Hi Vercel team and community,

Our Pro project serves a static storefront and proxies a small set of commerce routes through a Vercel Function to a WooCommerce backend. Our print-on-demand partners need to call the standard WooCommerce REST API on our domain (/wp-json/wc/v3/..., /wp-json/wc/v2/printful/..., /wp-json/wc-shipment-tracking/v3/...).

Every request to /wp-json/ is denied at the edge by the system DDoS mitigation (403, X-Vercel-Mitigated: deny) before it reaches our function. A custom WAF rule with the bypass action does not apply to system mitigations, and IP-based System Bypass isn't practical because these partners don't publish stable IP ranges.

The SDK docs mention a custom rule with mitigate: { action: "bypass", bypassSystem: true }, noting that bypassing system-level mitigations via the API is in beta and that access can be requested here. Could we get access to that beta for our team, so we can scope a bypass to the path prefix /wp-json/wc only? Everything else (including /wp-admin/) can stay blocked, and our function still enforces API-key authentication and an exact route allowlist.

We've also opened support case CSE_01ptXQhC7mbXTPWs with the details.

Thank you!