Do not clone the property to fix a schema deny.

AKEVD-03 — Prove the Host (hostname + CP + DIG)

02:20 · P1. Marketing cut over shop.example (apex-style host in the ticket). www.shop.example is fine. WSA for shop-waf has no Samples for the new Host. L1 wants a custom rule.

First tool: Property Hostnames on shop-ion v18, then Get Domain Details (DIG) for shop.example.

Proof field: www.shop.example → www.shop.example.edgekey.net is on the property. shop.example is not in Property Hostnames. DIG does not CNAME to an Akamai edge hostname. Empty WSA is expected — this Host never reached the security configuration. Add the hostname to a new property version, activate Staging, then Production. Assign an existing, recognized CP code — do not create a brand-new CP code and activate Production in the same hour (official: up to two hours before the network recognizes it).

AKEVD-04 — Prove the status (GREP r vs f)

02:40 · P1. Checkout throws 500. Channel says “Akamai WAF.” WSA Samples for the same minute show Alert, not Deny.

First tool: View logs (GREP). Host header = www.shop.example. Log record type = Both. Last 10 minutes. Edge server IP from DIG.

Proof field: r Status = 500 and f Status = 500. Origin already failed; the edge forwarded it. Alert on WSA is a recording, not a mitigation. Restarting origin (or the app pool) is isolate. Disabling App & API Protector is change-control that will not fix a 500.

The opposite pair is the AKEVD-02 close: r 403 + f 200 = edge policy, not origin death.

AKEVD-05 — Prove the cache hop (CURL + Pragma)

03:00 · P3. Homepage is yesterday’s sale banner. WSA Action Applied is Alert or empty. Property v18 is Production Active. Someone typed Sev-1 and a WAF Deny.

First tool: Request Content (CURL) on https://www.shop.example/. Add Pragma headers.

Proof field: HTTP 200 + X-Cache: TCP_HIT + X-Cache-Key containing CP 7654321 and a long TTL. That is a cache object, not a WAF ticket. If you need origin’s copy, you are in property behaviors (caching, cache key, purge) — a new property version — not a security-config Activate. Compare two locations with CURL compare if only one region is stale.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• TechDocs — How activation works (staging vs production, phases, Pending - Full Rollout, Active, Fast Fallback 60-minute window, cannot edit an active property)
• TechDocs — Activate on staging (Content delivery → CDN → Properties → Version → Activate tab → Activate v# on Staging)
• TechDocs — Activate on production (Activate v# on Production; DNS CNAME to the edge hostname)
• TechDocs — Key concepts and terms (property hostname vs edge hostname)
• TechDocs — Content Provider Code (CP codes required before production; new CP code recognition up to two hours)
• TechDocs — Map your domain to a property (CNAME to edge hostname; hostname Status column)
• TechDocs — Mitigate threats against your web applications (Security → Web app & API protection → Web Security; Activate + Network; one hostname, one active security configuration)
• TechDocs — Security Configurations (versioned; cannot edit an activated version; Activate)
• TechDocs — Application Security API concepts (rule actions alert / deny / none; versioned security configurations)
• TechDocs — Navigate Web Security Analytics (Security → Security analytics → Security Center; Statistics vs Samples; 31-day query / 38-day sample retention)
• TechDocs — Samples view (Requests, Headers, Client Information, Rules; random hundred)
• TechDocs — Add a filter (Action Applied vs Rule Action)
• TechDocs — View Logs (GREP) (Test & troubleshoot → Edge Diagnostics; Host headers / CP codes; log type r/f; Status; Host header; 6/24 hours; 10-minute recommendation)
• TechDocs — Request Content (CURL) (HTTP status + Headers; Add Pragma headers)
• TechDocs — Pragma headers (X-Cache TCP_HIT / TCP_MISS / …; X-Cache-Key serial + CP code + TTL; X-Akamai-Request-ID)
• TechDocs — Content Problems (CURL + GREP on one URL)
• TechDocs — Choose a tool or problem scenario (GREP, CURL, DIG, Verify and Locate IP, URL health check)
• TechDocs — DataStream 2 data set parameters (cp, reqHost, HTTP status — the long-running log sibling of GREP)

Related: Factory · property version ≠ security config version · WAAP ASE policy tuning · App & API Protector Hybrid · Akamai practice dashboard