Almost every CDN has an API. Most of them have a subset of one: the endpoints somebody got around to writing, covering the settings somebody assumed you might want to automate. Everything else lives behind a dashboard, and the dashboard is where your automation stops.

We rebuilt the middleware at the heart of smoxy so that is no longer true here.

The Hub is just another API client

The important part is not that we shipped more endpoints. It is that there is now one way into the platform, and the Hub uses it like everyone else.

When you toggle a WAF rule, add a hostname, or swap an origin in the dashboard, the Hub sends the same request to the same public API you have a token for. No private channel, no internal-only route, no settings that exist in the UI but have no name in the API.

That single change is what makes the guarantee below possible, and it is the one worth caring about.

Everything the Hub can do, the API can do

The public API is now 167 operations across 42 resource groups, and it spans the whole product rather than the convenient parts of it:

• Delivery - zones, hostnames, origin servers, load balancers, cache clearing, redirects and redirect maps
• Security - WAF rules, access rules, security scenarios, zone blocks and allows, IP lists, basic-auth users, IP lookup
• Configuration - rewrite rules, conditional configuration rules, custom pages, managed URL parameters
• Infrastructure - domains, DNS records, certificates and their SANs
• Visibility - CDN and traffic logs, audit logs, zone KPIs
• Organization - members, invitations, API tokens, billing

If you can configure it in the Hub, you can configure it with a token and a curl. That is the whole point.

Built for the tools you already run

Most teams do not want another control panel. They want smoxy to fit the systems they already have, and those systems rarely map neatly onto a vendor's UI.

The clearest example is IP filtering. Plenty of teams already maintain allowlists and blocklists somewhere upstream: an internal risk service, a SIEM, a fraud pipeline, a spreadsheet a security lead actually trusts. Before, keeping smoxy in step with that meant a person and a browser tab. Now it is a scheduled job that reconciles your source of truth against IP lists and zone blocks, and nobody has to remember to do it on a Friday afternoon.

The same shape applies everywhere else. Provision a zone per pull request and tear it down on merge. Roll a certificate from the same pipeline that rolls the rest of your estate. Push cache invalidation from your CMS at publish time rather than by hand. Pull traffic KPIs into the dashboard your team already looks at, instead of asking them to open one more.

Tokens are built for that world too: scope them to specific organizations, mark them read-only when a job only needs to look, and give them an expiry. A metrics exporter has no business holding a credential that can delete a zone.

Why this makes us faster

Here is the part that sounds like an internal detail and is not.

Because the Hub is an API client, the API can no longer fall behind the product. There is no separate integration to schedule, no backlog of "expose this in the API too". A setting ships with its endpoint because the setting is its endpoint.

That removed the slowest, most fragile step in our release process. Frontend changes now go out on their own cadence, in small increments, most days of the week, instead of waiting to be bundled into something large enough to justify the coordination. Smaller changes are easier to review, easier to roll back, and far less likely to need rolling back at all.

You get the compounding version of that: fixes and refinements arriving continuously, and an API that is complete on the day a feature launches rather than a quarter later.

Start here

Create a token under Account → API tokens, then:

curl -H "X-API-TOKEN: <token>" https://api.smoxy.eu/api/zones

That is the same call the Hub makes to render your zone list.

• The API Reference documents every operation with request schemas, response examples and ready-to-run snippets, and lets you try calls from the browser.
• API Tokens covers scoping, read-only tokens and rotation.
• The machine-readable schema lives at openapi.json, so you can generate a client in your own language.
• If your team works with AI assistants, the smoxy MCP Server puts the same API behind a conversational interface.

Build the integration you actually wanted. The dashboard will still be there when you want it - it is just no longer the only way in.