DataDome

No entries match these filters. Clear filters

1. React Native SDK for Fetch 3.0.0 (2026-11-03) Nov 3, 2026 · issue 130

   DataDome React Native SDK for Fetch 3.0.0 rewrites on top of CoreDataDome SDK, replacing the singleton API with createDataDomeFetch(dataDome) and native challenge presentatio⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Initialize DataDome protection for all fetch calls in a React Native app using the new client-based API.
   javascript copy

   import { DataDome } from '@datadome/react-native-core-datadome';
   import { createDataDomeFetch } from '@datadome/react-native-datadome-fetch';
   
   const dataDome = new DataDome({ clientKey: '<your-client-key>' });
   const protectedFetch = createDataDomeFetch(dataDome);
   
   // Use protectedFetch anywhere you would use fetch
   const response = await protectedFetch('https://api.example.com/data');

   • Replace DataDomeFetch and the DataDome singleton (DataDome.configure, DataDome.getInstance) with createDataDomeFetch(dataDome), which takes a DataDome client created with new DataDome({ clientKey }) and returns a fetch-compatible function that automatically adds DataDome headers to every request and checks every response for a challenge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Accept a string, URL, or Request as fetch input, and a Headers object, an array of pairs, or a plain object as headers.
   • Re-export DataDome, ResponseValidationStatus, DataDomeConfiguration, and DataDomeCookie from @datadome/react-native-core-datadome.
   • Return the server response as-is when the CoreDataDome SDK fails, so a DataDome error never blocks the app's request.
   • Rewrite the package in TypeScript.
   • Replace DataDomeFetch and the DataDome singleton (DataDome.configure, DataDome.getInstance) with createDataDomeFetch(dataDome), which takes a DataDome client created with new DataDome({ clientKey }) and returns a fetch-compatible function that automatically adds DataDome headers to every request and checks every response for a challenge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Re-export DataDome, ResponseValidationStatus, DataDomeConfiguration, and DataDomeCookie from @datadome/react-native-core-datadome.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The package is renamed from @datadome/react-native-datadome to @datadome/react-native-datadome-fetch; update all imports and your package.json dependency.
   • !@datadome/react-native-core-datadome is now a required peer dependency and must be installed alongside this package.
   • !DataDomeFetch, DataDome.configure, and DataDome.getInstance are removed; replace them with createDataDomeFetch(new DataDome({ clientKey })).
   • !The datadome per-request option is removed; the returned fetch function now applies DataDome headers and challenge checks to every request automatically.
   • !DataDomeModal, DataDomeModule, and enableVerboseLogs are removed.
   • !The react-native-webview peer dependency is removed; challenges are now presented natively by the CoreDataDome SDK.
   • !React Native 0.85 or newer with the New Architecture is now required, along with iOS 15.1 or newer and Android API 24 or newer.
2. Node.js module 2.7.0 (2026-10-28) Oct 28, 2026 · issue 124

   DataDome Node.js module 2.7.0 adds TLS fingerprint collection to enrich bot-detection signals⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • DataDome now collects TLS fingerprints from incoming requests to send richer bot-detection signals to the Bot Protect API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • DataDome now includes the RequestMetadata property in the TypeScript type definitions.
   • DataDome now collects TLS fingerprints from incoming requests to send richer bot-detection signals to the Bot Protect API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. Cloudflare Worker Rust module 1.0.0 (2026-10-27) Oct 27, 2026 · issue 123

   Adds the datadome-cloudflare-worker Rust crate for native DataDome bot protection inside Cloudflare Workers.

   • New integration DataDome Cloudflare Workers integration (Rust)
4. Fraud SDK .Net 2.1.0 (2026-10-27) Oct 27, 2026 · issue 123

   DataDome Fraud SDK .Net 2.1.0 adds optional eventDate field to set effective event time in payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Pass eventDate in a fraud event payload to record the actual time an event occurred rather than the submission time — useful for replaying or backfilling events.
   json copy

   {
     "eventDate": "2026-10-27T14:32:00Z",
     "...": "..."
   }

5. docs update Oct 22, 2026 · issue 116

   DataDome adds full server-side and client-side bot-protection integration for the Azion edge platform⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Scope bot-protection to login and checkout paths only, exclude your admin area, and enable GraphQL extraction for your /graphql endpoint — all in the firewall function Arguments.
   json copy

   {
     "serverSideKey": "<your-server-side-key>",
     "urlPatternInclusion": "/login|/checkout",
     "urlPatternExclusion": "/admin/",
     "enableGraphQLSupport": true,
     "graphQLEndpoint": "/graphql"
   }

   Enable Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support on a custom MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint and raise the body-read limit for large MCP payloads.
   json copy

   {
     "serverSideKey": "<your-server-side-key>",
     "enableMCPSupport": true,
     "mcpEndpoint": "/mcp,/mcp-v2",
     "maximumBodySize": 51200
   }

   Inject the DataDome JS Tag via your own first-party domain and raise the response-body buffer limit to 4 MB for large HTML pages.
   json copy

   {
     "clientSideKey": "<your-client-side-key>",
     "jsURL": "https://ddfoo.example.com/tags.js",
     "originURL": "https://origin.example.com",
     "maximumResponseBodySize": 4194304
   }

   • Adds serverSideKey, endpoint, timeout, urlPatternExclusion, urlPatternInclusion, staticAssetExclusion, encodedCharInclusion, removeMatrixParams, ipExclusion, logEnrichedHeaders, enableDebugging, customFieldString1-3, customFieldInteger1-2, customFieldFloat1, userID, and productID server-side arguments to the firewall.js Azion firewall function for fine-grained bot-protection control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds enableGraphQLSupport and graphQLEndpoint server-side arguments to extract GraphQL operation name and type on requests to a GraphQL endpoint, improving protection for GraphQL APIs.
   • Adds enableMCPSupport and mcpEndpoint server-side arguments to enable Model Context Protocol support and extract MCP information at a configurable endpoint.
   • Adds maximumBodySize server-side argument (default 25600 bytes / 25 KB) to cap the request body read for GraphQL and MCP extraction.
   • Adds clientSideKey, jsURL, jsTagOptions, originURL, and maximumResponseBodySize client-side arguments to the js-tag-injection.js Azion application function for JS Tag injection into HTML responses.

