From e172a3c76aa58c17545f2b471e990e4c4a6c2a22 Mon Sep 17 00:00:00 2001
From: Zahava Brown <z.brown@f5.com>
Date: Thu, 2 Jul 2026 10:58:17 +0000
Subject: [PATCH] docs: document SECURITY_WAF_VIOLATION_TRANSPARENT for
 $app_protect_outcome_reason

WAFMC-14828: the nginx access-log variable $app_protect_outcome_reason can emit
SECURITY_WAF_VIOLATION_TRANSPARENT for requests allowed in transparent
(would-block) mode. This brings the access-log documentation to parity with the
security-log documentation (content/waf/logging/security-logs.md), which already
lists this value.
---
 content/waf/logging/access-logs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/content/waf/logging/access-logs.md b/content/waf/logging/access-logs.md
index 9292bb3817..3cbda55913 100644
--- a/content/waf/logging/access-logs.md
+++ b/content/waf/logging/access-logs.md
@@ -37,7 +37,7 @@ These are the variables added to Access Log. They are a subset of the Security l
 | ---| ---| --- |
 |$app_protect_support_id | Unique ID assigned to the request by F5 WAF for NGINX. | To be used to correlate the access log with the security log.<br>       Left empty in failure mode. |
 |$app_protect_outcome | One of:<ul><li>**PASSED**: request was sent to origin server.</li><li>**REJECTED**: request was blocked.</li></ul> |  |
-|$app_protect_outcome_reason | One of:<ul><li>**SECURITY_WAF_OK**: allowed with no violations (legal request).</li><li>**SECURITY_WAF_VIOLATION**: blocked due to security violations.</li><li>**SECURITY_WAF_FLAGGED**: allowed although it has violations (illegal).</li><li>**SECURITY_WAF_BYPASS**: WAF was supposed to inspect the request but it didn't (because of unavailability or resource shortage). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li><li>**SECURITY_WAF_REQUEST_IN_FILE_BYPASS**: WAF was supposed to inspect the request but it didn't (because request buffer was full and request was written to file). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li><li>**SECURITY_WAF_COMPRESSED_REQUEST_BYPASS**: WAF was supposed to inspect the request but it didn't (because request was compressed). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li></ul> |  |
+|$app_protect_outcome_reason | One of:<ul><li>**SECURITY_WAF_OK**: allowed with no violations (legal request).</li><li>**SECURITY_WAF_VIOLATION**: blocked due to security violations.</li><li>**SECURITY_WAF_FLAGGED**: allowed although it has violations (illegal).</li><li>**SECURITY_WAF_VIOLATION_TRANSPARENT**: allowed, when the policy is in transparent mode, but would be blocked if the policy is set to blocking mode.</li><li>**SECURITY_WAF_BYPASS**: WAF was supposed to inspect the request but it didn't (because of unavailability or resource shortage). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li><li>**SECURITY_WAF_REQUEST_IN_FILE_BYPASS**: WAF was supposed to inspect the request but it didn't (because request buffer was full and request was written to file). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li><li>**SECURITY_WAF_COMPRESSED_REQUEST_BYPASS**: WAF was supposed to inspect the request but it didn't (because request was compressed). The request was PASSED or REJECTED according to the failure mode action determined by the user.</li></ul> |  |
 |$app_protect_policy_name | The name of the policy that enforced the request. |  |
 |$app_protect_version | The F5 WAF for NGINX version string: major.minor.build format. | Does not include the F5 NGINX plus version (e.g. R21). The latter is available in `$version` variable. |