{ "openapi": "3.1.0", "info": { "title": "Smoxy Hub API", "description": "API-only configuration management for proxy/CDN system", "license": { "name": "Proprietary" }, "version": "1.0.0" }, "servers": [ { "url": "https://api.smoxy.eu", "description": "Public API" } ], "paths": { "/api/auth/2fa": { "post": { "operationId": "auth_two_factor", "tags": [ "Authentication" ], "responses": { "200": { "description": "Login successful", "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string" }, "refreshToken": { "type": "string" } } } } } }, "400": { "description": "A verification code is required.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "A verification code is required." } } } } } }, "401": { "description": "Invalid verification code", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "Invalid verification code" } } } } } } }, "summary": "Complete login with a second factor", "description": "Exchanges the 2FA challenge (mfa_pending cookie or challengeToken body) plus a TOTP or recovery code for a session.", "requestBody": { "description": "Verification code and optional challenge token", "content": { "application/json": { "schema": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "TOTP code or a recovery code", "example": "123456" }, "challengeToken": { "type": "string", "description": "Required only if the mfa_pending cookie is not sent" } } } } }, "required": true } } }, "/api/auth/forgot-password": { "post": { "operationId": "auth_forgot_password", "tags": [ "Authentication" ], "responses": { "200": { "description": "Generic success response", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "If the email exists, a password reset link has been sent." } } } } } }, "400": { "description": "Invalid JSON body or missing email", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Email is required" } } } } } }, "429": { "description": "Too many requests", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 429 }, "detail": { "type": "string", "example": "Too many requests. Please try again later." } } } } } } }, "summary": "Request password reset", "description": "Send password reset link to email. Returns generic message to prevent user enumeration.", "requestBody": { "description": "User email", "content": { "application/json": { "schema": { "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "format": "email", "example": "user@example.com" } } } } }, "required": true }, "security": [] } }, "/api/auth/login": { "post": { "operationId": "auth_login", "tags": [ "Authentication" ], "responses": { "200": { "description": "Login successful", "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "JWT access token (15 min expiry)", "example": "eyJ0eXAiOiJKV1QiLCJhbGc..." }, "refreshToken": { "type": "string", "description": "Refresh token (30 day expiry)", "example": "def502004f2c7e8a..." }, "mfaRequired": { "type": "boolean", "description": "Present and true when the account has 2FA enabled. No session is issued; exchange the challenge at POST /api/auth/2fa.", "example": true }, "challengeToken": { "type": "string", "description": "One-time 2FA challenge token (also set as the mfa_pending httpOnly cookie). Present only when mfaRequired is true." } } } } } }, "400": { "description": "Invalid JSON body or missing fields", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Email and password are required" } } } } } }, "401": { "description": "Invalid credentials", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 401 }, "detail": { "type": "string", "example": "Invalid credentials" } } } } } }, "403": { "description": "Account is inactive", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 403 }, "detail": { "type": "string", "example": "Account is inactive" } } } } } }, "429": { "description": "Too many login attempts", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 429 }, "detail": { "type": "string", "example": "Too many login attempts. Please try again later." } } } } } } }, "summary": "Authenticate and receive JWT tokens", "description": "Login with email and password. Returns JWT access token and refresh token in both response body and secure cookies. Use GET /api/users/me to fetch user profile after authentication.", "requestBody": { "description": "Login credentials", "content": { "application/json": { "schema": { "type": "object", "required": [ "email", "password" ], "properties": { "email": { "type": "string", "format": "email", "example": "user@example.com" }, "password": { "type": "string", "format": "password", "example": "SecurePass123" } } } } }, "required": true }, "security": [] } }, "/api/auth/logout": { "post": { "operationId": "auth_logout", "tags": [ "Authentication" ], "responses": { "200": { "description": "Logged out successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "Logged out successfully" } } } } } } }, "summary": "Logout and revoke tokens", "description": "Revokes the refresh token and clears authentication cookies.", "requestBody": { "description": "Refresh token (optional if sent via cookie)", "content": { "application/json": { "schema": { "type": "object", "properties": { "refreshToken": { "type": "string", "description": "Optional if sent via cookie" } } } } }, "required": false } } }, "/api/auth/refresh": { "post": { "operationId": "auth_refresh", "tags": [ "Authentication" ], "responses": { "200": { "description": "Token refreshed successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "New JWT access token" }, "refreshToken": { "type": "string", "description": "New refresh token (rotated)" } } } } } }, "400": { "description": "Refresh token is required", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Refresh token is required" } } } } } }, "401": { "description": "Token reuse detected - all tokens revoked", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 401 }, "detail": { "type": "string", "example": "Token reuse detected. Please login again." } } } } } }, "403": { "description": "Account is inactive", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 403 }, "detail": { "type": "string", "example": "Account is inactive" } } } } } } }, "summary": "Refresh JWT access token", "description": "Exchange a refresh token for a new access token. Implements token rotation for security. Accepts refresh token from cookie or request body.", "requestBody": { "description": "Refresh token (optional if sent via cookie)", "content": { "application/json": { "schema": { "type": "object", "properties": { "refreshToken": { "type": "string", "description": "Required only if not sent via cookie", "example": "def502004f2c7e8a..." } } } } }, "required": false }, "security": [] } }, "/api/auth/register": { "post": { "operationId": "auth_register", "tags": [ "Authentication" ], "responses": { "201": { "description": "User registered successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "User registered successfully. Please check your email to verify your account." }, "id": { "type": "string", "format": "uuid", "example": "550e8400-e29b-41d4-a716-446655440000" } } } } } }, "400": { "description": "Invalid input or validation errors", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string", "example": "https://tools.ietf.org/html/rfc2616#section-10" }, "title": { "type": "string", "example": "An error occurred" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Missing required fields: email, password, firstName, lastName" } } } } } }, "409": { "description": "Email already registered", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string", "example": "https://tools.ietf.org/html/rfc2616#section-10" }, "title": { "type": "string", "example": "An error occurred" }, "status": { "type": "integer", "example": 409 }, "detail": { "type": "string", "example": "Registration failed. Please check your information and try again." } } } } } }, "429": { "description": "Too many registration attempts", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string", "example": "https://tools.ietf.org/html/rfc2616#section-10" }, "title": { "type": "string", "example": "An error occurred" }, "status": { "type": "integer", "example": 429 }, "detail": { "type": "string", "example": "Too many registration attempts. Please try again later." } } } } } } }, "summary": "Register a new user account", "description": "Creates a new user account and sends an email verification link. Rate limited to prevent abuse.", "requestBody": { "description": "User registration data", "content": { "application/json": { "schema": { "type": "object", "required": [ "email", "password", "firstName", "lastName" ], "properties": { "email": { "type": "string", "format": "email", "example": "user@example.com", "maxLength": 180 }, "password": { "type": "string", "format": "password", "minLength": 8, "maxLength": 255, "description": "Must contain at least one uppercase letter, one lowercase letter, and one number", "example": "SecurePass123" }, "firstName": { "type": "string", "maxLength": 100, "example": "John" }, "lastName": { "type": "string", "maxLength": 100, "example": "Doe" } } } } }, "required": true }, "security": [] } }, "/api/auth/resend-verification": { "post": { "operationId": "auth_resend_verification", "tags": [ "Authentication" ], "responses": { "200": { "description": "Generic success response", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "If the email exists and is not yet verified, a verification link has been sent." } } } } } }, "400": { "description": "Invalid JSON body or missing email", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Email is required" } } } } } }, "429": { "description": "Too many requests", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 429 }, "detail": { "type": "string", "example": "Too many requests. Please try again later." } } } } } } }, "summary": "Resend email verification link", "description": "Request a new email verification link. Returns generic message to prevent user enumeration.", "requestBody": { "description": "User email", "content": { "application/json": { "schema": { "type": "object", "required": [ "email" ], "properties": { "email": { "type": "string", "format": "email", "example": "user@example.com" } } } } }, "required": true }, "security": [] } }, "/api/auth/reset-password": { "post": { "operationId": "auth_reset_password", "tags": [ "Authentication" ], "responses": { "200": { "description": "Password reset successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "Password reset successfully" } } } } } }, "400": { "description": "Invalid or expired reset token, or invalid password", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Invalid or expired reset token" } } } } } } }, "summary": "Reset password with token", "description": "Reset password using token from forgot password email. All refresh tokens are revoked for security.", "requestBody": { "description": "Reset token and new password", "content": { "application/json": { "schema": { "type": "object", "required": [ "token", "password" ], "properties": { "token": { "type": "string", "description": "Password reset token from email" }, "password": { "type": "string", "format": "password", "minLength": 8, "maxLength": 255, "description": "Must contain at least one uppercase letter, one lowercase letter, and one number" } } } } }, "required": true }, "security": [] } }, "/api/auth/verify-email": { "post": { "operationId": "auth_verify_email", "tags": [ "Authentication" ], "responses": { "200": { "description": "Email verified successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "Email verified successfully" } } } } } }, "400": { "description": "Invalid or expired verification token", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer", "example": 400 }, "detail": { "type": "string", "example": "Invalid or expired verification token" } } } } } } }, "summary": "Verify user email address", "description": "Verify email using token sent during registration.", "requestBody": { "description": "Verification token", "content": { "application/json": { "schema": { "type": "object", "required": [ "token" ], "properties": { "token": { "type": "string", "description": "Email verification token from email" } } } } }, "required": true }, "security": [] } }, "/api/2fa/confirm": { "post": { "operationId": "two_factor_confirm", "tags": [ "Two-Factor Authentication" ], "responses": { "200": { "description": "Recovery codes (shown once)", "content": { "application/json": { "schema": { "type": "object", "properties": { "recoveryCodes": { "type": "array", "items": { "type": "string" }, "example": [ "abcde-12345", "f6g7h-89012" ] } } } } } }, "422": { "description": "Invalid verification code.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "Invalid verification code." } } } } } } }, "summary": "Confirm 2FA enrollment", "description": "Verifies a code from the authenticator app, enables 2FA, and returns single-use recovery codes (shown once).", "requestBody": { "description": "Verification code", "content": { "application/json": { "schema": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "TOTP code (or recovery code where accepted)", "example": "123456" } } } } }, "required": true } } }, "/api/2fa/disable": { "post": { "operationId": "two_factor_disable", "tags": [ "Two-Factor Authentication" ], "responses": { "200": { "description": "Success", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "example": "Two-factor authentication disabled." } } } } } }, "403": { "description": "An organization you belong to requires two-factor authentication. It cannot be disabled.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "An organization you belong to requires two-factor authentication. It cannot be disabled." } } } } } }, "422": { "description": "Invalid verification code.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "Invalid verification code." } } } } } } }, "summary": "Disable 2FA", "description": "Verifies a current TOTP or recovery code, then disables 2FA. Forbidden while an organization enforces 2FA.", "requestBody": { "description": "Verification code", "content": { "application/json": { "schema": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "TOTP code (or recovery code where accepted)", "example": "123456" } } } } }, "required": true } } }, "/api/2fa/recovery-codes": { "post": { "operationId": "two_factor_recovery_regenerate", "tags": [ "Two-Factor Authentication" ], "responses": { "200": { "description": "Recovery codes (shown once)", "content": { "application/json": { "schema": { "type": "object", "properties": { "recoveryCodes": { "type": "array", "items": { "type": "string" }, "example": [ "abcde-12345", "f6g7h-89012" ] } } } } } }, "422": { "description": "Invalid verification code.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "Invalid verification code." } } } } } } }, "summary": "Regenerate recovery codes", "description": "Verifies a current TOTP or recovery code, then replaces the recovery-code set and returns the new codes (shown once).", "requestBody": { "description": "Verification code", "content": { "application/json": { "schema": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string", "description": "TOTP code (or recovery code where accepted)", "example": "123456" } } } } }, "required": true } } }, "/api/2fa/setup": { "post": { "operationId": "two_factor_setup", "tags": [ "Two-Factor Authentication" ], "responses": { "200": { "description": "Setup data", "content": { "application/json": { "schema": { "type": "object", "properties": { "secret": { "type": "string", "example": "JBSWY3DPEHPK3PXP" }, "otpauthUri": { "type": "string", "example": "otpauth://totp/Smoxy%20Hub:user@example.com?secret=..." }, "qrDataUri": { "type": "string", "example": "data:image/png;base64,iVBORw0..." } } } } } }, "409": { "description": "Two-factor authentication is already enabled.", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string", "example": "Two-factor authentication is already enabled." } } } } } } }, "summary": "Begin 2FA enrollment", "description": "Generates a TOTP secret (stored encrypted as pending) and returns the provisioning URI + QR. 2FA is not active until /confirm." } }, "/api/users/me": { "get": { "operationId": "api_usersme_get", "tags": [ "User" ], "responses": { "200": { "description": "User resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/User.jsonld-user.read_user.read.me" } }, "application/json": { "schema": { "$ref": "#/components/schemas/User-user.read_user.read.me" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get the current user", "description": "Returns the profile of the currently authenticated user, resolved from the session/JWT rather than by ID (no user ID is accepted). In addition to the base profile it also exposes `hasPassword` (whether a local password is set) and `connectedProviders` (linked OAuth providers). Requires a fully authenticated session; a remember-me / partially authenticated token is rejected.", "parameters": [] }, "patch": { "operationId": "api_usersme_patch", "tags": [ "update-profile" ], "responses": { "200": { "description": "update-profile resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/update-profile.jsonld-user.read_user.read.me" } }, "application/json": { "schema": { "$ref": "#/components/schemas/update-profile-user.read_user.read.me" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Updates the update-profile resource.", "description": "Updates the update-profile resource.", "parameters": [], "requestBody": { "description": "The updated update-profile resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/update-profile-user.update.jsonMergePatch" } } }, "required": true } } }, "/api/zones": { "get": { "operationId": "api_zones_get_collection", "tags": [ "Zone" ], "responses": { "200": { "description": "Zone collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "Zone.jsonld-zone.read_zone_settings collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/Zone.jsonld-zone.read_zone_settings" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Zone-zone.read_zone_settings" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List zones", "description": "Returns the zones the authenticated user can access. Use `q` to search by name or ID, `organization` to scope the list to one organization, `tag` to filter by environment tag, and the `order[...]` parameters to sort. Full `zone_settings` are included on each item.", "parameters": [ { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "organization", "in": "query", "description": "Filter by organization ID", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Search zones by name or ID", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "tag", "in": "query", "description": "Filter by environment tag. One of: prod, stage, dev.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "tag[]", "in": "query", "description": "Filter by environment tag. One of: prod, stage, dev.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "order[name]", "in": "query", "description": "Sort by name. Values: asc, desc.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[tag]", "in": "query", "description": "Sort by tag. Values: asc, desc.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[createdAt]", "in": "query", "description": "Sort by creation date. Values: asc, desc.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[updatedAt]", "in": "query", "description": "Sort by last-update date. Values: asc, desc.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_post", "tags": [ "Zone" ], "responses": { "201": { "description": "Zone resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Zone.jsonld-zone.read_zone_settings" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Zone-zone.read_zone_settings" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a zone", "description": "Creates a zone in the target organization. A unique `banToken` is generated automatically and `createdBy` is set to the authenticated user. Default custom cache-tag headers and image-optimization quality values are applied unless the body overrides them. The `name` + `tag` combination must be unique within the organization.", "parameters": [], "requestBody": { "description": "The new Zone resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Zone-zone.write_zone_settings" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Zone-zone.write_zone_settings" } } }, "required": true } } }, "/api/zones/{id}": { "get": { "operationId": "api_zones_id_get", "tags": [ "Zone" ], "responses": { "200": { "description": "Zone resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Zone.jsonld-zone.read_zone_settings" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Zone-zone.read_zone_settings" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve a zone", "description": "Returns a single zone including its full settings (the `zone_settings` group), rule/WAF/scenario usage counters, and the nested rewrite, configuration, access rules and security scenarios.", "parameters": [ { "name": "id", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_id_delete", "tags": [ "Zone" ], "responses": { "204": { "description": "Zone resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone", "description": "Permanently deletes the zone. Cascades to its rewrite, configuration, access and WAF rules, security scenarios, basic-auth users and hostnames.", "parameters": [ { "name": "id", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_id_patch", "tags": [ "Zone" ], "responses": { "200": { "description": "Zone resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Zone.jsonld-zone.read_zone_settings" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Zone-zone.read_zone_settings" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a zone", "description": "Partially updates a zone and its settings. `name` + `tag` must remain unique within the organization. When `logForwardingEnabled` is true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. A `defaultBackend` must reference an origin server or load balancer that belongs to the same organization.", "parameters": [ { "name": "id", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated Zone resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/Zone-zone.write_zone_settings.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/access-rules": { "get": { "operationId": "api_zones_zoneIdaccess-rules_get_collection", "tags": [ "access-rule" ], "responses": { "200": { "description": "access-rule collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "access-rule.jsonld-access_rule.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/access-rule.jsonld-access_rule.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/access-rule-access_rule.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List access rules for a zone", "description": "Returns the access rules configured for the given zone, sorted by execution order in descending order. Use the \"name\" query parameter to filter the results by rule name.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter access rules by name (partial match).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter access rules by name (partial match).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdaccess-rules_post", "tags": [ "access-rule" ], "responses": { "201": { "description": "access-rule resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/access-rule.jsonld-access_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create an access rule", "description": "Creates a new access rule in the given zone. The rule name must be unique within the zone, and \"conditions\" must contain at least one condition describing when the rule applies. The \"action\" field determines what happens when the conditions match; when it is \"skip\", \"skipTargets\" lists the security features to bypass. The zone's configured access rule limit must not be exceeded.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new access-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.write" } } }, "required": true } } }, "/api/zones/{zoneId}/access-rules/{id}": { "get": { "operationId": "api_zones_zoneIdaccess-rules_id_get", "tags": [ "access-rule" ], "responses": { "200": { "description": "access-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/access-rule.jsonld-access_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an access rule", "description": "Returns a single access rule identified by ID within the given zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "access-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdaccess-rules_id_delete", "tags": [ "access-rule" ], "responses": { "204": { "description": "access-rule resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete an access rule", "description": "Permanently removes an access rule from the zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "access-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdaccess-rules_id_patch", "tags": [ "access-rule" ], "responses": { "200": { "description": "access-rule resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/access-rule.jsonld-access_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update an access rule", "description": "Partially updates an access rule. Any subset of writable fields may be sent. Name uniqueness within the zone and condition validity are re-checked on every change.