   +1 more show less

   • Adds maximumResponseBodySize client-side argument (default 2 MB) to control the HTML response size threshold above which the JS Tag is skipped and the response is passed through unmodified.

   6 details in Everything

6. Fastly Compute Rust module 1.0.0 (2026-10-21) Oct 21, 2026 · issue 116
   • New integration Fastly Compute (Rust) integration
7. Azion module 1.0.0 (2026-10-21) Oct 21, 2026 · issue 116
   • New integration DataDome Azion module
8. Fraud SDK Java 3.1.0 (2026-10-21) Oct 21, 2026 · issue 116

   Fraud SDK Java 3.1.0 adds optional eventDate field to supply the effective event time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

9. Android SDK 3.1.0 (2026-10-21) Oct 21, 2026 · issue 115

   DataDome Android SDK 3.1.0 adds predictive back support with configurable BackBehaviour on Android 13+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Opt in to Android predictive back so DataDome's BackBehaviour controls what happens when a user swipes back on a protected screen.
   app/src/main/AndroidManifest.xml copy

   <application
       android:enableOnBackInvokedCallback="true"
       ... />

   • Adds support for Android predictive back gesture via BackBehaviour enum (BLOCKED, GO_BACKGROUND, GO_BACK), honoured on Android 13+ when the app sets android:enableOnBackInvokedCallback="true" or targets API 36+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Requires androidx.activity 1.6.1 and compileSdk 33 or higher.
   • Adds support for Android predictive back gesture via BackBehaviour enum (BLOCKED, GO_BACKGROUND, GO_BACK), honoured on Android 13+ when the app sets android:enableOnBackInvokedCallback="true" or targets API 36+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The SDK now requires androidx.activity 1.6.1 and apps must compile with compileSdk 33 or higher; projects on lower compile SDK versions will fail to build.
10. Fraud SDK Go v2.1.0 (2026-10-02) Oct 2, 2026 · issue 092

    DataDome Fraud SDK Go v2.1.0 adds optional eventDate field for setting effective event time in payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

11. Flutter Dio SDK 3.5.0 (2026-10-02) Oct 2, 2026 · issue 092

    DataDome Flutter Dio SDK 3.5.0 adds Swift Package Manager support for iOS and an iOS privacy manifest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds Swift Package Manager (SPM) support for iOS native dependencies alongside existing CocoaPods support; apps on Flutter 3.44+ with SPM enabled resolve the plugin via SPM automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds an iOS privacy manifest (PrivacyInfo.xcprivacy) to the plugin.

    2 details in Everything

12. announced Oct 1, 2026 · issue 093

    DataDome adds AI Key Takeaways to Homepage & Trend Reports, delivering real-time security and business summaries for Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Switch from the security analyst view to the executive business view inside AI Key Takeaways to prepare a monthly risk report without rebuilding data from scratch.
    📍In the DataDome dashboard, go to Homepage or Trend Reports › AI Key Takeaways › toggle from Security view to Business view.
    • Adds AI Key Takeaways to the DataDome Homepage & Trend Reports, providing a real-time AI-generated summary of threat data including sophisticated bots, AI agents, and threat traffic ratio.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces a security view as the default mode of AI Key Takeaways, surfacing detection precision, critical escalations, unusual behavioral patterns, attack pattern analysis, and configuration recommendations.
    • Introduces a business view toggle within AI Key Takeaways that reframes the same underlying data for executive audiences, covering protection status, threats blocked, false positive rates, and actionable guidance for internal reporting.

    3 details in Everything

13. Google Cloud Load Balancer module 1.8.0 Sep 30, 2026 · release notes

    DataDome Google Cloud Load Balancer module 1.8.0 adds JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. and JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprint support.

    • JA3 and JA4 TLS fingerprints

    1 detail in Everything

14. docs update Sep 26, 2026 · issue 086

    DataDome CloudFront Node.js v3 splits exclusion config into two env vars and adds URI inspection defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    After upgrading to v3, separate your custom URL exclusions from static-asset exclusions so each variable covers only its intended scope.
    .env copy

    DATADOME_URI_REGEX_EXCLUSION="/health|/heartbeat"
    DATADOME_STATIC_ASSET_EXCLUSION="\.(css|gif|ico|jpg|js|png|svg|woff2)$"

    Disable matrix-param stripping if your application relies on semicolons in URLs being passed through unmodified.
    .env copy

    DATADOME_REMOVE_MATRIX_PARAMS=false

    • Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default with a standard list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Splits DATADOME_URI_REGEX_EXCLUSION so it now holds only custom URL exclusions, removing static-asset extensions from its scope.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) before regex evaluation, matching existing query-param (?) handling.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths containing encoded characters %23, %25, %2f, %3b, or %3f.
    • Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default with a standard list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) before regex evaluation, matching existing query-param (?) handling.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths containing encoded characters %23, %25, %2f, %3b, or %3f.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !DATADOME_URI_REGEX_EXCLUSION no longer covers static-asset extensions — any static-asset patterns previously placed there must be moved to the new DATADOME_STATIC_ASSET_EXCLUSION variable or they will no longer be excluded.
15. Varnish module 3.6.0 (2026-09-25) Sep 25, 2026 · issue 085

    DataDome Varnish module 3.6.0 adds support for Varnish 8.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

16. Fraud SDK .NET 2.0.0 Sep 17, 2026 · release notes

    Fraud SDK .NET 2.0.0 adds custom events and a builder pattern over API generation.

