On a Hobby project with no custom WAF rules, GET /v1/security/firewall/config/draft and PATCH /v1/security/firewall/config with rules.insert return 404, Seawall Config not found. The current official CLI implementation in packages/cli/src/util/firewall/patch-firewall-draft.ts uses PATCH /config/draft, while the published REST reference describes PATCH /config.

What is the supported operation to create the first unpublished draft without changing active configuration? Does PUT /config activate the configuration directly, or only stage it?

For a rate_limit_api_id rule using the Vercel Firewall SDK with fixed-window counters, can the threshold action be Log? The CLI documents --rate-limit-action log, but our attempts to select Log in the dashboard SDK rule editor left the action at 429, so we cancelled without saving. This could be an interaction issue. If Log is supported for SDK rules, what is the accepted action.mitigate.rateLimit JSON shape, including API-controlled keys?

Is environment=preview a supported condition for SDK internal /.well-known/vercel/rate-limit-api/{id} requests?

The intended test uses synthetic keys, a protected preview, and no database connection. We want to inspect a saved draft before publishing. No project identifiers, private URLs, request IDs, credentials or customer data are included in this question.