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "access-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated access-rule resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/access-rule-access_rule.write.jsonMergePatch" } } }, "required": true } } }, "/api/api-tokens": { "get": { "operationId": "api_api-tokens_get_collection", "tags": [ "api-token" ], "responses": { "200": { "description": "api-token collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "api-token.jsonld-api_token.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/api-token.jsonld-api_token.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/api-token-api_token.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List your API tokens", "description": "Returns every API token belonging to the authenticated user. The secret token value is never included; only the one-time creation response ever exposes it.", "parameters": [ { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_api-tokens_post", "tags": [ "api-token" ], "responses": { "201": { "description": "api-token resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/api-token.jsonld-api_token.read_api_token.read.create" } }, "application/json": { "schema": { "$ref": "#/components/schemas/api-token-api_token.read_api_token.read.create" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create an API token", "description": "Creates a new personal API token for the authenticated user. The full secret token is returned exactly once, in the `plainToken` field of the response - store it immediately, as it is hashed on the server and can never be retrieved again. The `name` must be unique among the user's tokens. Optionally scope the token to specific organizations via `organizations` (the requesting user must be a member of each); an empty list grants access to all organizations the user belongs to. This endpoint requires a full session/JWT login - it cannot be called while authenticating with an API token. Set `readOnly` to true to create a token limited to read operations (GET, HEAD, OPTIONS); the flag cannot be changed after creation.", "parameters": [], "requestBody": { "description": "The new api-token resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/api-token-api_token.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/api-token-api_token.write" } } }, "required": true } } }, "/api/api-tokens/{id}": { "get": { "operationId": "api_api-tokens_id_get", "tags": [ "api-token" ], "responses": { "200": { "description": "api-token resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/api-token.jsonld-api_token.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/api-token-api_token.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an API token", "description": "Returns a single API token by ID. The authenticated user must be the token owner (VIEW). Only metadata is returned (name, expiration, last-used timestamp, active state, read-only flag, organization scopes); the secret token value is never disclosed after creation.", "parameters": [ { "name": "id", "in": "path", "description": "api-token identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_api-tokens_id_delete", "tags": [ "api-token" ], "responses": { "204": { "description": "api-token resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete an API token", "description": "Permanently revokes and deletes an API token. The authenticated user must be the token owner (DELETE). Any client still presenting the token will immediately fail authentication. This action cannot be undone.", "parameters": [ { "name": "id", "in": "path", "description": "api-token identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/audit-logs": { "get": { "operationId": "api_organizations_organizationIdaudit-logs_get_collection", "tags": [ "audit-log" ], "responses": { "200": { "description": "audit-log collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "audit-log.jsonld-audit_log.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/audit-log.jsonld-audit_log.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/audit-log-audit_log.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List an organization's audit log", "description": "Returns the append-only audit trail for the given organization, newest first. Each entry records who changed what and when. The trail is read-only: entries are written automatically whenever audited resources change and cannot be created, edited, or deleted through the API. Paginated at 30 entries per page (max 50) and filterable by entity type and id, acting user, action, zone, IP address, and by partial match on the entity label or user display name.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 50 }, "style": "form", "explode": true }, { "name": "exists[userId]", "in": "query", "description": "", "required": false, "deprecated": false, "schema": { "type": "boolean" }, "style": "form", "explode": false }, { "name": "createdAt[before]", "in": "query", "description": "", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": false }, { "name": "createdAt[strictly_before]", "in": "query", "description": "", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": false }, { "name": "createdAt[after]", "in": "query", "description": "", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": false }, { "name": "createdAt[strictly_after]", "in": "query", "description": "", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": false }, { "name": "entityType", "in": "query", "description": "Filter by the audited entity type (kebab-case), e.g. `zone`, `access-rule`, `basic-auth-user`, `certificate`.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "entityType[]", "in": "query", "description": "Filter by the audited entity type (kebab-case), e.g. `zone`, `access-rule`, `basic-auth-user`, `certificate`.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "entityId", "in": "query", "description": "Filter by the audited entity's identifier as a string (a UUID for UUID-keyed entities, otherwise the numeric id).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "entityId[]", "in": "query", "description": "Filter by the audited entity's identifier as a string (a UUID for UUID-keyed entities, otherwise the numeric id).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "userId", "in": "query", "description": "Filter by the UUID of the user who performed the action.", "required": false, "deprecated": false, "schema": { "type": "string", "format": "uuid" }, "style": "form", "explode": true }, { "name": "userId[]", "in": "query", "description": "Filter by the UUID of the user who performed the action.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "style": "form", "explode": true }, { "name": "action", "in": "query", "description": "Filter by action type. One of `create`, `update`, `delete`.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "action[]", "in": "query", "description": "Filter by action type. One of `create`, `update`, `delete`.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "zoneId", "in": "query", "description": "Filter by the denormalised zone id the change occurred in (only set for zone-scoped entities).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "zoneId[]", "in": "query", "description": "Filter by the denormalised zone id the change occurred in (only set for zone-scoped entities).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "ipAddress", "in": "query", "description": "Filter by the client IP address recorded for the change.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "ipAddress[]", "in": "query", "description": "Filter by the client IP address recorded for the change.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "entityLabel", "in": "query", "description": "Partial (substring) match on the entity's human-readable label.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "entityLabel[]", "in": "query", "description": "Partial (substring) match on the entity's human-readable label.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "userDisplayName", "in": "query", "description": "Partial (substring) match on the acting user's display name.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "userDisplayName[]", "in": "query", "description": "Partial (substring) match on the acting user's display name.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "order[createdAt]", "in": "query", "description": "Sort by creation time. Accepts `asc` or `desc` (defaults to newest first).", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/audit-logs/{id}": { "get": { "operationId": "api_organizations_organizationIdaudit-logs_id_get", "tags": [ "audit-log" ], "responses": { "200": { "description": "audit-log resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/audit-log.jsonld-audit_log.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/audit-log-audit_log.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a single audit log entry", "description": "Returns one audit log entry by id within the given organization. If the entry belongs to a different organization the API responds with 404 (existence is not leaked). Read-only.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "audit-log identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/basic-auth-users": { "get": { "operationId": "api_zones_zoneIdbasic-auth-users_get_collection", "tags": [ "basic-auth-user" ], "responses": { "200": { "description": "basic-auth-user collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "basic-auth-user.jsonld-basic_auth_user.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user.jsonld-basic_auth_user.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone's basic auth users", "description": "Returns all HTTP Basic Authentication users configured for the given zone. Passwords are never included in the response; only username, comment, and timestamps are returned.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdbasic-auth-users_post", "tags": [ "basic-auth-user" ], "responses": { "201": { "description": "basic-auth-user resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/basic-auth-user.jsonld-basic_auth_user.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a basic auth user", "description": "Adds a new HTTP Basic Authentication user to the zone. The username must be unique within the zone, and a plainPassword of at least 8 characters is required. The password is hashed server-side and is never stored or returned in plaintext.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new basic-auth-user resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.write" } } }, "required": true } } }, "/api/zones/{zoneId}/basic-auth-users/{id}": { "get": { "operationId": "api_zones_zoneIdbasic-auth-users_id_get", "tags": [ "basic-auth-user" ], "responses": { "200": { "description": "basic-auth-user resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/basic-auth-user.jsonld-basic_auth_user.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve a basic auth user", "description": "Returns a single basic auth user belonging to the zone. The password is never exposed.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "basic-auth-user identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdbasic-auth-users_id_delete", "tags": [ "basic-auth-user" ], "responses": { "204": { "description": "basic-auth-user resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a basic auth user", "description": "Removes a basic auth user from the zone. The request is rejected with 409 Conflict if the user is still referenced by a configuration rule; remove the user from the rule first.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "basic-auth-user identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdbasic-auth-users_id_patch", "tags": [ "basic-auth-user" ], "responses": { "200": { "description": "basic-auth-user resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/basic-auth-user.jsonld-basic_auth_user.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a basic auth user", "description": "Updates the username, comment, or password of an existing basic auth user. Providing plainPassword (minimum 8 characters) replaces the stored password; omitting it leaves the current password unchanged. Changing the username requires providing plainPassword as well, because the stored password is bound to the username. The username must remain unique within the zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "basic-auth-user identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated basic-auth-user resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/basic-auth-user-basic_auth_user.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/billing/customer": { "get": { "operationId": "api_organizations_organizationIdbillingcustomer_get", "tags": [ "billing" ], "responses": { "200": { "description": "billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/BillingCustomer.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/BillingCustomer" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a billing resource.", "description": "Retrieves a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/billing/invoices": { "get": { "operationId": "api_organizations_organizationIdbillinginvoices_get", "tags": [ "billing" ], "responses": { "200": { "description": "billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/InvoicePage.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/InvoicePage" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a billing resource.", "description": "Retrieves a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "nextPageToken", "in": "query", "description": "Pagination cursor returned as nextPageToken by a previous response. Omit for the first page.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/billing/payment-methods": { "get": { "operationId": "api_organizations_organizationIdbillingpayment-methods_get", "tags": [ "billing" ], "responses": { "200": { "description": "billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/BillingPaymentMethods.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/BillingPaymentMethods" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a billing resource.", "description": "Retrieves a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/billing/plan": { "get": { "operationId": "api_organizations_organizationIdbillingplan_get", "tags": [ "billing" ], "responses": { "200": { "description": "billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/BillingPlan.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/BillingPlan" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a billing resource.", "description": "Retrieves a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/billing/subscription": { "post": { "operationId": "api_organizations_organizationIdbillingsubscription_post", "tags": [ "billing" ], "responses": { "201": { "description": "billing resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/billing.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/billing" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Creates a billing resource.", "description": "Creates a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/billing.SubscribeInput" } }, "application/json": { "schema": { "$ref": "#/components/schemas/billing.SubscribeInput" } } }, "required": true } }, "delete": { "operationId": "api_organizations_organizationIdbillingsubscription_delete", "tags": [ "billing" ], "responses": { "204": { "description": "billing resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Removes the billing resource.", "description": "Removes the billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/billing/subscriptions": { "get": { "operationId": "api_organizations_organizationIdbillingsubscriptions_get", "tags": [ "billing" ], "responses": { "200": { "description": "billing resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/BillingSubscriptions.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/BillingSubscriptions" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a billing resource.", "description": "Retrieves a billing resource.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/cache/clear": { "post": { "operationId": "zone_cache_clear", "tags": [ "cache-clear" ], "responses": { "200": { "description": "cache-clear resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/cache-clear.jsonld-cache-clear.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/cache-clear-cache-clear.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} }, "429": { "description": "Rate limit exceeded", "content": { "application/json": { "schema": { "type": "object", "properties": { "type": { "type": "string", "example": "https://tools.ietf.org/html/rfc2616#section-10" }, "title": { "type": "string", "example": "An error occurred" }, "status": { "type": "integer", "example": 429 }, "detail": { "type": "string", "example": "Cache clearing is limited to one request per zone every 5 seconds." } } } } } } }, "summary": "Clear the zone cache", "description": "Clears cached content for the zone. Set `action` to `all` to clear the whole zone cache, `tag` to clear all entries matching the given `tags`, `uri` to clear a single URI (requires `hostname` and `uri`), or `html`, `images` or `assets` to clear all cached content of that class across the zone. When the zone serves content through the CDN, the matching CDN cache is purged as well; `cdnCleared` reports whether that happened. Limited to one request per zone every 5 seconds; further requests are rejected with `429 Too Many Requests` and a `Retry-After` header. Because of this strict limit, the endpoint is not suited for routine, application-driven cache invalidation. See the [cache invalidation guide](https://docs.smoxy.eu/developer-guide/cache-invalidation.html) for the preferred approaches.", "externalDocs": { "description": "Cache invalidation guide", "url": "https://docs.smoxy.eu/developer-guide/cache-invalidation.html" }, "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new cache-clear resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/cache-clear-cache-clear.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/cache-clear-cache-clear.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/cdn-logs": { "get": { "operationId": "api_organizations_organizationIdcdn-logs_get_collection", "tags": [ "cdn-log" ], "responses": { "200": { "description": "cdn-log collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "cdn-log.jsonld collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/cdn-log.jsonld" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/cdn-log" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves the collection of cdn-log resources.", "description": "Retrieves the collection of cdn-log resources.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "from", "in": "query", "description": "Window start, unix seconds (default: 15 minutes before \"to\").", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "to", "in": "query", "description": "Window end, unix seconds (default: now).", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "zoneId", "in": "query", "description": "Restrict to these zones (must belong to the organization). Omit for all the org's zones.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "integer" } }, "style": "form", "explode": true }, { "name": "order[timestamp]", "in": "query", "description": "Sort by timestamp (default desc). Any field is sortable via order[].", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "status_code", "in": "query", "description": "Filter by status_code (also status_code[gte]/[lt]/…). Any field is filterable.", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "host", "in": "query", "description": "Filter by host (host[like]=… for substring).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Case-insensitive substring search on host/path/remote_ip/request_id.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/certificates": { "get": { "operationId": "api_organizations_organizationIdcertificates_get_collection", "tags": [ "certificate" ], "responses": { "200": { "description": "certificate collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "certificate.jsonld-certificate.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/certificate.jsonld-certificate.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-certificate.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List certificates for an organization", "description": "Returns every TLS certificate belonging to the organization, covering both auto-managed (ACME) and custom (user-uploaded) certificates.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdcertificates_post", "tags": [ "certificate" ], "responses": { "201": { "description": "certificate resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate.jsonld-certificate.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a certificate", "description": "Creates a certificate for an apex domain in the organization; the domain is created automatically if it does not exist yet. `domainName` is required and must be a root domain. For `auto_managed` certificates, apex and wildcard SANs are seeded automatically and no `certificateData`/`privateKeyData` may be supplied (422 otherwise). For `custom` certificates, `certificateData` and `privateKeyData` are required and are parsed and verified - invalid or expired content returns 422. Returns 409 if the domain already has a certificate.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new certificate resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.write_certificate.create" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.write_certificate.create" } } }, "required": true } } }, "/api/organizations/{organizationId}/certificates/{id}": { "get": { "operationId": "api_organizations_organizationIdcertificates_id_get", "tags": [ "certificate" ], "responses": { "200": { "description": "certificate resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate.jsonld-certificate.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve a certificate", "description": "Returns a single certificate by ID, including its status, type, expiry, issuer, fingerprint, SANs and most recent renewal attempt.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdcertificates_id_delete", "tags": [ "certificate" ], "responses": { "204": { "description": "certificate resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a certificate", "description": "Deletes a certificate. Rejected with 409 while any hostname still uses it - remove those hostnames (and their zones or redirects) first. When the certificate's domain has no hostnames and no managed DNS the domain is removed together with the certificate so its name becomes available again; when the domain still has managed DNS only the certificate is removed and the domain is kept.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdcertificates_id_patch", "tags": [ "certificate" ], "responses": { "200": { "description": "certificate resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate.jsonld-certificate.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a certificate", "description": "Updates a certificate. Supplying new `certificateData` and `privateKeyData` on an `auto_managed` certificate implicitly switches it to `custom`; the content is parsed and verified and returns 422 on invalid or expired data. Hostname mappings referencing the certificate are updated to reflect the change.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated certificate resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/certificate-certificate.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/certificates/{id}/renew": { "post": { "operationId": "certificate_renew", "tags": [ "certificate" ], "responses": { "202": { "description": "certificate resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate.CertificateRenewOutput.jsonld-certificate.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate.CertificateRenewOutput-certificate.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Renew a certificate", "description": "Queues an asynchronous ACME (re-)issuance for an `auto_managed` certificate and returns 202 Accepted with the dispatched `jobId`. Only `auto_managed` certificates can be renewed (400 otherwise). Returns 409 if the certificate is already `renewing` or a previous attempt is still in flight, to avoid hitting the CA rate limits. No request body is required.