    • Adds ValidateCustom and CollectCustom methods to support submitting custom event payloads
    • Adds .NET 8.0 platform support
    • Updates client setup to the Client.Builder(...) pattern for dependency injection

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The useForwarded configuration option is removed along with its header parsing
    • !Asynchronous validate and collect calls are no longer supported
    • !Client setup replaces AddDataDome DI registration and DataDomeOptions with the Client.Builder(...) pattern
17. docs update Sep 15, 2026 · issue 075

    DataDome adds static asset exclusion support to skip processing of common file types like CSS, JS, and images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports excluding static assets (e.g., .css, .js, .jpg, .png, .webp, .pdf, .woff2, and 40+ other extensions) from DataDome processing to reduce unnecessary inspection overhead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

18. docs update Sep 14, 2026 · issue 074

    DataDome: Adds the ability to exclude static assets (.avi, .avif, .bmp, .css, .eot, .flac, .flv, .gif, .gz, .ico, .jpeg, .jpg, .js, .json, .less, .map, .mka, .mkv, .mov, .mp3, .mp4, .mpeg, .mpg, .ogg, .ogm, .opus, .otf, .pdf, .png, .svg, .svgz, .swf, .tif, .tiff, .ttf, .wav, .webm, .webp, .woff, .woff2, .xml, .zip) from DataDome processing to reduce unnecessary bot-detection overhead on non-dynamic resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

19. api-docs-b6ca6b54f992 Sep 13, 2026 · issue 073

    DataDome: Supports excluding static assets (e.g., css, js, jpg, png, woff2, mp4, zip, and 40+ other extensions) from DataDome processing to reduce unnecessary inspection overhead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

20. api-docs-9a79fd98bf10 Sep 12, 2026 · issue 072

    DataDome adds static asset exclusion to skip processing of CSS, JS, images, media, and other non-dynamic file types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports excluding static assets (e.g., avi, css, js, jpg, png, svg, mp4, woff2, zip, and dozens more) from DataDome processing via an exclusion list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

21. api-docs-734ce93c032f Sep 11, 2026 · issue 071

    DataDome: Adds the ability to exclude static assets (e.g., avi, css, js, jpg, png, svg, woff2, zip, and 40+ other extensions) from DataDome processing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

22. api-docs-d864889da5bc Sep 10, 2026 · issue 070

    DataDome adds static asset exclusion support, letting you skip CSS, JS, images, and other non-dynamic files from bot protection processing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Supports excluding static asset file types (including avi, avif, bmp, css, eot, flac, flv, gif, gz, ico, jpeg, jpg, js, json, less, map, mka, mkv, mov, mp3, mp4, mpeg, mpg, ogg, ogm, opus, otf, pdf, png, svg, svgz, swf, tif, tiff, ttf, wav, webm, webp, woff, woff2, xml, zip) from DataDome processing to reduce unnecessary inspection of non-dynamic content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

23. docs update Sep 8, 2026 · issue 068

    DataDome CloudFront v3 splits exclusion config into two env vars and adds two new default URI checks

    └──▷ USE IT
    Separate your custom URL exclusions from static-asset exclusions so DataDome correctly applies both independently.
    env copy

    DATADOME_URI_REGEX_EXCLUSION='/health|/heartbeat'
    DATADOME_STATIC_ASSET_EXCLUSION=true

    Enable encoded-character inspection to catch bots probing static-looking paths with encoded chars like %2f or %3f.
    env copy

    DATADOME_ENCODED_CHAR_INCLUSION=true
    DATADOME_REMOVE_MATRIX_PARAMS=true

    • Introduces DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default.
    • Moves custom URL exclusions to DATADOME_URI_REGEX_EXCLUSION exclusively — static-asset extensions must now be removed from this variable.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) from URIs before regex evaluation.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths containing encoded characters %23, %25, %2f, %3b, or %3f.
    • Migrates the DataDome CloudFront Node.js module from CommonJS (module.exports / require) to ES Module (export / import) format, requiring .js files to be renamed to .mjs.

    +1 more show less

    • Migrates the Lambda@EdgeLambda@EdgeAn AWS feature that runs Lambda functions at CloudFront edge locations, letting cyber tools execute logic closer to users without managing servers in each region. function handler from callback-based signature to async/await pattern, enabling compatibility with Node.js runtime version 24 and later.
    • Introduces DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) from URIs before regex evaluation.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths containing encoded characters %23, %25, %2f, %3b, or %3f.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Static-asset extension patterns must be removed from DATADOME_URI_REGEX_EXCLUSION; leaving them there duplicates or conflicts with the new DATADOME_STATIC_ASSET_EXCLUSION variable.
    • !CommonJS .js files in the Lambda@Edge function must be renamed to .mjs and updated to use export/import syntax instead of module.exports/require.
    • !Callback-based Lambda@Edge handler signature (exports.handler = (event, context, callback) => {}) must be replaced with the async/await pattern (exports.handler = async (event, context) => {}).
24. Nginx Module 3.1.0 (2026-09-07) Sep 7, 2026 · issue 068

    Nginx Module 3.1.0 adds tif, tiff, and pdf to static asset exclusion and adopts dynamic API-driven status codes.

    • Extends the static asset exclusion regex pattern to cover tif, tiff, and pdf file extensions, skipping DataDome checks for those requests.
    • Replaces hard-coded HTTP status codes with values sourced from DataDome Protection API response headers, enabling dynamic status code handling for upcoming features.