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/certificates/{certificateId}/attempts": { "get": { "operationId": "api_organizations_organizationIdcertificates_certificateIdattempts_get_collection", "tags": [ "certificate-attempt" ], "responses": { "200": { "description": "certificate-attempt collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "certificate-attempt.jsonld-certificate_attempt.list collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-attempt.jsonld-certificate_attempt.list" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-attempt-certificate_attempt.list" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List certificate attempts", "description": "Returns the issuance, renewal, and upload attempts recorded for a certificate, newest first (25 per page). Each attempt captures the lifecycle status, type, timing, and any error of a single certificate operation. Attempts are read-only - they are created and maintained by the certificate renewer / message handlers, not via the API. The per-step breakdown is omitted from this collection view; fetch a single attempt to see its steps.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 25, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/certificates/{certificateId}/attempts/{id}": { "get": { "operationId": "api_organizations_organizationIdcertificates_certificateIdattempts_id_get", "tags": [ "certificate-attempt" ], "responses": { "200": { "description": "certificate-attempt resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-attempt.jsonld-certificate_attempt.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-attempt-certificate_attempt.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a certificate attempt", "description": "Returns a single certificate attempt including its ordered pipeline steps. Attempts are read-only; they are created and updated by the certificate renewer / message handlers, not via the API. Inspect the `steps` array for the per-step status, timing, and error details of the underlying ACME or upload pipeline.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate-attempt identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/certificates/{certificateId}/sans": { "get": { "operationId": "api_organizations_organizationIdcertificates_certificateIdsans_get_collection", "tags": [ "certificate-san" ], "responses": { "200": { "description": "certificate-san collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "certificate-san.jsonld-certificate_san.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-san.jsonld-certificate_san.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-san-certificate_san.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a certificate's SANs", "description": "Returns the Subject Alternative Names (SANs) attached to the certificate. Each entry includes its DNS validation status and SSL coverage status.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdcertificates_certificateIdsans_post", "tags": [ "certificate-san" ], "responses": { "201": { "description": "certificate-san resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-san.jsonld-certificate_san.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-san-certificate_san.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Add a SAN to a certificate", "description": "Registers a new Subject Alternative Name on the certificate. The name is lower-cased and validated: it must be a valid ASCII/punycode DNS host name (max 253 characters), may be a wildcard (e.g. \"*.example.com\"), must belong to the certificate's domain, must be unique within the certificate, and must not be redundant with an existing entry. A DNS recheck is scheduled immediately after creation, so the SAN starts with dnsStatus \"unknown\".", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new certificate-san resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-san-certificate_san.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-san-certificate_san.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/certificates/{certificateId}/sans/{id}": { "get": { "operationId": "api_organizations_organizationIdcertificates_certificateIdsans_id_get", "tags": [ "certificate-san" ], "responses": { "200": { "description": "certificate-san resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-san.jsonld-certificate_san.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-san-certificate_san.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a certificate SAN", "description": "Returns a single Subject Alternative Name, including its DNS validation status, SSL coverage status and DNS check timestamps.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate-san identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdcertificates_certificateIdsans_id_delete", "tags": [ "certificate-san" ], "responses": { "204": { "description": "certificate-san resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a certificate SAN", "description": "Removes the Subject Alternative Name from the certificate.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate-san identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/certificates/{certificateId}/sans/{id}/recheck": { "post": { "operationId": "api_organizations_organizationIdcertificates_certificateIdsans_idrecheck_post", "tags": [ "certificate-san" ], "responses": { "200": { "description": "certificate-san resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-san.jsonld-certificate_san.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-san-certificate_san.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Recheck a SAN's DNS", "description": "Immediately re-runs the CNAME/DNS validation for this SAN and returns the updated entity. Updates dnsStatus (\"valid\" or \"missing\"), dnsLastCheckedAt and dnsNextCheckAt (next check in 24h when valid, in 5 minutes when missing). Throttled to once per 60 seconds: a 429 is returned if called sooner. Send an empty request body.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "certificateId", "in": "path", "description": "Certificate identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "certificate-san identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new certificate-san resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/certificate-san" } }, "application/json": { "schema": { "$ref": "#/components/schemas/certificate-san" } } }, "required": true } } }, "/api/users/me/password": { "post": { "operationId": "api_usersmepassword_post", "tags": [ "change-password" ], "responses": { "204": { "description": "change-password resource created", "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Creates a change-password resource.", "description": "Creates a change-password resource.", "parameters": [], "requestBody": { "description": "The new change-password resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/change-password-user.change-password" } }, "application/json": { "schema": { "$ref": "#/components/schemas/change-password-user.change-password" } } }, "required": true } } }, "/api/zones/{zoneId}/configuration-rules": { "get": { "operationId": "api_zones_zoneIdconfiguration-rules_get_collection", "tags": [ "configuration-rule" ], "responses": { "200": { "description": "configuration-rule collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "configuration-rule.jsonld-configuration_rule.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/configuration-rule.jsonld-configuration_rule.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List configuration rules", "description": "Returns all configuration rules defined for the zone. Each rule pairs a condition group with a set of setting overrides that are applied to requests that match. Rules are evaluated in ascending `order`.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter rules by name using a partial, case-insensitive \"contains\" match.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter rules by name using a partial, case-insensitive \"contains\" match.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdconfiguration-rules_post", "tags": [ "configuration-rule" ], "responses": { "201": { "description": "configuration-rule resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/configuration-rule.jsonld-configuration_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a configuration rule", "description": "Creates a configuration rule in the zone. The name must be unique within the zone and the condition set must not duplicate an existing rule. When `order` is omitted the rule is appended after the highest existing order; when an `order` is supplied, existing rules at or after that position are shifted down to make room. The number of rules per zone is capped. `settingsOverrides` may only enable a package-gated feature when the owning organization holds the required package.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new configuration-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.write" } } }, "required": true } } }, "/api/zones/{zoneId}/configuration-rules/{id}": { "get": { "operationId": "api_zones_zoneIdconfiguration-rules_id_get", "tags": [ "configuration-rule" ], "responses": { "200": { "description": "configuration-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/configuration-rule.jsonld-configuration_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve a configuration rule", "description": "Returns a single configuration rule within the zone, including its condition group and its active setting overrides.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "configuration-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdconfiguration-rules_id_delete", "tags": [ "configuration-rule" ], "responses": { "204": { "description": "configuration-rule resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a configuration rule", "description": "Deletes the configuration rule and clears any reference rows it holds (such as IP-list references).", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "configuration-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdconfiguration-rules_id_patch", "tags": [ "configuration-rule" ], "responses": { "200": { "description": "configuration-rule resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/configuration-rule.jsonld-configuration_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a configuration rule", "description": "Updates a configuration rule. The owning zone cannot be changed. Name uniqueness, condition uniqueness, and backend-override validity are re-checked on update. Changing `order` re-sequences the sibling rules so the evaluation order stays contiguous.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "configuration-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated configuration-rule resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/configuration-rule-configuration_rule.write.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/custom-page/{type}": { "get": { "operationId": "api_zones_zoneIdcustom-page_type_get", "tags": [ "custom-page" ], "responses": { "200": { "description": "custom-page resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/custom-page.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/custom-page" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a custom-page resource.", "description": "Retrieves a custom-page resource.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "type", "in": "path", "description": "custom-page identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "post": { "operationId": "custom_page_upload", "tags": [ "custom-page" ], "responses": { "200": { "description": "custom-page resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/custom-page.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/custom-page" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Upload a zone custom page", "description": "Uploads the HTML for one of a zone's custom pages (multipart field `file`), overwriting any existing page of that type. The `type` path segment selects the page: `error`, `maintenance`, `security` or `challenge`. The file must be non-empty and at most 1 MiB. Returns the stored page. Whether the page is actually served is controlled separately by the zone's per-type enable setting.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "type", "in": "path", "description": "custom-page identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "binary", "description": "The HTML file to store for this page type. Non-empty, max 1 MiB." } } } } }, "required": true } }, "delete": { "operationId": "custom_page_delete", "tags": [ "custom-page" ], "responses": { "204": { "description": "custom-page resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone custom page", "description": "Removes the stored HTML for one of a zone's custom pages (`error`, `maintenance`, `security` or `challenge`) and, if that page type is currently active, disables it for the zone so it is no longer served. Idempotent: deleting a page that is not stored still succeeds. Returns 204 No Content.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "type", "in": "path", "description": "custom-page identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/domains/{domainId}/dns-records": { "post": { "operationId": "api_organizations_organizationIddomains_domainIddns-records_post", "tags": [ "dns-record" ], "responses": { "201": { "description": "dns-record resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/dns-record.jsonld-dns_record.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/dns-record-dns_record.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a DNS record", "description": "Create a new DNS record in the given managed domain. The record is created at the DNS provider and returned.\n\nThe `type` field determines which additional fields are permitted; sending a field that is not allowed for the chosen type is rejected:\n- `A`, `AAAA`, `CNAME` - allow `monitorType`, `weight`.\n- `CAA` - allow `flags`, `tag`.\n- `MX`, `HTTPS`, `SVCB` - allow `priority`.\n- `SRV` - allow `priority`, `weight`, `port`.\n- Other types (`TXT`, `NS`, `PTR`, `Redirect`, `Flatten`, `PullZone`, `Script`) accept only `name`, `value`, `ttl` and `comment`.\n\n`name` and `value` are required. `ttl`, when supplied, must be between 15 and 86400 (defaults to 3600). `priority`, `weight` and `port` accept 0-65535, and `flags` accepts 0-255.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "domainId", "in": "path", "description": "dns-record identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new dns-record resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/dns-record-dns_record.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/dns-record-dns_record.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/domains/{domainId}/dns-records/{id}": { "delete": { "operationId": "api_organizations_organizationIddomains_domainIddns-records_id_delete", "tags": [ "dns-record" ], "responses": { "204": { "description": "dns-record resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a DNS record", "description": "Delete a DNS record from the managed domain. The record is removed at the DNS provider. Returns 204 No Content on success.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "domainId", "in": "path", "description": "dns-record identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "dns-record identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIddomains_domainIddns-records_id_patch", "tags": [ "dns-record" ], "responses": { "200": { "description": "dns-record resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/dns-record.jsonld-dns_record.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/dns-record-dns_record.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a DNS record", "description": "Update an existing DNS record. Only the fields present in the request body are changed; omitted fields keep their current values. To clear the optional `priority`, send it explicitly as `null`.\n\nUnlike create, `name` and `value` are not required. The `type`-based field-allow rules still apply (`monitorType`/`weight` only for `A`, `AAAA`, `CNAME`; `flags`/`tag` only for `CAA`; `priority`/`weight`/`port` only for `SRV`), and the same range checks are enforced (`ttl` 15-86400; `priority`/`weight`/`port` 0-65535; `flags` 0-255).", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "domainId", "in": "path", "description": "dns-record identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "dns-record identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated dns-record resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/dns-record-dns_record.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/domains": { "get": { "operationId": "api_organizations_organizationIddomains_get_collection", "tags": [ "domain" ], "responses": { "200": { "description": "domain collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "domain.jsonld-domain.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchemaNoPagination" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/domain.jsonld-domain.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/domain-domain.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List an organization's domains", "description": "Returns all managed DNS domains belonging to the given organization. Shared domains are excluded from this list. Pagination is disabled, so the full set is returned in one response.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "post": { "operationId": "api_organizations_organizationIddomains_post", "tags": [ "domain" ], "responses": { "201": { "description": "domain resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain.jsonld-domain.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain-domain.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a domain", "description": "Creates a domain in the organization. The name must be an apex (root) domain - subdomains such as \"sub.example.com\" are rejected. Domain names are globally unique, so a name already in use by any organization is rejected with 422. The domain is created without managed DNS; enable it afterwards with the update (PATCH) operation to provision managed DNS.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new domain resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain-domain.create" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain-domain.create" } } }, "required": true } } }, "/api/organizations/{organizationId}/domains/{id}": { "get": { "operationId": "api_organizations_organizationIddomains_id_get", "tags": [ "domain" ], "responses": { "200": { "description": "domain resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain.jsonld-domain.read_domain.item" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain-domain.read_domain.item" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a single domain", "description": "Returns the full detail representation of one domain, including its live DNS records fetched from the managed DNS zone.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "domain identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIddomains_id_patch", "tags": [ "domain" ], "responses": { "200": { "description": "domain resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain.jsonld-domain.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain-domain.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a domain", "description": "Partially updates a domain. Only dnsEnabled is writable through this operation: toggling it on provisions a managed DNS zone for the domain, which is required before DNS records can be imported, exported, or edited.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "domain identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated domain resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/domain-domain.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/domains/{id}/dns-check": { "get": { "operationId": "domain_dns_check", "tags": [ "domain" ], "responses": { "200": { "description": "domain resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain.DomainDnsCheckOutput.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain.DomainDnsCheckOutput" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Resolve the authoritative nameservers for this domain", "description": "Performs a live NS lookup against the public DNS for this domain and returns the list of nameservers found. Trailing dots are stripped so the values are directly comparable to the configured nameserver pair.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "domain identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/domains/{id}/export": { "get": { "operationId": "domain_dns_export", "tags": [ "domain" ], "responses": { "200": { "description": "BIND-format zone file (text/plain)." }, "204": { "description": "domain resource" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Export DNS records as a BIND zone file", "description": "Returns this domain's DNS records in BIND zone-file format as plain text, generated from the domain's managed DNS zone. The response is served as text/plain with a Content-Disposition attachment filename of \".zone\". DNS must be enabled on the domain before exporting.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "domain identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/domains/{id}/import": { "post": { "operationId": "domain_dns_import", "tags": [ "domain" ], "responses": { "200": { "description": "Import completed. Returns counts of successful, failed, and skipped records.", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/domain.DnsImportOutput.jsonld-domain.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/domain.DnsImportOutput-domain.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Import DNS records from a BIND zone file", "description": "Upload a BIND-format zone file (.txt) to bulk-import DNS records into this domain. The file must be sent as multipart/form-data with field name \"file\". The records are imported, then any records with a TTL below the minimum threshold are corrected, and subdomain NS records found in the file are created separately (NS records are skipped during import). DNS must be enabled on the domain before importing.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "domain identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "binary", "description": "BIND zone file in plain text format (.txt)" } } } } }, "required": true } } }, "/api/organizations/{organizationId}/hostnames": { "get": { "operationId": "api_organizations_organizationIdhostnames_get_collection", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "hostname.jsonld-hostname.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/hostname-hostname.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List hostnames in an organization", "description": "Returns a flat, paginated collection of every hostname in the organization - both zone-owned and redirect-owned - across all of its domains. Supports filtering by hostname name, zone, owner type and CDN status. Paginated at 30 items per page.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Search by hostname name (LIKE %q%).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "zone", "in": "query", "description": "Filter by zone id.", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "ownerType", "in": "query", "description": "Filter by owner type.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "zone", "redirect" ] }, "style": "form", "explode": true }, { "name": "cdnEnabled", "in": "query", "description": "Filter by CDN status.", "required": false, "deprecated": false, "schema": { "type": "boolean" }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/hostnames/{id}": { "get": { "operationId": "api_organizations_organizationIdhostnames_id_get", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a hostname", "description": "Returns a single hostname in the organization by id. This is the canonical IRI route for the resource, so it resolves whether the hostname is zone-owned or redirect-owned.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdhostnames_id_patch", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Reassign a hostname between a zone and a redirect", "description": "Moves a hostname between a zone and a redirect. The two directions are mutually exclusive: send \"zone\" (an IRI) to attach the hostname to that zone, or send both \"reassignRedirectTargetHostname\" and \"reassignRedirectMode\" to create a new redirect in the hostname's organization and attach the hostname to it. Either direction deletes the previous redirect owner if there was one. Zone-to-zone moves are out of scope here and stay on PATCH /zones/{zoneId}/hostnames/{id}. CDN state is re-synced and the change takes effect on the live configuration.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated hostname resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.reassign.