    2 more in Everything

25. docs update Sep 3, 2026 · issue 063

    DataDome CloudFront v3 splits URI exclusions and adds matrix-param and encoding checks by default

    • Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable (new in v3) to hold static-asset extension exclusions separately, enabled by default with a standard extension list — previously these lived inside DATADOME_URI_REGEX_EXCLUSION.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) from URIs before regex evaluation, matching existing query-param (?) handling.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) so DataDome inspects static-looking paths that contain encoded characters %23, %25, %2f, %3b, or %3f.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Static-asset extension patterns must be removed from DATADOME_URI_REGEX_EXCLUSION and are now controlled via the new DATADOME_STATIC_ASSET_EXCLUSION variable; leaving them in DATADOME_URI_REGEX_EXCLUSION after upgrading to v3 duplicates or conflicts with the new default list.
    • !DATADOME_REMOVE_MATRIX_PARAMS is enabled by default in v3, meaning matrix-param URIs that were previously passed through will now be stripped before regex evaluation — disable only if this breaks application compatibility.
    • !DATADOME_ENCODED_CHAR_INCLUSION is enabled by default in v3, meaning paths containing %23 %25 %2f %3b %3f that previously appeared static will now be inspected — disable only if this breaks application compatibility.
26. docs update Sep 3, 2026 · issue 063
    └──▷ BREAKING ON UPGRADE

    • !DATADOME_URI_REGEX_EXCLUSION now holds only custom URL exclusions — static-asset extension exclusions that were previously part of this setting are moved to the new DATADOME_STATIC_ASSET_EXCLUSION setting. Any existing static-asset patterns in DATADOME_URI_REGEX_EXCLUSION must be migrated to DATADOME_STATIC_ASSET_EXCLUSION to remain effective.
27. docs update Sep 2, 2026 · issue 062

    DataDome: Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default with a standard list of extensions.

    • Narrows DATADOME_URI_REGEX_EXCLUSION to hold only custom URL exclusions (e.g. /health|/heartbeat), no longer bundling static-asset extensions.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !In v3, static-asset extension exclusions must move out of DATADOME_URI_REGEX_EXCLUSION and into the new DATADOME_STATIC_ASSET_EXCLUSION variable; leaving them in DATADOME_URI_REGEX_EXCLUSION duplicates or conflicts with the new default list.
28. docs update Sep 2, 2026 · issue 062

    DataDome CloudFront module 3.0.0 splits exclusion config and adds encoded-path inspection via three new settings

    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to force inspection of static-looking paths that carry an encoded delimiter, with a configurable delimiter list (defaults: %23 %25 %2f %3b %3f).

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !DATADOME_URI_REGEX_EXCLUSION no longer contains static-asset extension exclusions — those are moved to the new DATADOME_STATIC_ASSET_EXCLUSION setting. Any custom regex rules previously sharing that list must be re-verified to ensure static-asset entries were not relied upon there.
    • !DATADOME_STATIC_ASSET_EXCLUSION is enabled by default in 3.0.0, changing exclusion evaluation behaviour for static assets on upgrade.
    • !DATADOME_REMOVE_MATRIX_PARAMS is enabled by default in 3.0.0, changing how URLs with matrix parameters are matched against exclusion patterns on upgrade.
    • !DATADOME_ENCODED_CHAR_INCLUSION is enabled by default in 3.0.0, causing paths with encoded delimiters (%23 %25 %2f %3b %3f) that previously passed through as excluded static assets to now be sent for bot inspection on upgrade.
29. docs update Sep 1, 2026 · issue 061

    DataDome CloudFront v3 splits exclusion config and adds default URI inspection for matrix params and encoded chars

    └──▷ USE IT
    Migrate a v2 combined exclusion variable to the v3 split config, keeping only custom health-check paths in DATADOME_URI_REGEX_EXCLUSION and relying on DATADOME_STATIC_ASSET_EXCLUSION for static assets.
    env copy

    DATADOME_URI_REGEX_EXCLUSION="/health|/heartbeat"
    DATADOME_STATIC_ASSET_EXCLUSION="\.(avi|avif|bmp|css|eot|flac|flv|gif|gz|ico|jpeg|jpg|js|json|less|map|mka|mkv|mov|mp3|mp4|mpeg|mpg|ogg|ogm|opus|otf|png|svg|svgz|swf|ttf|wav|webm|webp|woff|woff2|xml|zip)$"

    • Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions (standard list, enabled by default), separating them from custom URL exclusions previously combined in DATADOME_URI_REGEX_EXCLUSION.
    • DATADOME_URI_REGEX_EXCLUSION now holds only custom URL exclusions — static-asset extensions must be moved out of this variable when upgrading to v3.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DATADOME_URI_REGEX_EXCLUSION no longer holds static-asset extensions by default in v3 — any extension patterns (e.g. \.(css|js|png|…)$) must be removed from this variable and left to the new DATADOME_STATIC_ASSET_EXCLUSION variable, or existing exclusions will be double-listed or lost.
30. docs update Sep 1, 2026 · issue 061

    DataDome CloudFront integration 3.0.0 restructures exclusion and URL-evaluation settings with three new dedicated config keys.

    • Adds DATADOME_STATIC_ASSET_EXCLUSION setting (enabled by default) to hold static-asset file-extension exclusions in a dedicated list, separating them from custom URL exclusions previously mixed into DATADOME_URI_REGEX_EXCLUSION.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) to strip RFC 3986 matrix parameters from URLs before evaluating exclusion patterns.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DATADOME_URI_REGEX_EXCLUSION now holds only custom URL exclusions; static-asset extensions it previously covered are moved to the new DATADOME_STATIC_ASSET_EXCLUSION setting — any custom static-asset patterns left in DATADOME_URI_REGEX_EXCLUSION must be migrated.
    • !DATADOME_REMOVE_MATRIX_PARAMS is enabled by default, meaning matrix parameters are silently stripped from URLs during exclusion-pattern evaluation on upgrade — configurations that relied on matching matrix parameters will no longer match.
    • !DATADOME_ENCODED_CHAR_INCLUSION is enabled by default, meaning paths with encoded delimiters (%23 %25 %2f %3b %3f) that were previously skipped as static assets will now be sent to DataDome for inspection on upgrade.
31. docs update Aug 31, 2026 · issue 060

    DataDome v3 splits URL exclusion config and adds matrix-param and encoding checks by default

    • Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately, enabled by default with a standard list — freeing DATADOME_URL_REGEX_EXCLUSION for application-specific URL exclusions only.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so matrix parameters (;) are stripped before regex evaluation, matching existing query-parameter behaviour.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths that contain any of %23, %25, %2f, %3b, or %3f.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !In v2, DATADOME_URL_REGEX_EXCLUSION also excluded static-asset extensions; in v3 those extensions move to the new DATADOME_STATIC_ASSET_EXCLUSION variable — any static-asset patterns left in DATADOME_URL_REGEX_EXCLUSION must be removed to avoid duplication or misconfiguration.
32. api-docs-c11305f974b4 Aug 28, 2026 · issue 058

    DataDome API adds AcceptLanguage, Via, SecCHUAFullVersionList, and three CustomFieldString fields to its reference.

    • Adds AcceptLanguage field to the DataDome API reference for passing the request's Accept-Language header to the detection engine.
    • Adds Via field to the DataDome API reference for forwarding proxy chain information.
    • Adds SecCHUAFullVersionList field to the DataDome API reference for passing the Sec-CH-UA-Full-Version-List client hint header.
    • Adds CustomFieldString1, CustomFieldString2, and CustomFieldString3 fields to the DataDome API reference for sending arbitrary custom string data alongside detection requests.

    4 details in Everything

33. announced Aug 27, 2026 · issue 058

    DataDome launches a hosted MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server giving AI agents direct natural-language access to Trend Reports data.

    └──▷ HOW TO FIND IT
    Connect an MCP-compatible AI agent to DataDome's hosted MCP endpoint to query Trend Reports in natural language from within existing workflows.
    📍In your MCP-compatible AI agent or tool, configure the server connection to DataDome's hosted MCP endpoint and authenticate using your existing DataDome credentials.
    • New hosted MCP server exposes DataDome Trend Reports data to MCP-compatible AI agents and agentic workflows, authenticated via existing DataDome credentials — no custom integration or infrastructure required.
    • Enables AI agents to query automated traffic trends, threat types, scraping activity, and credential-stuffing patterns in natural language directly from tools like Slack-connected assistants, enterprise copilots, or custom agent pipelines.

    2 details in Everything

34. docs update Aug 25, 2026 · issue 056

    DataDome Cloudflare Worker 3.0.0 splits URL exclusion config and enables matrix-param/encoding checks by default

    └──▷ USE IT
    Migrate to v3.0.0 by splitting your exclusion config: keep only custom health-check paths in DATADOME_URL_REGEX_EXCLUSION and let DATADOME_STATIC_ASSET_EXCLUSION handle static assets automatically.
    .env copy

    DATADOME_URL_REGEX_EXCLUSION="/health|/heartbeat"
    DATADOME_STATIC_ASSET_EXCLUSION=".(avi|avif|bmp|css|eot|flac|gif|gz|ico|jpeg|jpg|js|json|mp3|mp4|ogg|otf|png|svg|ttf|wav|webm|webp|woff|woff2|xml|zip)$"

    • Adds DATADOME_STATIC_ASSET_EXCLUSION env var to hold static-asset file-extension exclusions separately from custom URL patterns, enabled by default with a standard extension list.
    • DATADOME_URL_REGEX_EXCLUSION now holds only custom URL exclusions (e.g. /health|/heartbeat); static-asset extensions must be migrated out of it.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting to strip matrix params (;) before regex evaluation, mirroring existing query-param (?) handling, enabled by default.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting to inspect static-looking paths that contain encoded characters %23, %25, %2f, %3b, or %3f, enabled by default.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !In v3.0.0, static-asset file extensions must be moved out of DATADOME_URL_REGEX_EXCLUSION into the new DATADOME_STATIC_ASSET_EXCLUSION variable; any extensions left in DATADOME_URL_REGEX_EXCLUSION will be treated as custom URL exclusions rather than static-asset exclusions.
    • !DATADOME_REMOVE_MATRIX_PARAMS and DATADOME_ENCODED_CHAR_INCLUSION are enabled by default in v3.0.0; applications that require the old behaviour must explicitly disable them.
35. docs update Aug 25, 2026 · issue 056
    ⤢ ⤢ ⤢ ⤢
    └──▷ USE IT
    Migrate a v2 config to v3 by splitting static-asset extensions out of your custom URL exclusions into the dedicated variable.
    .env copy

    # .env / Cloudflare Worker environment variables
    DATADOME_URL_REGEX_EXCLUSION="/health|/heartbeat"
    DATADOME_STATIC_ASSET_EXCLUSION="\.(avi|avif|bmp|css|eot|flac|gif|gz|ico|jpeg|jpg|js|json|less|map|mp3|mp4|png|svg|ttf|woff|woff2|xml|zip)$"

    • Narrows DATADOME_URL_REGEX_EXCLUSION to hold only custom URL exclusions — static-asset extensions must now be moved to the new DATADOME_STATIC_ASSET_EXCLUSION variable.
    • Enables matrix-parameter stripping via DATADOME_REMOVE_MATRIX_PARAMS by default, ignoring semicolon-delimited params (;) before regex evaluation, matching existing query-param (?) behaviour.
    • Enables encoded-character inspection via DATADOME_ENCODED_CHAR_INCLUSION by default, causing DataDome to inspect static-looking paths that contain %23, %25, %2f, %3b, or %3f.
    └──▷ BREAKING ON UPGRADE

    • !Any static-asset extensions previously listed in DATADOME_URL_REGEX_EXCLUSION (e.g. .css, .js, .png, etc.) must be moved to the new DATADOME_STATIC_ASSET_EXCLUSION variable; leaving them in DATADOME_URL_REGEX_EXCLUSION will cause them to be evaluated as bot-detection candidates rather than excluded.
    • !DATADOME_REMOVE_MATRIX_PARAMS is now on by default — deployments that rely on matrix params being passed through unchanged must explicitly disable this setting.
    • !DATADOME_ENCODED_CHAR_INCLUSION is now on by default — paths containing %23, %25, %2f, %3b, or %3f that were previously excluded as static assets will now be inspected; disable the setting only if it causes compatibility issues.
36. docs update Aug 25, 2026 · issue 056

    DataDome Cloudflare module 3.0.0 adds three new config settings for static-asset exclusion, matrix-param handling, and encoded-char inspection.