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/hostnames": { "get": { "operationId": "api_zones_zoneIdhostnames_get_collection", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "hostname.jsonld-hostname.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/hostname-hostname.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List hostnames in a zone", "description": "Returns the hostnames attached to the given zone, optionally filtered by name.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter by hostname name (partial, case-insensitive match).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter by hostname name (partial, case-insensitive match).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdhostnames_post", "tags": [ "hostname" ], "responses": { "201": { "description": "hostname resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a hostname in a zone", "description": "Creates a hostname on the zone. The root domain is derived from the hostname name and the matching domain is found or created for the zone's organization (rejected if that domain already belongs to another organization). A unique CNAME target is generated, an initial DNS check is scheduled, and a certificate is bootstrapped for the domain when one is needed. When \"cdnEnabled\" is true the CDN pull zone is provisioned, and the change takes effect on the live configuration.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new hostname resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.create_hostname.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.create_hostname.write" } } }, "required": true } } }, "/api/zones/{zoneId}/hostnames/{id}": { "get": { "operationId": "api_zones_zoneIdhostnames_id_get", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a hostname in a zone", "description": "Returns a single hostname scoped to the given zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdhostnames_id_delete", "tags": [ "hostname" ], "responses": { "204": { "description": "hostname resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a hostname", "description": "Removes the hostname. If CDN is enabled the CDN pull-zone entry is disabled first; CDN failures surface as 400 (rejected) or 503 (temporarily unavailable). The change then takes effect on the live configuration.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdhostnames_id_patch", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a hostname in a zone", "description": "Updates the hostname's writable fields - \"cdnEnabled\", and \"zone\" for zone-to-zone moves. Toggling CDN or moving the hostname to another zone re-syncs the CDN pull zone, and a rename or move takes effect on the live configuration. CDN changes are applied together with the save so stored state never claims a CDN status the CDN did not apply.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated hostname resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.write_hostname.zone.write.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/hostnames/{id}/dns-check": { "post": { "operationId": "hostname_dns_recheck", "tags": [ "hostname" ], "responses": { "200": { "description": "hostname resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/hostname.jsonld-hostname.dns.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/hostname-hostname.dns.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Re-check a hostname's DNS target", "description": "Triggers an immediate DNS verification of the hostname. Resets the check counter, updates \"dnsTargetStatus\" and \"dnsObservedValue\" from the live lookup, records the check time, and reschedules the next automatic check. Takes no request body and returns the updated hostname with HTTP 200.\n\nThe response also carries the DNS setup guidance the customer needs. \"isApex\" tells the two cases apart: when false (a subdomain such as www.example.com) the customer points a CNAME record named \"recordName\" (the label, e.g. \"www\") at \"cnameTarget\", and \"aRecordTargets\" is an empty array; when true (the apex/root, e.g. example.com) a CNAME cannot be used, so the customer instead creates A records at the apex (\"recordName\" is \"@\") pointing at every IP in \"aRecordTargets\" (the addresses \"cnameTarget\" currently resolves to, typically two; empty if it cannot be resolved).", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "hostname identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/invitations": { "get": { "operationId": "api_organizations_organizationIdinvitations_get_collection", "tags": [ "invitation" ], "responses": { "200": { "description": "invitation collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "invitation.jsonld-invitation.read_invitation.read.org collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.org" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.org" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List an organization's invitations", "description": "Returns every invitation belonging to the organization, in any status (pending, accepted, declined, expired, cancelled). On these org-scoped endpoints the inviter is exposed as an organization-member IRI via the \"invitedBy\" field.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdinvitations_post", "tags": [ "invitation" ], "responses": { "201": { "description": "invitation resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.org" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.org" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Invite a user to the organization", "description": "Creates a pending invitation for the given email address and role and emails the invitee a link to accept it. The email is lowercased and trimmed before storage. Rejected with 422 when a pending invitation for the same email already exists in this organization, when the invitee is already a member, or when a non-OWNER attempts to grant the OWNER role. The expiry (expiresAt) is derived from the INVITATION_TTL_DAYS configuration and the status starts as \"pending\".", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new invitation resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/invitations/{id}": { "get": { "operationId": "api_organizations_organizationIdinvitations_id_get", "tags": [ "invitation" ], "responses": { "200": { "description": "invitation resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.org" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.org" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an invitation", "description": "Returns a single invitation within the organization by its ID.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "invitation identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdinvitations_id_delete", "tags": [ "invitation" ], "responses": { "204": { "description": "invitation resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Cancel (delete) an invitation", "description": "Permanently removes the invitation, revoking a pending invite before it is accepted.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "invitation identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/invitations/{id}/resend": { "post": { "operationId": "api_organizations_organizationIdinvitations_idresend_post", "tags": [ "invitation" ], "responses": { "201": { "description": "invitation resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.org" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.org" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Resend an invitation email", "description": "Re-sends the invitation email to the invitee. Only pending invitations can be resent; a non-pending invitation is rejected with 400, and an already-expired one is rejected with 400 (create a new invitation instead - the TTL is not silently bumped). No request body is required.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "invitation identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new invitation resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation" } } }, "required": true } } }, "/api/users/me/invitations": { "get": { "operationId": "api_usersmeinvitations_get_collection", "tags": [ "invitation" ], "responses": { "200": { "description": "invitation collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "invitation.jsonld-invitation.read_invitation.read.me collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.me" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.me" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List my pending invitations", "description": "Returns the pending, not-yet-expired invitations addressed to the authenticated user's email address across all organizations. On these endpoints the inviter is embedded as their first and last name (invitedBy).", "parameters": [ { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] } }, "/api/users/me/invitations/{id}/accept": { "post": { "operationId": "api_usersmeinvitations_idaccept_post", "tags": [ "invitation" ], "responses": { "201": { "description": "invitation resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.me" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.me" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Accept an invitation", "description": "Accepts the invitation for the authenticated user: creates their organization membership with the invited role and marks the invitation \"accepted\" (setting acceptedAt). Rejected with 400 when the invitation is not addressed to the caller's email, is no longer pending, or has expired; returns 409 if the caller is already a member. No request body is required.", "parameters": [ { "name": "id", "in": "path", "description": "invitation identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new invitation resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation" } } }, "required": true } } }, "/api/users/me/invitations/{id}/decline": { "post": { "operationId": "api_usersmeinvitations_iddecline_post", "tags": [ "invitation" ], "responses": { "201": { "description": "invitation resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation.jsonld-invitation.read_invitation.read.me" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation-invitation.read_invitation.read.me" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Decline an invitation", "description": "Marks the invitation as \"declined\" for the authenticated user. Only pending invitations can be declined (400 otherwise). No request body is required.", "parameters": [ { "name": "id", "in": "path", "description": "invitation identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new invitation resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/invitation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/invitation" } } }, "required": true } } }, "/api/organizations/{organizationId}/ip-lists": { "get": { "operationId": "api_organizations_organizationIdip-lists_get_collection", "tags": [ "ip-list" ], "responses": { "200": { "description": "ip-list collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "ip-list.jsonld-ip_list.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/ip-list.jsonld-ip_list.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ip-list-ip_list.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List IP lists", "description": "Returns every IP list belonging to the organization. Use the \"name\" query parameter to filter by a partial (substring) match on the list name.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter IP lists by a partial (substring) match on the name.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter IP lists by a partial (substring) match on the name.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdip-lists_post", "tags": [ "ip-list" ], "responses": { "201": { "description": "ip-list resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ip-list.jsonld-ip_list.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create an IP list", "description": "Creates a named IP list of IPv4/IPv6 addresses or CIDR blocks within the organization. The name must be unique within the organization. Each entry must be a valid IP address or a canonical CIDR block (host bits must be zero), and entries must be unique and non-overlapping (an entry fully contained within another is rejected); at most 500 entries are allowed. IPv4-mapped IPv6 addresses (e.g. \"::ffff:1.2.3.4\") are rejected - use the plain IPv4 form.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new ip-list resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/ip-lists/{id}": { "get": { "operationId": "api_organizations_organizationIdip-lists_id_get", "tags": [ "ip-list" ], "responses": { "200": { "description": "ip-list resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ip-list.jsonld-ip_list.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve an IP list", "description": "Returns a single IP list by ID, including its name, description, and entries.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "ip-list identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdip-lists_id_delete", "tags": [ "ip-list" ], "responses": { "204": { "description": "ip-list resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete an IP list", "description": "Permanently deletes the IP list. The deletion is rejected if the list is still referenced by other resources (e.g. an allow/block rule); remove those references first.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "ip-list identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdip-lists_id_patch", "tags": [ "ip-list" ], "responses": { "200": { "description": "ip-list resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ip-list.jsonld-ip_list.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update an IP list", "description": "Partially updates the IP list's name, description, or entries. The same validation as creation applies (unique name; valid, canonical, unique and non-overlapping entries; at most 500 entries). The entries array cannot be emptied while the list is still referenced by other resources.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "ip-list identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated ip-list resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/ip-list-ip_list.write.jsonMergePatch" } } }, "required": true } } }, "/api/legacy-api-tokens": { "get": { "operationId": "api_legacy-api-tokens_get_collection", "tags": [ "legacy-api-token" ], "responses": { "200": { "description": "legacy-api-token collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "legacy-api-token.jsonld-legacy_api_token.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/legacy-api-token.jsonld-legacy_api_token.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/legacy-api-token-legacy_api_token.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List your legacy API tokens", "description": "Returns the legacy hub API tokens imported for the authenticated user. The provider scopes the collection to the current user, so it never includes other users' tokens. Each entry exposes only a masked token preview - the full selector and the hashed verifier are never returned.", "parameters": [ { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] } }, "/api/legacy-api-tokens/{id}": { "get": { "operationId": "api_legacy-api-tokens_id_get", "tags": [ "legacy-api-token" ], "responses": { "200": { "description": "legacy-api-token resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/legacy-api-token.jsonld-legacy_api_token.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/legacy-api-token-legacy_api_token.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a legacy API token (disabled)", "description": "Intentionally disabled: an individual legacy token is never exposed by id. The item route exists only so collection IRIs and the Delete operation can resolve, and this endpoint always responds with 403 Forbidden.", "parameters": [ { "name": "id", "in": "path", "description": "legacy-api-token identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_legacy-api-tokens_id_delete", "tags": [ "legacy-api-token" ], "responses": { "204": { "description": "legacy-api-token resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a legacy API token", "description": "Permanently revokes an imported legacy API token. Once deleted, the token can no longer authenticate against the API. Only the owner of the token may delete it.", "parameters": [ { "name": "id", "in": "path", "description": "legacy-api-token identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/organizations/{organizationId}/load-balancers": { "get": { "operationId": "api_organizations_organizationIdload-balancers_get_collection", "tags": [ "load-balancer" ], "responses": { "200": { "description": "load-balancer collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "load-balancer.jsonld-load_balancer.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/load-balancer.jsonld-load_balancer.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/load-balancer-load_balancer.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List load balancers", "description": "Retrieve all load balancers for an organization, each with its configured origin servers.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter load balancers by name using a partial, case-insensitive match.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter load balancers by name using a partial, case-insensitive match.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdload-balancers_post", "tags": [ "load-balancer" ], "responses": { "201": { "description": "load-balancer resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/load-balancer.jsonld-load_balancer.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a load balancer", "description": "Create a new load balancer. Must include at least one origin server in the origins array. Each origin must reference an existing origin server within the same organization and include a weight (1-1000). The name must be unique within the organization.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new load-balancer resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.write_load_balancer.create" } }, "application/json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.write_load_balancer.create" } } }, "required": true } } }, "/api/organizations/{organizationId}/load-balancers/{id}": { "get": { "operationId": "api_organizations_organizationIdload-balancers_id_get", "tags": [ "load-balancer" ], "responses": { "200": { "description": "load-balancer resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/load-balancer.jsonld-load_balancer.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieve a load balancer", "description": "Retrieve a specific load balancer with its configured origins.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "load-balancer identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdload-balancers_id_delete", "tags": [ "load-balancer" ], "responses": { "204": { "description": "load-balancer resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a load balancer", "description": "Delete a load balancer and all its origin associations. Deletion is blocked while the load balancer is still referenced as a zone default backend or by a configuration rule backend override.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "load-balancer identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdload-balancers_id_patch", "tags": [ "load-balancer" ], "responses": { "200": { "description": "load-balancer resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/load-balancer.jsonld-load_balancer.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a load balancer", "description": "Partially update a load balancer. Only provided fields will be updated. Origins can be updated by including the origins array; the resulting set must still contain at least one origin, and every origin must belong to the same organization as the load balancer.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "load-balancer identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated load-balancer resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/load-balancer-load_balancer.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/members": { "get": { "operationId": "api_organizations_organizationIdmembers_get_collection", "tags": [ "member" ], "responses": { "200": { "description": "member collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "member.jsonld-organization_member.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/member.jsonld-organization_member.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/member-organization_member.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List organization members", "description": "Returns every member of the organization, including each member's role, who invited them, and when they joined. Accessible to any authenticated member of the organization. Note that there is no direct create endpoint: members join exclusively through the invitation flow (POST /invitations followed by POST /invitations/{id}/accept), which requires the invitee's consent and email ownership.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Search members by email, first name, or last name (partial match)", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "role", "in": "query", "description": "Filter members by their role: OWNER, MANAGER, or VIEWER", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ] }, "style": "form", "explode": true } ] } }, "/api/organizations/{organizationId}/members/{id}": { "get": { "operationId": "api_organizations_organizationIdmembers_id_get", "tags": [ "member" ], "responses": { "200": { "description": "member resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/member.jsonld-organization_member.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/member-organization_member.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an organization member", "description": "Retrieves a single membership record within the organization by its id, including the member's role, inviter, and join date.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "member identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdmembers_id_delete", "tags": [ "member" ], "responses": { "204": { "description": "member resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Remove a member from the organization", "description": "Removes a member from the organization. You cannot remove your own membership through this endpoint (rejected with 409), and the last remaining OWNER cannot be removed. Side effects: any pending invitations issued by a departing OWNER or MANAGER are cancelled, and the removed user's API tokens are unscoped from this organization so they can no longer access it.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "member identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdmembers_id_patch", "tags": [ "member" ], "responses": { "200": { "description": "member resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/member.jsonld-organization_member.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/member-organization_member.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a member's role", "description": "Changes a member's role within the organization. Only the \"role\" field is mutable; the user and organization associations cannot be changed. Constraints and side effects: you cannot edit your own membership (rejected with 409 - have another OWNER change your role); only an existing OWNER may promote a member to OWNER; and the organization must always retain at least one OWNER, so demoting the last OWNER is rejected.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "member identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated member resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/member-organization_member.update.jsonMergePatch" } } }, "required": true } } }, "/api/organizations": { "get": { "operationId": "api_organizations_get_collection", "tags": [ "organization" ], "responses": { "200": { "description": "organization collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "organization.jsonld-organization.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/organization.jsonld-organization.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/organization-organization.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List organizations", "description": "Returns the organizations the authenticated user is a member of, ordered by name ascending. Use the `q` parameter to search by name (partial match).", "parameters": [ { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Search organizations by name (partial match)", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "order[name]", "in": "query", "description": "Sort by organization name (asc or desc).", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[id]", "in": "query", "description": "Sort by organization ID (asc or desc).", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[createdAt]", "in": "query", "description": "Sort by creation date (asc or desc).", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true }, { "name": "order[plan]", "in": "query", "description": "Sort by subscription plan (asc or desc).", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc", "ASC", "DESC" ] }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_post", "tags": [ "organization" ], "responses": { "201": { "description": "organization resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/organization.jsonld-organization.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/organization-organization.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create an organization", "description": "Creates a new organization. Only `name` is accepted; the plan defaults to FREE and a 30-day trial end date is set automatically on creation. The authenticated user is added as the organization OWNER.", "parameters": [], "requestBody": { "description": "The new organization resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/organization.OrganizationPublicInput-organization.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/organization.OrganizationPublicInput-organization.write" } } }, "required": true } } }, "/api/organizations/{id}": { "get": { "operationId": "api_organizations_id_get", "tags": [ "organization" ], "responses": { "200": { "description": "organization resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/organization.jsonld-organization.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/organization-organization.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an organization", "description": "Returns a single organization by ID. The authenticated user must be a member of the organization (VIEW). Includes the name, plan, trial end date, scalecommerce flag, external customer number, and timestamps.", "parameters": [ { "name": "id", "in": "path", "description": "organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_id_delete", "tags": [ "organization" ], "responses": { "204": { "description": "organization resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete an organization", "description": "Permanently deletes the organization and cascades to all of its members, zones, IP lists, origin servers, load balancers, redirects, and domains. DNS zones for the organization's domains are freed on a best-effort basis (failures are logged but do not block deletion). This action cannot be undone.", "parameters": [ { "name": "id", "in": "path", "description": "organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_id_patch", "tags": [ "organization" ], "responses": { "200": { "description": "organization resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/organization.jsonld-organization.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/organization-organization.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update an organization", "description": "Updates an organization the user is allowed to edit (EDIT). Only the `name` can be changed through this endpoint; plan and other subscription fields cannot be modified here. A rename has no side effects.", "parameters": [ { "name": "id", "in": "path", "description": "organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated organization resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/organization.OrganizationPublicInput-organization.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/origin-servers": { "get": { "operationId": "api_organizations_organizationIdorigin-servers_get_collection", "tags": [ "origin-server" ], "responses": { "200": { "description": "origin-server collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "origin-server.jsonld-origin.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/origin-server.jsonld-origin.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/origin-server-origin.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List origin servers", "description": "Returns the origin servers belonging to the organization. Results can be filtered by name (partial, case-insensitive match), address (exact) and port (exact).", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter by origin server name (partial, case-insensitive match).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter by origin server name (partial, case-insensitive match).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "address", "in": "query", "description": "Filter by exact origin address (hostname or IP).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "address[]", "in": "query", "description": "Filter by exact origin address (hostname or IP).", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true }, { "name": "port", "in": "query", "description": "Filter by exact origin port.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "port[]", "in": "query", "description": "Filter by exact origin port.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdorigin-servers_post", "tags": [ "origin-server" ], "responses": { "201": { "description": "origin-server resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/origin-server.jsonld-origin.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create an origin server", "description": "Registers a new origin server for the organization. The name must be unique within the organization, and the address+port pair must also be unique. The address must be a valid hostname (no wildcards) or IP address and is rejected if it resolves to a forbidden internal range (loopback, RFC1918, link-local, cloud metadata) to prevent SSRF.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new origin-server resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/origin-servers/{id}": { "get": { "operationId": "api_organizations_organizationIdorigin-servers_id_get", "tags": [ "origin-server" ], "responses": { "200": { "description": "origin-server resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/origin-server.jsonld-origin.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get an origin server", "description": "Returns a single origin server belonging to the organization by its ID.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "origin-server identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdorigin-servers_id_delete", "tags": [ "origin-server" ], "responses": { "204": { "description": "origin-server resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete an origin server", "description": "Deletes an origin server. The request is rejected with a 422 if the origin is still referenced by a zone default backend or a configuration rule override, or if deleting it would leave a load balancer with no origins.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "origin-server identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdorigin-servers_id_patch", "tags": [ "origin-server" ], "responses": { "200": { "description": "origin-server resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/origin-server.jsonld-origin.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update an origin server", "description": "Partially update an origin server. Only provided fields will be updated. Set requestHostname to null to clear it. Uniqueness of the name and of the address+port pair within the organization is re-validated, and a changed address is re-checked against the internal-range deny-list.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "origin-server identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated origin-server resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/origin-server-origin.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/redirects": { "get": { "operationId": "api_organizations_organizationIdredirects_get_collection", "tags": [ "redirect" ], "responses": { "200": { "description": "redirect collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "redirect.jsonld-redirect.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/redirect.jsonld-redirect.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/redirect-redirect.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List redirects for an organization", "description": "Returns redirects owned by the organization, paginated. Each redirect exposes its source hostname, target hostname, mode, the generated CNAME target, and the current DNS target verification status of the source hostname. Pass `search` to filter by source hostname, target hostname or CNAME target.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "search", "in": "query", "description": "Partial, case-insensitive match on source hostname, target hostname or generated CNAME target. Combine with `page`/`itemsPerPage` to page the results.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "order[sourceHostname]", "in": "query", "description": "Sort by source hostname, ascending or descending.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "order[targetHostname]", "in": "query", "description": "Sort by target hostname, ascending or descending.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "order[mode]", "in": "query", "description": "Sort by redirect mode, ascending or descending.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_organizations_organizationIdredirects_post", "tags": [ "redirect" ], "responses": { "201": { "description": "redirect resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect.jsonld-redirect.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a redirect", "description": "Creates a redirect from a source hostname to a target hostname. The root domain for the source hostname is found or created for the organization (bootstrapping a certificate for non-shared domains), and a unique CNAME target is generated and assigned to the source hostname; the customer must point the source hostname's DNS CNAME at that value for the redirect to activate. The mapping then takes effect on the live configuration.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new redirect resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.create_redirect.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.create_redirect.write" } } }, "required": true } } }, "/api/organizations/{organizationId}/redirects/{id}": { "get": { "operationId": "api_organizations_organizationIdredirects_id_get", "tags": [ "redirect" ], "responses": { "200": { "description": "redirect resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect.jsonld-redirect.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a redirect", "description": "Returns a single redirect by id, including its source and target hostnames, mode, generated CNAME target, and the DNS target verification status of the source hostname.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "redirect identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_organizations_organizationIdredirects_id_delete", "tags": [ "redirect" ], "responses": { "204": { "description": "redirect resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a redirect", "description": "Deletes the redirect and its source hostname. The removed hostname mapping takes effect on the live configuration.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "redirect identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_organizations_organizationIdredirects_id_patch", "tags": [ "redirect" ], "responses": { "200": { "description": "redirect resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect.jsonld-redirect.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a redirect", "description": "Updates the target hostname and/or mode of a redirect (the source hostname is fixed at creation time and is not writable here). Changing the target or mode updates the live redirect configuration accordingly.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "redirect identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated redirect resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/redirects/{id}/dns-check": { "post": { "operationId": "redirect_dns_recheck", "tags": [ "redirect" ], "responses": { "200": { "description": "redirect resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect.jsonld-redirect.dns.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-redirect.dns.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Re-run the DNS target check for a redirect", "description": "Triggers an immediate, on-demand DNS verification of the redirect's source hostname: the DNS check counter is reset, a live lookup resolves the observed value, and dnsTargetStatus, dnsObservedValue, and dnsLastCheckedAt are updated. The next automatic check is rescheduled based on the resulting status. No request body is expected; returns 200 with the refreshed DNS fields.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "redirect identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/redirect-map": { "get": { "operationId": "api_zones_zoneIdredirect-map_get_collection", "tags": [ "redirect-map" ], "responses": { "200": { "description": "redirect-map collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "redirect-map.jsonld collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/redirect-map.jsonld" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/redirect-map" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone redirect map", "description": "Returns the zone's path-level redirect map as a paginated collection: one member per redirect, each mapping an exact source (\"host/path\") to a target with a mode and an HTTP redirect status. Filter with `search`, order the whole (filtered) map with `order[]` (source, target, mode, status), and page with `page` and `itemsPerPage` (max 500). `totalItems` is the number of entries matching the current `search`.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 50, "minimum": 0, "maximum": 500 }, "style": "form", "explode": true }, { "name": "search", "in": "query", "description": "Case-insensitive substring match on source or target.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "order[source]", "in": "query", "description": "Sort by source. Any of source, target, mode or status is sortable via order[]; sorting is applied server-side across the whole (filtered) map.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "order[target]", "in": "query", "description": "Sort by target.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "order[mode]", "in": "query", "description": "Sort by mode.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "order[status]", "in": "query", "description": "Sort by status.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true } ] }, "delete": { "operationId": "redirect_map_clear", "tags": [ "redirect-map" ], "responses": { "204": { "description": "redirect-map resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Clear a zone redirect map", "description": "Removes every redirect for the zone, emptying its redirect map. Idempotent: clearing an already-empty map still succeeds. Returns 204 No Content.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/redirect-map/export": { "get": { "operationId": "redirect_map_export", "tags": [ "redirect-map" ], "responses": { "200": { "description": "CSV file (text/csv) as an attachment download." }, "204": { "description": "redirect-map resource" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Export a zone redirect map as CSV", "description": "Downloads the whole redirect map as a CSV file - \"source,target,mode,status\", one row per redirect, with a header row. This is the same format the import endpoint accepts, so an exported file can be re-imported as-is. Served as text/csv with a Content-Disposition attachment.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/redirect-map/import": { "post": { "operationId": "redirect_map_import", "tags": [ "redirect-map" ], "responses": { "200": { "description": "redirect-map resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/redirect-map.RedirectMapImportResult.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/redirect-map.RedirectMapImportResult" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Import a zone redirect map from CSV", "description": "Replaces or extends the zone's redirect map from a CSV upload (multipart field `file`). \n\nCSV columns, in order:\n- `source` (required): the exact match key as \"host/path\", e.g. `www.example.com/old`. The host is lowercased; the path is kept as-is.\n- `target` (required): the redirect destination - a full URL (e.g. `https://www.example.com/new`), or a bare host when mode is `H`.\n- `mode` (optional, default `L`): `L` = literal (target is the final URL), `Q` = preserve-query (the incoming query string is appended to the target), `H` = host-swap (keep the incoming path, swap only the host).\n- `status` (optional, default `301`): the HTTP redirect code, one of `301`, `302`, `307`, `308`.\n\nA leading `source,target` header row is ignored, as are blank lines and lines starting with `#`. The multipart form field `mode` chooses \"replace\" (default - the upload becomes the entire map) or \"append\" (the upload is merged into the existing map).\n\nValidation before storage: rows with a missing `source`/`target`, an invalid `mode`, or an invalid `status` are skipped; duplicate sources are rejected (the first is kept); redirect chains (A to B to C) are collapsed to a single hop (A to C); and cycles (A to B to A) are rejected. Skipped or rejected rows do not fail the request - the response reports how many entries were stored (`imported`), how many chains were collapsed (`collapsed`), and a message per problem row (`errors`).", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "binary", "description": "CSV file with columns \"source,target[,mode][,status]\" (an optional header row is ignored). See the endpoint description for each column's allowed values and defaults." }, "mode": { "type": "string", "enum": [ "replace", "append" ], "default": "replace", "description": "\"replace\" (default) overwrites the whole map with the upload; \"append\" merges the upload into the existing map." } } } } }, "required": true } } }, "/api/zones/{zoneId}/rewrite-rules": { "get": { "operationId": "api_zones_zoneIdrewrite-rules_get_collection", "tags": [ "rewrite-rule" ], "responses": { "200": { "description": "rewrite-rule collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "rewrite-rule.jsonld-rewrite_rule.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/rewrite-rule.jsonld-rewrite_rule.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List rewrite rules for a zone", "description": "Returns all URL rewrite rules configured on the zone, ordered by their execution order. Use the \"name\" query parameter to filter by a partial name match.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Filter rules by name using a case-insensitive partial (substring) match.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "name[]", "in": "query", "description": "Filter rules by name using a case-insensitive partial (substring) match.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "string" } }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdrewrite-rules_post", "tags": [ "rewrite-rule" ], "responses": { "201": { "description": "rewrite-rule resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/rewrite-rule.jsonld-rewrite_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a rewrite rule", "description": "Adds a new URL rewrite rule to the zone. The rule is attached to the zone from the URI. If \"order\" is omitted, the rule is appended (highest existing order + 1); if an explicit \"order\" is provided, existing rules at or after that position are shifted down to keep ordering contiguous. The name and the operator+source-pattern combination must be unique within the zone, and the zone's rule limit must not be exceeded. When the operator is a regex variant, the source pattern must be a safe regular expression and the target may only reference capture groups that exist in the pattern.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new rewrite-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.write" } } }, "required": true } } }, "/api/zones/{zoneId}/rewrite-rules/{id}": { "get": { "operationId": "api_zones_zoneIdrewrite-rules_id_get", "tags": [ "rewrite-rule" ], "responses": { "200": { "description": "rewrite-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/rewrite-rule.jsonld-rewrite_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a rewrite rule", "description": "Returns a single rewrite rule identified by its id within the zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "rewrite-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdrewrite-rules_id_delete", "tags": [ "rewrite-rule" ], "responses": { "204": { "description": "rewrite-rule resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a rewrite rule", "description": "Removes the rewrite rule from the zone. Remaining rules keep their relative order.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "rewrite-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdrewrite-rules_id_patch", "tags": [ "rewrite-rule" ], "responses": { "200": { "description": "rewrite-rule resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/rewrite-rule.jsonld-rewrite_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a rewrite rule", "description": "Updates the writable fields of a rewrite rule. The rule's zone cannot be changed. Changing \"order\" re-sequences the other rules in the zone so ordering stays contiguous. Uniqueness (name, and operator+source-pattern) and regex/target validity are re-checked on update.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "rewrite-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated rewrite-rule resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/rewrite-rule-rewrite_rule.write.jsonMergePatch" } } }, "required": true } } }, "/api/search": { "get": { "operationId": "api_search_get", "tags": [ "search" ], "responses": { "200": { "description": "search resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/search.jsonld-search.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/search-search.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a search resource.", "description": "Retrieves a search resource.", "parameters": [ { "name": "q", "in": "query", "description": "", "required": true, "deprecated": false, "schema": { "type": "string", "minLength": 2 }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/security/scenarios": { "get": { "operationId": "api_zones_zoneIdsecurityscenarios_get_collection", "tags": [ "security-scenario" ], "responses": { "200": { "description": "security-scenario collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "security-scenario.jsonld-security_scenario.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/security-scenario.jsonld-security_scenario.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/security-scenario-security_scenario.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone's security scenarios", "description": "Returns the security scenarios owned by the given zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdsecurityscenarios_post", "tags": [ "security-scenario" ], "responses": { "201": { "description": "security-scenario resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/security-scenario.jsonld-security_scenario.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a zone security scenario", "description": "Creates a scenario owned by the zone from a raw YAML `definition`; name, enabled, testing and scope are derived from that YAML. The zone is taken from the URL. Rejected with 422 if the zone's scenario limit is exceeded or the name is already used within the zone.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new security-scenario resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.write" } } }, "required": true } } }, "/api/zones/{zoneId}/security/scenarios/{id}": { "get": { "operationId": "api_zones_zoneIdsecurityscenarios_id_get", "tags": [ "security-scenario" ], "responses": { "200": { "description": "security-scenario resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/security-scenario.jsonld-security_scenario.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a zone security scenario", "description": "Returns a single zone-owned scenario. Global ids and scenarios belonging to another zone return 404.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "security-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdsecurityscenarios_id_delete", "tags": [ "security-scenario" ], "responses": { "204": { "description": "security-scenario resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone security scenario", "description": "Deletes a zone-owned scenario.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "security-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdsecurityscenarios_id_patch", "tags": [ "security-scenario" ], "responses": { "200": { "description": "security-scenario resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/security-scenario.jsonld-security_scenario.