    └──▷ USE IT
    Keep custom URL exclusions separate from static-asset exclusions now that the two settings are split in 3.0.0.
    ini copy

    DATADOME_STATIC_ASSET_EXCLUSION = true
    DATADOME_URL_REGEX_EXCLUSION = "^/api/internal/.*"

    • Adds DATADOME_STATIC_ASSET_EXCLUSION setting (enabled by default) that moves static-asset file-extension exclusions into a dedicated list, so DATADOME_URL_REGEX_EXCLUSION now holds only custom URL exclusions.
    • Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) to strip RFC 3986 matrix parameters from URLs before matching against exclusion patterns.
    • Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to force inspection of static-looking paths that carry an encoded delimiter — defaults to %23, %25, %2f, %3b, %3f, with custom values supported.
    • Removes hard-coded HTTP status codes in favor of DataDome Protection API response headers, enabling forward-compatible support for new API features.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The DATADOME_URL_REGEX_EXCLUSION setting no longer includes static-asset extension patterns — those are now managed by the new DATADOME_STATIC_ASSET_EXCLUSION setting. Any custom regexes that were duplicating built-in static-asset exclusions should be reviewed to avoid redundancy or gaps.
37. docs update Aug 24, 2026 · issue 055

    DataDome CloudFront integration now supports the nodejs26.x Lambda runtime.

    ⤢ ⤢ ⤢ ⤢
38. Tyk module 1.4.0 (2026-08-24) Aug 24, 2026 · issue 055

    DataDome Tyk module 1.4.0 adds GraphQL path detection and X-Forwarded-Host support.

    └──▷ USE IT
    Route GraphQL traffic detection across multiple non-standard endpoints in a Tyk plugin config.
    ini copy

    datadome_graphql_endpoint = graphql,api/graphql,query

    Enable host override via the X-Forwarded-Host header when DataDome sits behind a reverse proxy that rewrites the Host.
    ini copy

    datadome_use_x_forwarded_host = true

    • Adds datadome_graphql_endpoint config option to define one or more paths (comma-separated) used to detect GraphQL requests, defaulting to graphql.
    • Adds datadome_use_x_forwarded_host config option to support host override via the X-Forwarded-Host header.
    • Adds support for 301/302 redirects.

    3 details in Everything

39. docs update Aug 22, 2026 · issue 053

    DataDome Envoy module 2.8.0 adds GraphQL support with configurable endpoint extraction.

    • Adds ENABLE_GRAPHQL_SUPPORT setting (set to true) to enable GraphQL request handling in the Envoy module starting with v2.8.0.
    • Adds GRAPHQL_ENDPOINT setting (default: /graphql) to specify one or more comma-separated endpoints from which the GraphQL operation name and type are extracted.

    2 details in Everything

40. Envoy module 2.8.0 (2026-08-21) Aug 21, 2026 · issue 053

    DataDome Envoy module 2.8.0 adds GraphQL support.

41. iOS SDK for Alamofire 4.1.0 (2026-08-20) Aug 20, 2026 · issue 051

    DataDome iOS Alamofire SDK 4.1.0 automatically merges DataDome cookies with manually added request cookies.

42. Magento module 1.2.247 (2026-08-19) Aug 19, 2026 · issue 050

    Magento module 1.2.247 adds the datadome_enable_mcp_support property.

43. docs update Aug 18, 2026 · issue 049

    DataDome Cloudflare Worker Terraform module v2.7.0 adds DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT configuration settings.

    ⤢ ⤢
    • Adds DATADOME_GRAPHQL_ENDPOINT config setting (module v2.7.0+) to specify one or more GraphQL endpoints (comma-separated) from which the operation name and type are extracted for analysis.
    • Adds DATADOME_MCP_ENDPOINT config setting (module v2.7.0+) to specify one or more MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoints (comma-separated) so that requests targeting those endpoints are analyzed to extract MCP properties.

    2 details in Everything

44. docs update Aug 18, 2026 · issue 049

    DataDome Cloudflare Worker v2.7.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint analysis, GraphQL endpoint config, and enriched headers access.

    └──▷ USE IT
    Access enriched DataDome headers in your Cloudflare Worker to log or forward request classification metadata downstream.
    typescript copy

    async fetch(
      request: Request,
      env: Env,
      ctx: ExecutionContext,
    ): Promise<Response> {
      const response = await dataDomeHandler.fetch(request as any, env, ctx);
      console.log(
        Object.entries(ctx.dataDomeEnrichedHeaders)
          .map(([name, value]) => `${name}: ${value}`)
          .join(' - '),
      );
      return response;
    }

    • Adds graphQLEndpoint config setting to customize which endpoints have GraphQL operation name and type extracted; accepts multiple endpoints as a comma-separated list.
    • Adds mcpEndpoint config setting to designate MCP endpoints for automated MCP-property extraction; accepts multiple endpoints as a comma-separated list.
    • Exposes enriched headers in ctx.dataDomeEnrichedHeaders after calling dataDomeHandler.fetch(), making DataDome's request metadata available for downstream Cloudflare Worker logic.

    3 details in Everything

45. docs update Aug 18, 2026 · issue 049

    DataDome Cloudflare Worker adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint inspection and configurable GraphQL/MCP endpoint settings in v2.7.0

    • Adds DATADOME_MCP_ENDPOINT config setting (v2.7.0) to designate one or more MCP endpoints (comma-separated) for MCP property extraction and analysis.
    • Adds DATADOME_GRAPHQL_ENDPOINT config setting (v2.7.0) to customize one or more GraphQL endpoints (comma-separated) from which operation name and type are extracted.

    2 details in Everything

46. docs update Aug 18, 2026 · issue 049

    DataDome Cloudflare Worker adds DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT settings for targeted request analysis.