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a zone security scenario", "description": "Updates a zone-owned scenario from its YAML `definition`. Renaming it applies the change under the new name.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "security-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated security-scenario resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/security-scenario-security_scenario.write.jsonMergePatch" } } }, "required": true } } }, "/api/organizations/{organizationId}/traffic-logs": { "get": { "operationId": "api_organizations_organizationIdtraffic-logs_get_collection", "tags": [ "traffic-log" ], "responses": { "200": { "description": "traffic-log collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "traffic-log.jsonld collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/traffic-log.jsonld" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/traffic-log" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves the collection of traffic-log resources.", "description": "Retrieves the collection of traffic-log resources.", "parameters": [ { "name": "organizationId", "in": "path", "description": "Organization identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "from", "in": "query", "description": "Window start, unix seconds (default: 15 minutes before \"to\").", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "to", "in": "query", "description": "Window end, unix seconds (default: now).", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "zoneId", "in": "query", "description": "Restrict to these zones (must belong to the organization). Omit for all the org's zones.", "required": false, "deprecated": false, "schema": { "type": "array", "items": { "type": "integer" } }, "style": "form", "explode": true }, { "name": "order[event_time]", "in": "query", "description": "Sort by event_time (default desc). Any field is sortable via order[].", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "asc", "desc" ] }, "style": "form", "explode": true }, { "name": "status_code", "in": "query", "description": "Filter by status_code (also status_code[gte]/[lt]/…). Any raw field is filterable.", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "host", "in": "query", "description": "Filter by host (host[like]=… for substring).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Case-insensitive substring search on host/uri/client_ip/request_id.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/security/waf-rules": { "get": { "operationId": "api_zones_zoneIdsecuritywaf-rules_get_collection", "tags": [ "waf-rule" ], "responses": { "200": { "description": "waf-rule collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "waf-rule.jsonld-waf_rule.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/waf-rule.jsonld-waf_rule.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/waf-rule-waf_rule.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone's WAF rules", "description": "Returns the zone's own WAF rules, ordered by execution \"order\" ascending. Global WAF rules are not included here; see the global-waf-rules endpoint for those.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdsecuritywaf-rules_post", "tags": [ "waf-rule" ], "responses": { "201": { "description": "waf-rule resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/waf-rule.jsonld-waf_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a WAF rule for a zone", "description": "Creates a zone-scoped WAF rule owned by the given zone, subject to the zone's maximum WAF-rule limit. The rule must define at least one condition or an expression; a \"block\" action requires a valid HTTP \"status\" (100-599) and a \"throttle\" action requires \"rateBps\" and/or \"delayMs\".", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new waf-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.write" } } }, "required": true } } }, "/api/zones/{zoneId}/security/waf-rules/{id}": { "get": { "operationId": "api_zones_zoneIdsecuritywaf-rules_id_get", "tags": [ "waf-rule" ], "responses": { "200": { "description": "waf-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/waf-rule.jsonld-waf_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a zone's WAF rule", "description": "Returns a single zone-owned WAF rule by ID.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdsecuritywaf-rules_id_delete", "tags": [ "waf-rule" ], "responses": { "204": { "description": "waf-rule resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone's WAF rule", "description": "Permanently deletes a zone-owned WAF rule.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdsecuritywaf-rules_id_patch", "tags": [ "waf-rule" ], "responses": { "200": { "description": "waf-rule resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/waf-rule.jsonld-waf_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a zone's WAF rule", "description": "Partially updates a zone-owned WAF rule. The same validation as creation applies: at least one condition or an expression, a valid HTTP status for \"block\" actions, and rateBps/delayMs for \"throttle\" actions.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated waf-rule resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/waf-rule-waf_rule.write.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/security/allows": { "get": { "operationId": "api_zones_zoneIdsecurityallows_get_collection", "tags": [ "zone-allow" ], "responses": { "200": { "description": "zone-allow collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "zone-allow.jsonld-allow.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/zone-allow.jsonld-allow.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/zone-allow-allow.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone's allowlist entries", "description": "Returns the per-zone allowlist of trusted IP and CIDR sources for the given zone. IP entries include `geo` data. ASN sources are not supported for zone allowlists.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Substring match on the source (IP/CIDR/ASN).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "type", "in": "query", "description": "Filter by source type.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "ip", "cidr" ] }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdsecurityallows_post", "tags": [ "zone-allow" ], "responses": { "201": { "description": "zone-allow resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-allow.jsonld-allow.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-allow-allow.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a zone allowlist entry", "description": "Adds an IP or CIDR source to the zone allowlist. ASN sources are rejected for zones. The `source` must be unique within the zone allowlist, and the `type` must match the source.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new zone-allow resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-allow-allow.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-allow-allow.write" } } }, "required": true } } }, "/api/zones/{zoneId}/security/allows/{id}": { "get": { "operationId": "api_zones_zoneIdsecurityallows_id_get", "tags": [ "zone-allow" ], "responses": { "200": { "description": "zone-allow resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-allow.jsonld-allow.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-allow-allow.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a zone allowlist entry", "description": "Returns a single zone allowlist entry, identified by its opaque id (base64url of the source). Includes `geo` data for IP sources.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-allow identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-allow identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdsecurityallows_id_delete", "tags": [ "zone-allow" ], "responses": { "204": { "description": "zone-allow resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone allowlist entry", "description": "Removes an entry from the zone allowlist, identified by its opaque id.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-allow identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-allow identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] } }, "/api/zones/{zoneId}/security/blocks": { "get": { "operationId": "api_zones_zoneIdsecurityblocks_get_collection", "tags": [ "zone-block" ], "responses": { "200": { "description": "zone-block collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "zone-block.jsonld-block.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/zone-block.jsonld-block.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/zone-block-block.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List a zone's manual blocks", "description": "Returns the per-zone manual blocklist for the given zone. Supports a substring search on the source (`q`) and filtering by `action` and source `type`; the `geo` field is populated for IP entries only.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Substring match on the source (IP/CIDR/ASN).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "action", "in": "query", "description": "Filter by action.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "block", "challenge" ] }, "style": "form", "explode": true }, { "name": "type", "in": "query", "description": "Filter by source type.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "ip", "cidr", "asn" ] }, "style": "form", "explode": true } ] }, "post": { "operationId": "api_zones_zoneIdsecurityblocks_post", "tags": [ "zone-block" ], "responses": { "201": { "description": "zone-block resource created", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-block.jsonld-block.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-block-block.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Create a manual block in a zone", "description": "Adds an IP, CIDR, or ASN to the zone's manual blocklist with the given action (`block` or `challenge`). The source must be valid, must not already be blocked in this zone, and the `type` must match the source.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The new zone-block resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-block-block.write" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-block-block.write" } } }, "required": true } } }, "/api/zones/{zoneId}/security/blocks/{id}": { "get": { "operationId": "api_zones_zoneIdsecurityblocks_id_get", "tags": [ "zone-block" ], "responses": { "200": { "description": "zone-block resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-block.jsonld-block.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-block-block.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a zone's manual block", "description": "Returns a single per-zone blocklist entry by its opaque id (base64url of the source).", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "delete": { "operationId": "api_zones_zoneIdsecurityblocks_id_delete", "tags": [ "zone-block" ], "responses": { "204": { "description": "zone-block resource deleted" }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Delete a zone's manual block", "description": "Removes an entry from the zone's manual blocklist.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdsecurityblocks_id_patch", "tags": [ "zone-block" ], "responses": { "200": { "description": "zone-block resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-block.jsonld-block.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-block-block.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Update a zone's manual block", "description": "Changes the action (`block` or `challenge`) of an existing per-zone blocklist entry. The source (and therefore the id) is immutable.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-block identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated zone-block resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/zone-block-block.update.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/security/global-scenarios": { "get": { "operationId": "api_zones_zoneIdsecurityglobal-scenarios_get_collection", "tags": [ "zone-global-scenario" ], "responses": { "200": { "description": "zone-global-scenario collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "zone-global-scenario.jsonld-global_scenario.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/zone-global-scenario.jsonld-global_scenario.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/zone-global-scenario-global_scenario.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List global scenarios for a zone", "description": "Returns the active global scenarios (enabled and not testing) as seen by this zone. Each entry carries `enabledForZone`, the zone's effective on/off state: its explicit preference when set, otherwise the scenario's participation-mode default (opt-out on, opt-in off).", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/security/global-scenarios/{id}": { "get": { "operationId": "api_zones_zoneIdsecurityglobal-scenarios_id_get", "tags": [ "zone-global-scenario" ], "responses": { "200": { "description": "zone-global-scenario resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-global-scenario.jsonld-global_scenario.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-global-scenario-global_scenario.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a global scenario for a zone", "description": "Returns one active global scenario including the zone's effective `enabledForZone` flag. Disabled or testing globals, and non-global ids, return 404.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-global-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-global-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdsecurityglobal-scenarios_id_patch", "tags": [ "zone-global-scenario" ], "responses": { "200": { "description": "zone-global-scenario resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-global-scenario.jsonld-global_scenario.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-global-scenario-global_scenario.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Toggle a global scenario for a zone", "description": "Turns a global scenario on or off for this zone by recording the zone's explicit preference; the global scenario itself is never modified. Send `enabledForZone`. The explicit choice is always recorded so it survives a later change of the scenario's participation mode.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-global-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-global-scenario identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated zone-global-scenario resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/zone-global-scenario-global_scenario.write.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/security/global-waf-rules": { "get": { "operationId": "api_zones_zoneIdsecurityglobal-waf-rules_get_collection", "tags": [ "zone-global-waf-rule" ], "responses": { "200": { "description": "zone-global-waf-rule collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "zone-global-waf-rule.jsonld-global_waf_rule.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/zone-global-waf-rule.jsonld-global_waf_rule.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/zone-global-waf-rule-global_waf_rule.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List global WAF rules applied to a zone", "description": "Read-only catalog of global (tenant-agnostic) WAF rules as seen from a zone context. These rules cannot be created, edited, or deleted here.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/security/global-waf-rules/{id}": { "get": { "operationId": "api_zones_zoneIdsecurityglobal-waf-rules_id_get", "tags": [ "zone-global-waf-rule" ], "responses": { "200": { "description": "zone-global-waf-rule resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-global-waf-rule.jsonld-global_waf_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-global-waf-rule-global_waf_rule.read" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Get a global WAF rule in a zone context", "description": "Read-only view of a single global WAF rule as seen from a zone context, including the zone's effective `enabledForZone` flag. The rule itself cannot be edited here; only the per-zone on/off toggle (PATCH `enabledForZone`) is writable.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-global-waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-global-waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ] }, "patch": { "operationId": "api_zones_zoneIdsecurityglobal-waf-rules_id_patch", "tags": [ "zone-global-waf-rule" ], "responses": { "200": { "description": "zone-global-waf-rule resource updated", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-global-waf-rule.jsonld-global_waf_rule.read" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-global-waf-rule-global_waf_rule.read" } } }, "links": {} }, "400": { "description": "Invalid input", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "422": { "description": "An error occurred", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ConstraintViolation" } } }, "links": {} } }, "summary": "Enable or disable a global WAF rule for a zone", "description": "Turns a global WAF rule on or off for this zone by recording the zone's explicit preference; the global rule itself is never modified. Send `enabledForZone` (global rules are on by default, so `false` opts the zone out). An opted-out rule is not enforced for the zone but still contributes to the shadow anomaly score.", "parameters": [ { "name": "zoneId", "in": "path", "description": "zone-global-waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "id", "in": "path", "description": "zone-global-waf-rule identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false } ], "requestBody": { "description": "The updated zone-global-waf-rule resource", "content": { "application/merge-patch+json": { "schema": { "$ref": "#/components/schemas/zone-global-waf-rule-global_waf_rule.write.jsonMergePatch" } } }, "required": true } } }, "/api/zones/{zoneId}/security/lookup": { "get": { "operationId": "api_zones_zoneIdsecuritylookup_get", "tags": [ "zone-ip-lookup" ], "responses": { "200": { "description": "zone-ip-lookup resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-ip-lookup.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-ip-lookup" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a zone-ip-lookup resource.", "description": "Retrieves a zone-ip-lookup resource.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "ip", "in": "query", "description": "The IP address (IPv4 or IPv6) to look up. No CIDR or ASN.", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/traffic-chart": { "get": { "operationId": "api_zones_zoneIdtraffic-chart_get", "tags": [ "zone-kpis" ], "responses": { "200": { "description": "zone-kpis resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/ChartResult.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/ChartResult" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a zone-kpis resource.", "description": "Retrieves a zone-kpis resource.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "metric", "in": "query", "description": "The traffic metric to chart. Use \"top\" for a ranked breakdown (see dimension/limit).", "required": true, "deprecated": false, "schema": { "type": "string", "enum": [ "access", "status-codes", "image-cache", "html-cache", "content-type", "cache-purges", "blocked", "top" ] }, "style": "form", "explode": true }, { "name": "dimension", "in": "query", "description": "metric=top: which column to rank. Ignored for other metrics.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "host", "country", "status", "uri" ] }, "style": "form", "explode": true }, { "name": "limit", "in": "query", "description": "metric=top: number of rows to return (default 8, max 100).", "required": false, "deprecated": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 8 }, "style": "form", "explode": true }, { "name": "range", "in": "query", "description": "Preset time range. Ignored when from/to are provided.", "required": false, "deprecated": false, "schema": { "type": "string", "enum": [ "5 minutes", "15 minutes", "1 hour", "6 hours", "1 day", "3 days", "7 days", "30 days" ], "default": "1 hour" }, "style": "form", "explode": true }, { "name": "from", "in": "query", "description": "Custom range start (Unix timestamp in seconds).", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "to", "in": "query", "description": "Custom range end (Unix timestamp in seconds).", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "points", "in": "query", "description": "Number of data points (buckets). Auto-calculated when omitted.", "required": false, "deprecated": false, "schema": { "type": "integer", "minimum": 1, "maximum": 100 }, "style": "form", "explode": true }, { "name": "host", "in": "query", "description": "Only count requests for this exact host.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true }, { "name": "status_code", "in": "query", "description": "Only count requests with this exact HTTP status code.", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "q", "in": "query", "description": "Free-text filter: case-insensitive substring match over host, URI, client IP and request id.", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/traffic-summary": { "get": { "operationId": "api_zones_zoneIdtraffic-summary_get", "tags": [ "zone-kpis" ], "responses": { "200": { "description": "zone-kpis resource", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/zone-kpis.jsonld" } }, "application/json": { "schema": { "$ref": "#/components/schemas/zone-kpis" } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} }, "404": { "description": "Not found", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "Retrieves a zone-kpis resource.", "description": "Retrieves a zone-kpis resource.