    ⤢ ⤢ ⤢ ⤢
    • Adds DATADOME_GRAPHQL_ENDPOINT config setting to specify one or more GraphQL endpoints (comma-separated) from which operation name and type are extracted for analysis.
    • Adds DATADOME_MCP_ENDPOINT config setting to specify one or more MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoints (comma-separated) so that requests targeting them are analyzed to extract MCP properties.

    2 details in Everything

47. docs update Aug 18, 2026 · issue 049

    DataDome Cloudflare integration 2.7.0 adds enriched headers for log enhancement and new DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT config parameters.

    • Adds DATADOME_GRAPHQL_ENDPOINT environment parameter to specify the GraphQL endpoint (defaults to /graphql).
    • Adds DATADOME_MCP_ENDPOINT environment parameter to specify the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint (defaults to /mcp).
    • Adds enriched headers in context to enable log enhancement across all requests.

    3 details in Everything

48. docs update Aug 18, 2026 · issue 049

    Apache module 3.0.0 splits URL exclusion config and adds three new directive defaults for static-asset and encoded-path handling.

    • Adds DomeStaticAssetExclusion directive (enabled by default) to handle static-asset extension exclusions, now including avif, gz, json, xml, and zip in the standard list.
    • Adds DomeRemoveMatrixParams directive (enabled by default) to ignore matrix parameters during DataDome URL regex evaluation per RFC 3986.
    • Adds DomeEncodedCharInclusion directive (enabled by default) to inspect static-looking paths carrying encoded delimiters %23, %25, %2f, %3b, and %3f.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !DomeURIRegexExclusion now holds only custom URL exclusions; static-asset extension exclusions previously in DomeURIRegexExclusion move to the new DomeStaticAssetExclusion directive — any custom static-asset rules in DomeURIRegexExclusion must be migrated.
49. docs update Aug 18, 2026 · issue 049

    DataDome Apache module 3.0 splits URL exclusion settings and adds matrix-param and encoded-char inspection by default.

    └──▷ USE IT
    Migrate a 2.x Apache config to 3.0 by separating custom URL exclusions from static-asset extensions across the two new directives.
    /etc/apache2/datadome.conf copy

    # Before (2.x)
    DomeURIRegexExclusion="/health|/heartbeat|\.(css|js|png|gif|jpg)$"
    
    # After (3.0)
    DomeURIRegexExclusion="/health|/heartbeat"
    DomeStaticAssetExclusion="\.(css|js|png|gif|jpg)$"

    • Adds DomeStaticAssetExclusion config directive to hold static-asset extension exclusions separately from DomeURIRegexExclusion, which now holds only custom URL exclusions.
    • Adds DomeRemoveMatrixParams directive (default: On) to strip matrix parameters (;...) per path segment before the exclusion regex is evaluated.
    • Adds DomeEncodedCharInclusion directive to force inspection of static-looking paths containing encoded characters such as %23, %25, %2f, %3b, or %3f (default: "%23|%25|%2f|%3b|%3f").

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !In 3.0.0, static-asset extension patterns must be moved out of DomeURIRegexExclusion into the new DomeStaticAssetExclusion directive; leaving them in DomeURIRegexExclusion duplicates or conflicts with the new default list.
    • !DomeRemoveMatrixParams is enabled (On) by default in 3.0.0, meaning matrix parameters are stripped before exclusion regex matching — setups relying on matrix params being passed through unchanged may behave differently.
    • !DomeEncodedCharInclusion is enabled by default in 3.0.0, causing static-looking paths containing %23, %25, %2f, %3b, or %3f to be inspected rather than excluded.
    • !The DebugMode parameter is deprecated since version 2.26 and replaced by a new directive used as 'API request timeout for both new and reused connections in ms'.
50. OpenResty module 1.7.0 (2026-08-18) Aug 18, 2026 · issue 049

    DataDome OpenResty module 1.7.0 adds GraphQL endpoint and body-size config parameters

    • Adds datadome_graphql_endpoint configuration parameter to specify the GraphQL endpoint (defaults to graphql).
    • Adds datadome_graphql_max_body_size configuration parameter to limit the request body size parsed for GraphQL requests.

    2 details in Everything

51. Node.js module 2.6.0 (2026-08-17) Aug 17, 2026 · issue 049

    DataDome Node.js module 2.6.0 adds a graphQLEndpoint parameter to designate GraphQL paths for bot protection.

    └──▷ USE IT
    Override the default GraphQL path when your API mounts GraphQL at a non-standard route.
    json copy

    {
      graphQLEndpoint: '/api/graphql'
    }

    • Adds graphQLEndpoint parameter to specify the path(s) for the GraphQL endpoint, defaulting to /graphql.
    • Adds validation of the logger parameter to ensure it contains every required method with the correct signature.

    2 details in Everything

52. Cloudflare Worker module 2.7.0 (2026-08-17) Aug 17, 2026 · issue 049

    DataDome Cloudflare Worker 2.7.0 adds enriched request headers and configurable GraphQL/MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint parameters.

    └──▷ USE IT
    Override the default GraphQL and MCP endpoints when your app exposes them at non-standard paths.
    env copy

    DATADOME_GRAPHQL_ENDPOINT=/api/graphql
    DATADOME_MCP_ENDPOINT=/api/mcp

    • Adds DATADOME_GRAPHQL_ENDPOINT parameter to specify the GraphQL endpoint (defaults to /graphql).
    • Adds DATADOME_MCP_ENDPOINT parameter to specify the MCP endpoint (defaults to /mcp).
    • Adds enriched headers in context to enable log enhancement across all requests.

    3 details in Everything

53. Go module v2.5.0 (2026-07-28) Jul 28, 2026 · issue 028

    DataDome Go module v2.5.0 adds a GraphQLEndpoint parameter to configure GraphQL path protection.

    └──▷ USE IT
    Override the default GraphQL path when your API exposes GraphQL at a non-standard route.
    go copy

    GraphQLEndpoint: "/api/graphql"

    • Adds GraphQLEndpoint parameter to specify custom GraphQL endpoint paths (defaults to /graphql).