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "from", "in": "query", "description": "Window start (Unix seconds). Both from and to must be given; otherwise a rolling 7-day window is used. Note: bandwidth is aggregated daily, so sub-day windows report day-granular bytes.", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true }, { "name": "to", "in": "query", "description": "Window end (Unix seconds).", "required": false, "deprecated": false, "schema": { "type": "integer" }, "style": "form", "explode": true } ] } }, "/api/zones/{zoneId}/cache/managed-ignored-url-params": { "get": { "operationId": "api_zones_zoneIdcachemanaged-ignored-url-params_get_collection", "tags": [ "zone-managed-ignored-url-param" ], "responses": { "200": { "description": "zone-managed-ignored-url-param collection", "content": { "application/ld+json": { "schema": { "type": "object", "description": "zone-managed-ignored-url-param.jsonld-zone_managed_ignored_url_param.read collection.", "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchema" }, { "type": "object", "required": [ "member" ], "properties": { "member": { "type": "array", "items": { "$ref": "#/components/schemas/zone-managed-ignored-url-param.jsonld-zone_managed_ignored_url_param.read" } } } } ] } }, "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/zone-managed-ignored-url-param-zone_managed_ignored_url_param.read" } } } } }, "403": { "description": "Forbidden", "content": { "application/ld+json": { "schema": { "$ref": "#/components/schemas/Error.jsonld" } }, "application/problem+json": { "schema": { "$ref": "#/components/schemas/Error" } }, "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "links": {} } }, "summary": "List managed ignored URL parameters applied to a zone", "description": "Read-only catalog of the platform-managed query-string parameter names that are stripped from the URL before cache-key computation when the zone has `cachingManagedIgnoredUrlParamsEnabled` switched on.", "parameters": [ { "name": "zoneId", "in": "path", "description": "Zone identifier", "required": true, "deprecated": false, "schema": { "type": "string" }, "style": "simple", "explode": false }, { "name": "page", "in": "query", "description": "The collection page number", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 1 }, "style": "form", "explode": true }, { "name": "itemsPerPage", "in": "query", "description": "The number of items per page", "required": false, "deprecated": false, "schema": { "type": "integer", "default": 30, "minimum": 0, "maximum": 100 }, "style": "form", "explode": true }, { "name": "name", "in": "query", "description": "Substring match on the parameter name (LIKE %name%).", "required": false, "deprecated": false, "schema": { "type": "string" }, "style": "form", "explode": true } ] } } }, "components": { "schemas": { "AccessRuleCondition": { "type": "object", "description": "A single condition comparing a request attribute against a value", "required": [ "field", "operator" ], "properties": { "field": { "type": "string", "enum": [ "ip", "uri", "host", "method", "userAgent", "referer", "header", "cookie", "queryParam", "country", "isEu" ], "description": "Available fields:\nip: Client IP Address [operators: equal, notEqual, inCidr, notInCidr, isInIpList, isNotInIpList]\nuri: Request URI Path [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nhost: Request Hostname [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nmethod: HTTP Method [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nuserAgent: User Agent [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nreferer: Referer [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\nheader: HTTP Header (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\ncookie: Cookie (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\nqueryParam: Query Parameter (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\ncountry: Country Code [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nisEu: Is EU Country [operators: equal]" }, "operator": { "type": "string", "enum": [ "equal", "notEqual", "contains", "notContains", "endsWith", "matches", "in", "notIn", "inCidr", "notInCidr", "isInIpList", "isNotInIpList", "exists", "notExists" ], "description": "Available operators:\nequal: equals (value: string)\nnotEqual: does not equal (value: string)\ncontains: contains (value: string)\nnotContains: does not contain (value: string)\nendsWith: ends with (value: string)\nmatches: matches regex (value: string)\nin: is in (value: array)\nnotIn: is not in (value: array)\ninCidr: is in CIDR range (value: array)\nnotInCidr: is not in CIDR range (value: array)\nisInIpList: is in IP list (value: array)\nisNotInIpList: is not in IP list (value: array)\nexists: exists (value: none)\nnotExists: does not exist (value: none)" }, "target": { "type": "string", "description": "Required for header, cookie, queryParam fields. The name of the header/cookie/parameter to check.", "example": "X-Custom-Header" }, "value": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Value to compare. Use string for equal/contains/matches, array for in/notIn/inCidr. Not needed for exists/notExists." } }, "example": { "field": "header", "operator": "equal", "target": "X-Api-Version", "value": "v2" } }, "AccessRuleConditionGroup": { "type": "object", "description": "A group of conditions combined with AND/OR logic. Can contain conditions and nested groups.", "required": [ "logic", "conditions" ], "properties": { "logic": { "type": "string", "enum": [ "and", "or" ], "description": "\"and\" = all conditions must match, \"or\" = any condition must match" }, "conditions": { "type": "array", "minItems": 1, "description": "Array of conditions or nested condition groups", "items": { "oneOf": [ { "$ref": "#/components/schemas/AccessRuleCondition" }, { "$ref": "#/components/schemas/AccessRuleConditionGroup" } ] } } }, "example": { "logic": "and", "conditions": [ { "field": "ip", "operator": "inCidr", "value": [ "192.168.1.0/24", "10.0.0.0/8" ] }, { "logic": "or", "conditions": [ { "field": "uri", "operator": "startsWith", "value": "/api/" }, { "field": "header", "operator": "exists", "target": "Authorization" } ] } ] } }, "BillingCustomer": { "type": "object", "properties": { "accountId": { "description": "Merchant account id - used to build the customer-portal login URL.", "type": [ "string", "null" ] }, "handle": { "description": "Customer account id (handle) - used to build links to the account.", "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "firstName": { "type": [ "string", "null" ] }, "lastName": { "type": [ "string", "null" ] }, "company": { "type": [ "string", "null" ] }, "vatId": { "type": [ "string", "null" ] }, "phone": { "type": [ "string", "null" ] }, "address": { "type": [ "string", "null" ] }, "city": { "type": [ "string", "null" ] }, "postalCode": { "type": [ "string", "null" ] }, "country": { "type": [ "string", "null" ] } } }, "BillingCustomer.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "accountId": { "description": "Merchant account id - used to build the customer-portal login URL.", "type": [ "string", "null" ] }, "handle": { "description": "Customer account id (handle) - used to build links to the account.", "type": [ "string", "null" ] }, "email": { "type": [ "string", "null" ] }, "firstName": { "type": [ "string", "null" ] }, "lastName": { "type": [ "string", "null" ] }, "company": { "type": [ "string", "null" ] }, "vatId": { "type": [ "string", "null" ] }, "phone": { "type": [ "string", "null" ] }, "address": { "type": [ "string", "null" ] }, "city": { "type": [ "string", "null" ] }, "postalCode": { "type": [ "string", "null" ] }, "country": { "type": [ "string", "null" ] } } } ] }, "BillingCustomerInput": { "type": "object", "required": [ "email", "firstName", "lastName", "address", "city", "zip", "country" ], "properties": { "email": { "format": "email", "externalDocs": { "url": "https://schema.org/email" }, "type": [ "string", "null" ] }, "firstName": { "type": [ "string", "null" ] }, "lastName": { "type": [ "string", "null" ] }, "address": { "type": [ "string", "null" ] }, "city": { "type": [ "string", "null" ] }, "zip": { "type": [ "string", "null" ] }, "country": { "minLength": 2, "maxLength": 2, "type": [ "string", "null" ] }, "company": { "maxLength": 255, "type": [ "string", "null" ] }, "vatId": { "maxLength": 255, "type": [ "string", "null" ] }, "phone": { "maxLength": 255, "type": [ "string", "null" ] } } }, "BillingPaymentMethods": { "type": "object", "properties": { "paymentMethods": { "type": "array", "items": { "$ref": "#/components/schemas/PaymentMethod" } } } }, "BillingPaymentMethods.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "paymentMethods": { "type": "array", "items": { "$ref": "#/components/schemas/PaymentMethod.jsonld" } } } } ] }, "BillingPlan": { "type": "object", "properties": { "handle": { "default": "", "type": "string" }, "displayName": { "default": "", "type": "string" }, "basePrice": { "default": 0, "type": "number" }, "trafficGbPriceEurope": { "default": 0, "type": "number" }, "trafficGbPriceOther": { "default": 0, "type": "number" }, "storageGbPrice": { "default": 0, "type": "number" }, "includedTrafficGb": { "default": 0, "type": "integer" }, "includedStorageGb": { "default": 0, "type": "integer" } } }, "BillingPlan.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "handle": { "default": "", "type": "string" }, "displayName": { "default": "", "type": "string" }, "basePrice": { "default": 0, "type": "number" }, "trafficGbPriceEurope": { "default": 0, "type": "number" }, "trafficGbPriceOther": { "default": 0, "type": "number" }, "storageGbPrice": { "default": 0, "type": "number" }, "includedTrafficGb": { "default": 0, "type": "integer" }, "includedStorageGb": { "default": 0, "type": "integer" } } } ] }, "BillingSubscriptions": { "type": "object", "properties": { "subscriptions": { "type": "array", "items": { "$ref": "#/components/schemas/Subscription" } } } }, "BillingSubscriptions.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "subscriptions": { "type": "array", "items": { "$ref": "#/components/schemas/Subscription.jsonld" } } } } ] }, "CacheKeyConfig-zone.read_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByCookie": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } }, "varyByCountry": { "type": [ "boolean", "null" ] }, "varyByHeader": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "CacheKeyConfig-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByCookie": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } }, "varyByCountry": { "type": [ "boolean", "null" ] }, "varyByHeader": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "CacheKeyConfig-zone.write_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByCookie": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } }, "varyByCountry": { "type": [ "boolean", "null" ] }, "varyByHeader": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "CacheKeyConfig.jsonld-zone.read_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByCookie": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } }, "varyByCountry": { "type": [ "boolean", "null" ] }, "varyByHeader": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "CacheKeyConfig.jsonld-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByCookie": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } }, "varyByCountry": { "type": [ "boolean", "null" ] }, "varyByHeader": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "CacheTagHeader-zone.read_zone_settings": { "type": "object", "required": [ "header", "delimiter" ], "properties": { "header": { "type": "string" }, "delimiter": { "maxLength": 1, "pattern": "^(.*(^[a-zA-Z0-9 ,;|]$).*)$", "type": "string" } } }, "CacheTagHeader-zone.read_zone_settings_zone.admin.read": { "type": "object", "required": [ "header", "delimiter" ], "properties": { "header": { "type": "string" }, "delimiter": { "maxLength": 1, "pattern": "^(.*(^[a-zA-Z0-9 ,;|]$).*)$", "type": "string" } } }, "CacheTagHeader-zone.write_zone_settings": { "type": "object", "required": [ "header", "delimiter" ], "properties": { "header": { "type": "string" }, "delimiter": { "maxLength": 1, "pattern": "^(.*(^[a-zA-Z0-9 ,;|]$).*)$", "type": "string" } } }, "CacheTagHeader.jsonld-zone.read_zone_settings": { "type": "object", "required": [ "header", "delimiter" ], "properties": { "header": { "type": "string" }, "delimiter": { "maxLength": 1, "pattern": "^(.*(^[a-zA-Z0-9 ,;|]$).*)$", "type": "string" } } }, "CacheTagHeader.jsonld-zone.read_zone_settings_zone.admin.read": { "type": "object", "required": [ "header", "delimiter" ], "properties": { "header": { "type": "string" }, "delimiter": { "maxLength": 1, "pattern": "^(.*(^[a-zA-Z0-9 ,;|]$).*)$", "type": "string" } } }, "CertificateAttemptStep-certificate_attempt.read": { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "name": { "type": "string", "enum": [ "init", "verify_cname_record", "create_acme_order", "provision_dns_record", "await_dns_propagation", "authorize", "poll_order_ready", "download_certificate", "persist_certificate", "parse_certificate", "verify_key_match", "verify_not_expired", "verify_chain", "verify_san_coverage", "import_sans" ], "description": "The pipeline step identifier. Which steps appear depends on the attempt type.\n\n**ACME pipeline** (type `acme_issue` / `acme_renew`, executed in order):\n- `init` - Sets certificate status to RENEWING.\n- `verify_cname_record` - Verifies each SAN's base domain has a valid CNAME record pointing to the expected target.\n- `create_acme_order` - Creates the ACME order with the CA for all requested SANs.\n- `provision_dns_record` - Creates DNS-01 challenge TXT records in Cloudflare.\n- `await_dns_propagation` - Waits until every challenge TXT record is publicly resolvable before validation, to avoid a misleading NXDOMAIN failure; reports the unresolved name on timeout.\n- `authorize` - Submits each DNS-01 challenge to the CA for validation.\n- `poll_order_ready` - Polls the CA until the order is ready, generates a CSR, and finalizes the order.\n- `download_certificate` - Downloads the issued certificate PEM from the CA.\n- `persist_certificate` - Stores the certificate + private key, updates SAN coverage statuses, and marks the attempt as succeeded.\n\n**Upload pipeline** (type `upload`, executed in order):\n- `init` - Initializes the upload attempt.\n- `parse_certificate` - Parses the uploaded PEM certificate and extracts metadata (SANs, expiry, issuer, fingerprint).\n- `verify_key_match` - Verifies the uploaded private key matches the certificate's public key.\n- `verify_not_expired` - Checks that the certificate has not expired.\n- `import_sans` - Replaces the certificate's SANs with the ones present in the uploaded certificate (a custom certificate defines its own coverage).\n- `persist_certificate` - Stores the certificate + private key + chain, updates SAN coverage statuses, and marks the attempt as succeeded." }, "status": { "type": "string", "enum": [ "pending", "running", "succeeded", "failed", "skipped" ], "description": "Lifecycle status of this step.\n- `pending` - Step created but not yet started.\n- `running` - Step is currently executing.\n- `succeeded` - Step completed successfully.\n- `failed` - Step failed; see `errorCode` and `message` for details.\n- `skipped` - Step was skipped (e.g. not applicable for this attempt)." }, "startedAt": { "readOnly": true, "type": [ "string", "null" ], "format": "date-time" }, "finishedAt": { "readOnly": true, "type": [ "string", "null" ], "format": "date-time" }, "message": { "readOnly": true, "type": [ "string", "null" ], "description": "Human-readable status or error message. Present on succeeded steps (e.g. \"Certificate parsed successfully\") and on failed steps (e.g. the ACME error detail or validation failure reason)." }, "errorCode": { "readOnly": true, "type": [ "string", "null" ], "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error", null ], "description": "Machine-readable error classification. Only present when `status` is `failed`. Possible values depend on the step:\n\n**ACME pipeline errors:**\n- `cname_record_missing` - No CNAME record found for the domain (step: `verify_cname_record`).\n- `cname_record_invalid` - CNAME record exists but points to the wrong target (step: `verify_cname_record`).\n- `dns_provision_failed` - Failed to create DNS challenge TXT records in Cloudflare (step: `provision_dns_record`).\n- `rate_limit` - ACME CA rate limit exceeded.\n- `acme_error` - General ACME protocol error (steps: `create_acme_order`, `authorize`, `poll_order_ready`, `download_certificate`).\n- `internal_error` - Unexpected internal error.\n\n**Upload pipeline errors:**\n- `upload_invalid_pem` - Uploaded certificate PEM could not be parsed (step: `parse_certificate`).\n- `upload_key_mismatch` - Private key does not match the certificate (step: `verify_key_match`).\n- `upload_expired` - Certificate has already expired (step: `verify_not_expired`).\n- `internal_error` - Unexpected internal error." }, "context": { "readOnly": true, "description": "Optional step-specific context data. Only present on failed steps when additional diagnostic information is available. The structure varies by step and error type - typically contains identifiers or state from the failed operation (e.g. ACME order URLs, challenge details).", "type": "object", "nullable": true, "additionalProperties": true } } }, "CertificateAttemptStep.jsonld-certificate_attempt.read": { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "name": { "type": "string", "enum": [ "init", "verify_cname_record", "create_acme_order", "provision_dns_record", "await_dns_propagation", "authorize", "poll_order_ready", "download_certificate", "persist_certificate", "parse_certificate", "verify_key_match", "verify_not_expired", "verify_chain", "verify_san_coverage", "import_sans" ], "description": "The pipeline step identifier. Which steps appear depends on the attempt type.\n\n**ACME pipeline** (type `acme_issue` / `acme_renew`, executed in order):\n- `init` - Sets certificate status to RENEWING.\n- `verify_cname_record` - Verifies each SAN's base domain has a valid CNAME record pointing to the expected target.\n- `create_acme_order` - Creates the ACME order with the CA for all requested SANs.\n- `provision_dns_record` - Creates DNS-01 challenge TXT records in Cloudflare.\n- `await_dns_propagation` - Waits until every challenge TXT record is publicly resolvable before validation, to avoid a misleading NXDOMAIN failure; reports the unresolved name on timeout.\n- `authorize` - Submits each DNS-01 challenge to the CA for validation.\n- `poll_order_ready` - Polls the CA until the order is ready, generates a CSR, and finalizes the order.\n- `download_certificate` - Downloads the issued certificate PEM from the CA.\n- `persist_certificate` - Stores the certificate + private key, updates SAN coverage statuses, and marks the attempt as succeeded.\n\n**Upload pipeline** (type `upload`, executed in order):\n- `init` - Initializes the upload attempt.\n- `parse_certificate` - Parses the uploaded PEM certificate and extracts metadata (SANs, expiry, issuer, fingerprint).\n- `verify_key_match` - Verifies the uploaded private key matches the certificate's public key.\n- `verify_not_expired` - Checks that the certificate has not expired.\n- `import_sans` - Replaces the certificate's SANs with the ones present in the uploaded certificate (a custom certificate defines its own coverage).\n- `persist_certificate` - Stores the certificate + private key + chain, updates SAN coverage statuses, and marks the attempt as succeeded." }, "status": { "type": "string", "enum": [ "pending", "running", "succeeded", "failed", "skipped" ], "description": "Lifecycle status of this step.\n- `pending` - Step created but not yet started.\n- `running` - Step is currently executing.\n- `succeeded` - Step completed successfully.\n- `failed` - Step failed; see `errorCode` and `message` for details.\n- `skipped` - Step was skipped (e.g. not applicable for this attempt)." }, "startedAt": { "readOnly": true, "type": [ "string", "null" ], "format": "date-time" }, "finishedAt": { "readOnly": true, "type": [ "string", "null" ], "format": "date-time" }, "message": { "readOnly": true, "type": [ "string", "null" ], "description": "Human-readable status or error message. Present on succeeded steps (e.g. \"Certificate parsed successfully\") and on failed steps (e.g. the ACME error detail or validation failure reason)." }, "errorCode": { "readOnly": true, "type": [ "string", "null" ], "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error", null ], "description": "Machine-readable error classification. Only present when `status` is `failed`. Possible values depend on the step:\n\n**ACME pipeline errors:**\n- `cname_record_missing` - No CNAME record found for the domain (step: `verify_cname_record`).\n- `cname_record_invalid` - CNAME record exists but points to the wrong target (step: `verify_cname_record`).\n- `dns_provision_failed` - Failed to create DNS challenge TXT records in Cloudflare (step: `provision_dns_record`).\n- `rate_limit` - ACME CA rate limit exceeded.\n- `acme_error` - General ACME protocol error (steps: `create_acme_order`, `authorize`, `poll_order_ready`, `download_certificate`).\n- `internal_error` - Unexpected internal error.\n\n**Upload pipeline errors:**\n- `upload_invalid_pem` - Uploaded certificate PEM could not be parsed (step: `parse_certificate`).\n- `upload_key_mismatch` - Private key does not match the certificate (step: `verify_key_match`).\n- `upload_expired` - Certificate has already expired (step: `verify_not_expired`).\n- `internal_error` - Unexpected internal error." }, "context": { "readOnly": true, "description": "Optional step-specific context data. Only present on failed steps when additional diagnostic information is available. The structure varies by step and error type - typically contains identifiers or state from the failed operation (e.g. ACME order URLs, challenge details).", "type": "object", "nullable": true, "additionalProperties": true } } }, "ChartResult": { "type": "object", "properties": { "metric": { "type": "string" }, "series": { "description": "time-series buckets (empty for metric=top)", "type": "object", "additionalProperties": { "type": "array", "items": { "type": "array", "items": { "type": "integer" } } } }, "range": { "type": "string" }, "from": { "type": "string" }, "to": { "type": "string" }, "items": { "description": "ranked rows (only for metric=top)", "type": "array", "items": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "string" } ] } } }, "dimension": { "type": [ "string", "null" ] } } }, "ChartResult.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "metric": { "type": "string" }, "series": { "description": "time-series buckets (empty for metric=top)", "type": "object", "additionalProperties": { "type": "array", "items": { "type": "array", "items": { "type": "integer" } } } }, "range": { "type": "string" }, "from": { "type": "string" }, "to": { "type": "string" }, "items": { "description": "ranked rows (only for metric=top)", "type": "array", "items": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "string" } ] } } }, "dimension": { "type": [ "string", "null" ] } } } ] }, "Condition": { "type": "object", "description": "A single condition comparing a request attribute against a value", "required": [ "field", "operator" ], "properties": { "field": { "type": "string", "enum": [ "ip", "uri", "host", "method", "userAgent", "referer", "acceptLanguage", "cacheControl", "header", "cookie", "queryParam", "country", "countrySubdivision", "city", "isEu" ], "description": "Available fields:\nip: Client IP Address [operators: equal, notEqual, inCidr, notInCidr, isInIpList, isNotInIpList]\nuri: Request URI Path [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nhost: Request Hostname [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nmethod: HTTP Method [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nuserAgent: User Agent [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nreferer: Referer [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\nacceptLanguage: Accept-Language Header [operators: equal, notEqual, contains, notContains, matches, in, notIn]\ncacheControl: Cache-Control Header [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\nheader: HTTP Header (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\ncookie: Cookie (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\nqueryParam: Query Parameter (requires target) [operators: equal, notEqual, contains, notContains, matches, in, notIn, exists, notExists]\ncountry: Country Code [operators: equal, notEqual, contains, notContains, matches, in, notIn]\ncountrySubdivision: Country Subdivision (State/Province) [operators: equal, notEqual, contains, notContains, matches, in, notIn]\ncity: City [operators: equal, notEqual, contains, notContains, matches, in, notIn]\nisEu: Is EU Country [operators: equal]" }, "operator": { "type": "string", "enum": [ "equal", "notEqual", "contains", "notContains", "endsWith", "matches", "in", "notIn", "inCidr", "notInCidr", "isInIpList", "isNotInIpList", "exists", "notExists" ], "description": "Available operators:\nequal: equals (value: string)\nnotEqual: does not equal (value: string)\ncontains: contains (value: string)\nnotContains: does not contain (value: string)\nendsWith: ends with (value: string)\nmatches: matches regex (value: string)\nin: is in (value: array)\nnotIn: is not in (value: array)\ninCidr: is in CIDR range (value: array)\nnotInCidr: is not in CIDR range (value: array)\nisInIpList: is in IP list (value: array)\nisNotInIpList: is not in IP list (value: array)\nexists: exists (value: none)\nnotExists: does not exist (value: none)" }, "target": { "type": "string", "description": "Required for header, cookie, queryParam fields. The name of the header/cookie/parameter to check.", "example": "X-Custom-Header" }, "value": { "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ], "description": "Value to compare. Use string for equal/contains/matches, array for in/notIn/inCidr. Not needed for exists/notExists." } }, "example": { "field": "header", "operator": "equal", "target": "X-Api-Version", "value": "v2" } }, "ConditionGroup": { "type": "object", "description": "A group of conditions combined with AND/OR logic. Can contain conditions and nested groups.", "required": [ "logic", "conditions" ], "properties": { "logic": { "type": "string", "enum": [ "and", "or" ], "description": "\"and\" = all conditions must match, \"or\" = any condition must match" }, "conditions": { "type": "array", "minItems": 1, "description": "Array of conditions or nested condition groups", "items": { "oneOf": [ { "$ref": "#/components/schemas/Condition" }, { "$ref": "#/components/schemas/ConditionGroup" } ] } } }, "example": { "logic": "and", "conditions": [ { "field": "ip", "operator": "inCidr", "value": [ "192.168.1.0/24", "10.0.0.0/8" ] }, { "logic": "or", "conditions": [ { "field": "uri", "operator": "startsWith", "value": "/api/" }, { "field": "header", "operator": "exists", "target": "Authorization" } ] } ] } }, "ConstraintViolation": { "type": "object", "description": "Unprocessable entity", "properties": { "status": { "default": 422, "type": "integer" }, "violations": { "type": "array", "items": { "type": "object", "properties": { "propertyPath": { "type": "string", "description": "The property path of the violation" }, "message": { "type": "string", "description": "The message associated with the violation" }, "code": { "type": "string", "description": "The code of the violation" }, "hint": { "type": "string", "description": "An extra hint to understand the violation" }, "payload": { "type": "object", "additionalProperties": true, "description": "The serialized payload of the violation" } }, "required": [ "propertyPath", "message" ] } }, "detail": { "readOnly": true, "type": "string" }, "type": { "readOnly": true, "type": "string" }, "title": { "readOnly": true, "type": [ "string", "null" ] }, "instance": { "readOnly": true, "type": [ "string", "null" ] } } }, "ConstraintViolation.