    1 detail in Everything

54. Google Cloud Load Balancer module 1.7.0 (2026-07-28) Jul 28, 2026 · issue 028

    DataDome's Google Cloud Load Balancer module adds configurable GraphQL endpoint path support.

    └──▷ USE IT
    Override the default GraphQL endpoint path when your API exposes GraphQL at a non-standard route.
    yaml copy

    GraphQLEndpoint: /api/graphql

    • Adds GraphQLEndpoint parameter to specify custom paths for the GraphQL endpoint (defaults to /graphql).

    1 detail in Everything

55. Python ASGI module 1.2.0 (2026-07-28) Jul 28, 2026 · issue 028

    DataDome Python ASGIASGIA Python async web server interface specification that defines how servers and applications exchange HTTP and WebSocket messages; cyber tools use it to serve high-concurrency APIs without blocking on I/O. module 1.2.0 adds configurable MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. endpoint support and expands cookie length to 512 chars.

    • Adds mcp_endpoint attribute to DataDomeMiddleware to specify a custom MCP endpoint path (defaults to /mcp).
    • Increases DataDome cookie length limit from 128 to 512 characters to support future capabilities.

    2 details in Everything

56. docs update Jul 21, 2026 · issue 021

    DataDome Envoy module now supports logging enriched Protection API headers via Envoy dynamic metadata.

57. docs update Jul 21, 2026 · issue 021

    DataDome adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-aware payload fields and Session-by-Header (X-DataDome-ClientID) support to its Validate Request API.

    └──▷ USE IT
    Use Session by Header to track non-browser API clients that supply their own session ID instead of a cookie.
    lua copy

    if request_headers['x-datadome-clientid'] ~= nil then
      body['ClientID'] = request_headers['x-datadome-clientid']
      datadomeHeaders["X-DataDome-X-Set-Cookie"] = "true"
    else
      body['ClientID'] = clientId
    end

    • Supports Session by Header: integrations can now supply the client ID via the X-DataDome-ClientID request header as a higher-priority alternative to the datadome cookie, enabling session tracking for non-browser clients.
    • Adds X-DataDome-X-Set-Cookie: true signaling so integrations using header-based client IDs receive the updated session value in X-Set-Cookie instead of Set-Cookie.
    • Introduces Enriched Headers: the X-DataDome-request-headers pointer header lets integrations selectively inject upstream bot-signal headers (e.g., X-DataDome-isbot, X-DataDome-botname) into requests reaching the origin server.
    • Adds MCP-specific payload fields (McpMethod, McpParamsClientInfoName, McpParamsClientInfoVersion, McpParamsToolName, McpProtocolVersion, McpSessionId) to the Protection API request schema.

    4 details in Everything

58. Envoy module 2.7.0 (2026-07-21) Jul 21, 2026 · issue 021

    DataDome Envoy module 2.7.0 exposes enriched headers as Envoy dynamic metadata for downstream logging.

59. Fastly Compute module 1.4.0 (2026-07-20) Jul 20, 2026 · issue 020

    DataDome Fastly Compute 1.4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. protocol support with HTTP message signature collection per RFC 9421RFC 9421An IETF standard defining HTTP Message Signatures, a scheme for cryptographically signing HTTP requests and responses so tools can verify message integrity and authenticity end-to-end..

    └──▷ USE IT
    Enable MCP traffic inspection by pointing DataDome at your MCP endpoint in the Fastly Compute service config.
    ini copy

    datadome_mcp_endpoint = "/mcp"

    • Adds Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) support with new datadome_mcp_endpoint configuration parameter (defaults to /mcp) to specify the MCP endpoint.
    • Collects Signature, Signature-Agent, and Signature-Input headers to support HTTP message signatures as defined by RFC 9421.
    • Collects Skyfire-Pay-ID header from incoming requests.

    3 details in Everything

60. JavaScript Tag 5.9.0 (2026-07-20) Jul 20, 2026 · issue 020

    DataDome JS Tag 5.9.0 adds challengeType to event payloads and the displayDataDomeResponsePage function for style adaptation.

    • Adds challengeType parameter to event payloads, exposing the type of challenge triggered in downstream event handling.
    • Accepts challengeType in the displayDataDomeResponsePage function, enabling style adaptation based on the challenge type being displayed.

    2 details in Everything

61. DataDome Terraform provider v2.4.0 (2026-06-30) Jun 30, 2026 · issue 014

    DataDome Terraform provider v2.4.0 adds rate limiting, time-box policies, agentic endpoint types, and new response actions for custom rules.

    └──▷ USE IT
    Protect an agentic login endpoint with a rate-limit policy to throttle automated credential-stuffing agents.
    hcl copy

    resource "datadome_custom_rule" "agentic_login_rate_limit" {
      name          = "Rate-limit agentic login"
      endpoint_type = "agentic-login"
      response      = "intent_based"
      policy        = "rate_limit"
    }

    Apply a time-box policy with a device_check response to block suspicious agentic cart activity within a rolling window.
    hcl copy

    resource "datadome_custom_rule" "agentic_cart_timebox" {
      name          = "Time-box agentic cart abuse"
      endpoint_type = "agentic-cart"
      response      = "device_check"
      policy        = "time_box"
    }

    • Adds rate_limit and time_box policy options for custom rules, enabling threshold-based and time-windowed enforcement.
    • Adds six new endpoint_type values for custom rules targeting agentic AI traffic: agentic-general, agentic-account-creation, agentic-login, agentic-cart, agentic-forms, and agentic-payment.
    • Adds three new response values for custom rules: device_check, intent_based, and monetize, expanding the range of enforcement actions available.

    3 details in Everything

62. iOS SDK for Apollo 4.0.0 (2026-06-30) Jun 30, 2026 · issue 014

    DataDome iOS SDK for Apollo 4.0.0 adds support for Apollo v2.

    • Supports Apollo v2 GraphQL client for iOS, enabling DataDome bot protection on Apollo v2-based apps.

    1 detail in Everything