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "status": { "default": 422, "type": "integer" }, "violations": { "type": "array", "items": { "type": "object", "properties": { "propertyPath": { "type": "string", "description": "The property path of the violation" }, "message": { "type": "string", "description": "The message associated with the violation" }, "code": { "type": "string", "description": "The code of the violation" }, "hint": { "type": "string", "description": "An extra hint to understand the violation" }, "payload": { "type": "object", "additionalProperties": true, "description": "The serialized payload of the violation" } }, "required": [ "propertyPath", "message" ] } }, "detail": { "readOnly": true, "type": "string" }, "description": { "readOnly": true, "type": "string" }, "type": { "readOnly": true, "type": "string" }, "title": { "readOnly": true, "type": [ "string", "null" ] }, "instance": { "readOnly": true, "type": [ "string", "null" ] } } } ], "description": "Unprocessable entity" }, "DefaultBackend-zone.read_zone_settings": { "type": "object", "properties": { "type": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "DefaultBackend-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "type": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "DefaultBackend-zone.write_zone_settings": { "type": "object", "properties": { "type": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "DefaultBackend.jsonld-zone.read_zone_settings": { "type": "object", "properties": { "type": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "DefaultBackend.jsonld-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "type": { "type": "string" }, "id": { "type": "string", "format": "uuid" } } }, "Error": { "type": "object", "description": "A representation of common errors.", "properties": { "title": { "readOnly": true, "description": "A short, human-readable summary of the problem.", "type": [ "string", "null" ] }, "detail": { "readOnly": true, "description": "A human-readable explanation specific to this occurrence of the problem.", "type": [ "string", "null" ] }, "status": { "type": [ "integer", "null" ], "examples": [ 404 ], "default": 400 }, "instance": { "readOnly": true, "description": "A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.", "type": [ "string", "null" ] }, "type": { "readOnly": true, "description": "A URI reference that identifies the problem type", "type": "string" } } }, "Error.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "title": { "readOnly": true, "description": "A short, human-readable summary of the problem.", "type": [ "string", "null" ] }, "detail": { "readOnly": true, "description": "A human-readable explanation specific to this occurrence of the problem.", "type": [ "string", "null" ] }, "status": { "type": [ "integer", "null" ], "examples": [ 404 ], "default": 400 }, "instance": { "readOnly": true, "description": "A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.", "type": [ "string", "null" ] }, "type": { "readOnly": true, "description": "A URI reference that identifies the problem type", "type": "string" }, "description": { "readOnly": true, "type": [ "string", "null" ] } } } ], "description": "A representation of common errors." }, "GeoLocation": { "type": "object", "description": "Geo location of an IP from the MaxMind databases. Region/city/coordinates are null when the database lacks that granularity.", "properties": { "country": { "type": [ "string", "null" ], "description": "ISO 3166-1 alpha-2 country code.", "example": "US" }, "country_name": { "type": [ "string", "null" ], "example": "United States" }, "region": { "type": [ "string", "null" ], "description": "Most specific subdivision (state/region).", "example": "California" }, "city": { "type": [ "string", "null" ], "example": "San Francisco" }, "latitude": { "type": [ "number", "null" ], "format": "float", "example": 37.77 }, "longitude": { "type": [ "number", "null" ], "format": "float", "example": -122.42 }, "accuracy_radius_km": { "type": [ "integer", "null" ], "description": "Radius in km the IP is likely within.", "example": 20 }, "asn": { "type": [ "integer", "null" ], "description": "Autonomous System Number.", "example": 15169 }, "asn_organization": { "type": [ "string", "null" ], "description": "Organization that operates the ASN.", "example": "Google LLC" } } }, "HeaderEntry-zone.read_zone_settings": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": "string" }, "value": { "maxLength": 4096, "type": "string" } } }, "HeaderEntry-zone.read_zone_settings_zone.admin.read": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": "string" }, "value": { "maxLength": 4096, "type": "string" } } }, "HeaderEntry-zone.write_zone_settings": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": "string" }, "value": { "maxLength": 4096, "type": "string" } } }, "HeaderEntry.jsonld-zone.read_zone_settings": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": "string" }, "value": { "maxLength": 4096, "type": "string" } } }, "HeaderEntry.jsonld-zone.read_zone_settings_zone.admin.read": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": "string" }, "value": { "maxLength": 4096, "type": "string" } } }, "HydraCollectionBaseSchema": { "allOf": [ { "$ref": "#/components/schemas/HydraCollectionBaseSchemaNoPagination" }, { "type": "object", "properties": { "view": { "type": "object", "properties": { "@id": { "type": "string", "format": "iri-reference" }, "@type": { "type": "string" }, "first": { "type": [ "string", "null" ], "format": "iri-reference" }, "last": { "type": [ "string", "null" ], "format": "iri-reference" }, "previous": { "type": [ "string", "null" ], "format": "iri-reference" }, "next": { "type": [ "string", "null" ], "format": "iri-reference" } }, "example": { "@id": "string", "@type": "string", "first": "string", "last": "string", "previous": "string", "next": "string" } } } } ] }, "HydraCollectionBaseSchemaNoPagination": { "type": "object", "properties": { "totalItems": { "type": "integer", "minimum": 0 }, "search": { "type": "object", "properties": { "@type": { "type": "string" }, "template": { "type": "string" }, "variableRepresentation": { "type": "string" }, "mapping": { "type": "array", "items": { "type": "object", "properties": { "@type": { "type": "string" }, "variable": { "type": "string" }, "property": { "type": [ "string", "null" ] }, "required": { "type": "boolean" } } } } } } } }, "HydraItemBaseSchema": { "type": "object", "properties": { "@context": { "oneOf": [ { "type": "string" }, { "type": "object", "properties": { "@vocab": { "type": "string" }, "hydra": { "type": "string", "enum": [ "http://www.w3.org/ns/hydra/core#" ] } }, "required": [ "@vocab", "hydra" ], "additionalProperties": true } ] }, "@id": { "type": "string" }, "@type": { "type": "string" } }, "required": [ "@id", "@type" ] }, "Invoice": { "type": "object", "properties": { "handle": { "type": [ "string", "null" ] }, "amount": { "type": [ "integer", "null" ] }, "currency": { "type": [ "string", "null" ] }, "state": { "type": [ "string", "null" ] }, "created": { "type": [ "string", "null" ] }, "downloadUrl": { "type": [ "string", "null" ] }, "paymentMethod": { "anyOf": [ { "$ref": "#/components/schemas/PaymentMethod" }, { "type": "null" } ] } } }, "Invoice.jsonld": { "type": "object", "properties": { "handle": { "type": [ "string", "null" ] }, "amount": { "type": [ "integer", "null" ] }, "currency": { "type": [ "string", "null" ] }, "state": { "type": [ "string", "null" ] }, "created": { "type": [ "string", "null" ] }, "downloadUrl": { "type": [ "string", "null" ] }, "paymentMethod": { "anyOf": [ { "$ref": "#/components/schemas/PaymentMethod.jsonld" }, { "type": "null" } ] } } }, "InvoicePage": { "type": "object", "properties": { "invoices": { "type": "array", "items": { "$ref": "#/components/schemas/Invoice" } }, "nextPageToken": { "type": [ "string", "null" ] } } }, "InvoicePage.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "invoices": { "type": "array", "items": { "$ref": "#/components/schemas/Invoice.jsonld" } }, "nextPageToken": { "type": [ "string", "null" ] } } } ] }, "LoadBalancerOrigin-load_balancer.read": { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "originServer": { "$ref": "#/components/schemas/origin-server-load_balancer.read" }, "weight": { "minimum": 1, "maximum": 1000, "default": 1, "type": "integer" }, "enabled": { "default": true, "type": "boolean" } }, "required": [ "originServer" ] }, "LoadBalancerOrigin-load_balancer.write": { "type": "object", "required": [ "originServer" ], "properties": { "originServer": { "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "weight": { "minimum": 1, "maximum": 1000, "default": 1, "type": "integer" }, "enabled": { "default": true, "type": "boolean" } } }, "LoadBalancerOrigin-load_balancer.write_load_balancer.create": { "type": "object", "required": [ "originServer" ], "properties": { "originServer": { "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "weight": { "minimum": 1, "maximum": 1000, "default": 1, "type": "integer" }, "enabled": { "default": true, "type": "boolean" } } }, "LoadBalancerOrigin.jsonld-load_balancer.read": { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "originServer": { "$ref": "#/components/schemas/origin-server.jsonld-load_balancer.read" }, "weight": { "minimum": 1, "maximum": 1000, "default": 1, "type": "integer" }, "enabled": { "default": true, "type": "boolean" } }, "required": [ "originServer" ] }, "MetricSummary": { "type": "object", "properties": { "total": { "type": "integer" }, "change": { "type": [ "number", "null" ] } } }, "MetricSummary.jsonld": { "type": "object", "properties": { "total": { "type": "integer" }, "change": { "type": [ "number", "null" ] } } }, "PaymentMethod": { "type": "object", "properties": { "id": { "type": [ "string", "null" ] }, "type": { "type": [ "string", "null" ] }, "cardType": { "type": [ "string", "null" ] }, "maskedCard": { "type": [ "string", "null" ] }, "expiry": { "type": [ "string", "null" ] }, "offlineAgreementName": { "type": [ "string", "null" ] } } }, "PaymentMethod.jsonld": { "type": "object", "properties": { "id": { "type": [ "string", "null" ] }, "type": { "type": [ "string", "null" ] }, "cardType": { "type": [ "string", "null" ] }, "maskedCard": { "type": [ "string", "null" ] }, "expiry": { "type": [ "string", "null" ] }, "offlineAgreementName": { "type": [ "string", "null" ] } } }, "SearchResultItem-search.read": { "type": "object", "properties": { "id": { "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "type": "string" }, "organizationId": { "type": [ "integer", "null" ] }, "organizationName": { "type": [ "string", "null" ] }, "zoneId": { "type": [ "integer", "null" ] }, "zoneName": { "type": [ "string", "null" ] } } }, "SearchResultItem.jsonld-search.read": { "type": "object", "properties": { "id": { "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "type": "string" }, "organizationId": { "type": [ "integer", "null" ] }, "organizationName": { "type": [ "string", "null" ] }, "zoneId": { "type": [ "integer", "null" ] }, "zoneName": { "type": [ "string", "null" ] } } }, "StaticCacheKeyConfig-zone.read_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByQueryString": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "StaticCacheKeyConfig-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByQueryString": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "StaticCacheKeyConfig-zone.write_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByQueryString": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "StaticCacheKeyConfig.jsonld-zone.read_zone_settings": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByQueryString": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "StaticCacheKeyConfig.jsonld-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "varyByHostname": { "type": [ "boolean", "null" ] }, "varyByQueryString": { "minItems": 1, "type": [ "array", "null" ], "items": { "type": "string" } } } }, "Subscription": { "type": "object", "properties": { "handle": { "type": [ "string", "null" ] }, "state": { "type": [ "string", "null" ] }, "plan": { "type": [ "string", "null" ] }, "currency": { "type": [ "string", "null" ] }, "amount": { "type": [ "integer", "null" ] }, "amountInclVat": { "type": [ "integer", "null" ] }, "pendingAmount": { "type": [ "integer", "null" ] }, "inTrial": { "type": [ "boolean", "null" ] }, "expires": { "type": [ "string", "null" ] }, "expiredDate": { "type": [ "string", "null" ] }, "nextPeriodStart": { "type": [ "string", "null" ] } } }, "Subscription.jsonld": { "type": "object", "properties": { "handle": { "type": [ "string", "null" ] }, "state": { "type": [ "string", "null" ] }, "plan": { "type": [ "string", "null" ] }, "currency": { "type": [ "string", "null" ] }, "amount": { "type": [ "integer", "null" ] }, "amountInclVat": { "type": [ "integer", "null" ] }, "pendingAmount": { "type": [ "integer", "null" ] }, "inTrial": { "type": [ "boolean", "null" ] }, "expires": { "type": [ "string", "null" ] }, "expiredDate": { "type": [ "string", "null" ] }, "nextPeriodStart": { "type": [ "string", "null" ] } } }, "User-invitation.read_invitation.read.me": { "type": "object", "required": [ "firstName", "lastName" ], "properties": { "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" } } }, "User-organization_member.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the user (UUID v4), generated on creation.", "example": "9f1b6c2e-1e4a-4c3a-9c8b-1d2e3f4a5b6c", "type": "string", "format": "uuid" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the user, unique across all accounts and used as the login identifier. Normalized to lowercase and trimmed on write. Maximum 180 characters.", "externalDocs": { "url": "https://schema.org/email" }, "example": "jane.doe@example.com", "type": "string" }, "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" } }, "required": [ "email", "firstName", "lastName" ] }, "User-user.read_user.read.me": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the user (UUID v4), generated on creation.", "example": "9f1b6c2e-1e4a-4c3a-9c8b-1d2e3f4a5b6c", "type": "string", "format": "uuid" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the user, unique across all accounts and used as the login identifier. Normalized to lowercase and trimmed on write. Maximum 180 characters.", "externalDocs": { "url": "https://schema.org/email" }, "example": "jane.doe@example.com", "type": "string" }, "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" }, "superAdmin": { "description": "Whether the user holds elevated platform-wide privileges. Read-only. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "active": { "description": "Whether the account is active. Inactive accounts are disabled and cannot authenticate. Read-only. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "emailVerified": { "description": "Whether the user has verified their email address. Read-only. Defaults to false.", "default": false, "example": true, "type": "boolean" }, "emailVerifiedAt": { "description": "Timestamp at which the email address was verified, or null if it has not been verified yet. Read-only.", "example": "2025-06-15T10:30:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "hasPassword": { "description": "Whether the user has a local password set. False for accounts created purely via OAuth that have never set a password. Only exposed on the current-user endpoint.", "default": false, "example": true, "type": "boolean" }, "twoFactorEnabled": { "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp at which the account was created. Read-only, set automatically on creation.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp at which the account was last updated. Read-only, refreshed automatically on every change.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "twoFactorEnforced": { "readOnly": true, "description": "True when at least one organization the user belongs to requires 2FA.", "type": "boolean" }, "connectedProviders": { "readOnly": true, "description": "OAuth providers currently linked to this account. Empty when the user has no social logins connected. Only exposed on the current-user endpoint.", "type": "array", "items": { "type": "string", "enum": [ "google", "github" ] }, "example": [ "google" ] } }, "required": [ "email", "firstName", "lastName" ] }, "User.jsonld-invitation.read_invitation.read.me": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "required": [ "firstName", "lastName" ], "properties": { "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" } } } ] }, "User.jsonld-organization_member.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the user (UUID v4), generated on creation.", "example": "9f1b6c2e-1e4a-4c3a-9c8b-1d2e3f4a5b6c", "type": "string", "format": "uuid" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the user, unique across all accounts and used as the login identifier. Normalized to lowercase and trimmed on write. Maximum 180 characters.", "externalDocs": { "url": "https://schema.org/email" }, "example": "jane.doe@example.com", "type": "string" }, "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" } }, "required": [ "email", "firstName", "lastName" ] } ] }, "User.jsonld-user.read_user.read.me": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the user (UUID v4), generated on creation.", "example": "9f1b6c2e-1e4a-4c3a-9c8b-1d2e3f4a5b6c", "type": "string", "format": "uuid" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the user, unique across all accounts and used as the login identifier. Normalized to lowercase and trimmed on write. Maximum 180 characters.", "externalDocs": { "url": "https://schema.org/email" }, "example": "jane.doe@example.com", "type": "string" }, "firstName": { "maxLength": 100, "description": "User's given (first) name. Required, maximum 100 characters.", "example": "Jane", "type": "string" }, "lastName": { "maxLength": 100, "description": "User's family (last) name. Required, maximum 100 characters.", "example": "Doe", "type": "string" }, "superAdmin": { "description": "Whether the user holds elevated platform-wide privileges. Read-only. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "active": { "description": "Whether the account is active. Inactive accounts are disabled and cannot authenticate. Read-only. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "emailVerified": { "description": "Whether the user has verified their email address. Read-only. Defaults to false.", "default": false, "example": true, "type": "boolean" }, "emailVerifiedAt": { "description": "Timestamp at which the email address was verified, or null if it has not been verified yet. Read-only.", "example": "2025-06-15T10:30:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "hasPassword": { "description": "Whether the user has a local password set. False for accounts created purely via OAuth that have never set a password. Only exposed on the current-user endpoint.", "default": false, "example": true, "type": "boolean" }, "twoFactorEnabled": { "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp at which the account was created. Read-only, set automatically on creation.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp at which the account was last updated. Read-only, refreshed automatically on every change.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "twoFactorEnforced": { "readOnly": true, "description": "True when at least one organization the user belongs to requires 2FA.", "type": "boolean" }, "connectedProviders": { "readOnly": true, "description": "OAuth providers currently linked to this account. Empty when the user has no social logins connected. Only exposed on the current-user endpoint.", "type": "array", "items": { "type": "string", "enum": [ "google", "github" ] }, "example": [ "google" ] } }, "required": [ "email", "firstName", "lastName" ] } ] }, "WafCondition": { "type": "object", "description": "A single WAF match condition: one or more request targets, optionally transformed, tested with an operator.", "required": [ "targets", "operator" ], "properties": { "targets": { "type": "array", "minItems": 1, "description": "Request parts to inspect.", "items": { "type": "string", "enum": [ "args", "args.names", "query", "uri", "uri.raw", "headers", "headers.user-agent", "headers.referer", "headers.host", "headers.content-type", "cookies", "body.json", "body.form", "body.raw", "ip", "method", "host", "geoip.country", "geoip.asn" ] } }, "transforms": { "type": "array", "description": "Transformations applied to each target value, in order, before the operator runs.", "items": { "type": "string", "enum": [ "lowercase", "uppercase", "urlDecode", "urlDecodeUni", "htmlEntityDecode", "base64Decode", "normalizePath", "removeNulls", "removeWhitespace", "compressWhitespace", "length" ] } }, "operator": { "type": "string", "enum": [ "rx", "detectSQLi", "detectXSS", "contains", "streq", "beginsWith", "endsWith", "pm", "within", "ipMatch", "ge", "gt", "le", "lt", "eq" ], "description": "Match operator. detectSQLi/detectXSS use libinjection and need no pattern; every other operator requires \"pattern\"." }, "pattern": { "type": "string", "description": "Operator argument. Required for every operator except detectSQLi and detectXSS." }, "negate": { "type": "boolean", "description": "Invert the condition result." } }, "example": { "targets": [ "uri", "args" ], "transforms": [ "lowercase", "urlDecode" ], "operator": "rx", "pattern": "(?i)union\\s+select", "negate": false } }, "WafConditionList": { "type": "array", "description": "Ordered list of WAF match conditions, combined per the rule's \"match\" mode (all/any).", "items": { "$ref": "#/components/schemas/WafCondition" } }, "Zone-zone.admin.jsonMergePatch": { "type": "object", "properties": { "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" } } }, "Zone-zone.read_zone.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cdnId": { "description": "Identifier of the CDN this zone is bound to. Read-only.", "example": 7, "type": [ "integer", "null" ] }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] }, "Zone-zone.read_zone_settings": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend-zone.read_zone_settings" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig-zone.read_zone_settings" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig-zone.read_zone_settings" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader-zone.read_zone_settings" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user-zone.read_zone_settings" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings" } }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] }, "Zone-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend-zone.read_zone_settings_zone.admin.read" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig-zone.read_zone_settings_zone.admin.read" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig-zone.read_zone_settings_zone.admin.read" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader-zone.read_zone_settings_zone.admin.read" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user-zone.read_zone_settings_zone.admin.read" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cdnId": { "description": "Identifier of the CDN this zone is bound to. Read-only.", "example": 7, "type": [ "integer", "null" ] }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings_zone.admin.read" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings_zone.admin.read" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.read_zone_settings_zone.admin.read" } }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] }, "Zone-zone.write_zone_settings": { "type": "object", "required": [ "organization", "name", "tag" ], "properties": { "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend-zone.write_zone_settings" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig-zone.write_zone_settings" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig-zone.write_zone_settings" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader-zone.write_zone_settings" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user-zone.write_zone_settings" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } } } }, "Zone-zone.write_zone_settings.jsonMergePatch": { "type": "object", "properties": { "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend-zone.write_zone_settings" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig-zone.write_zone_settings" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig-zone.write_zone_settings" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader-zone.write_zone_settings" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user-zone.write_zone_settings" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry-zone.write_zone_settings" } } } }, "Zone.jsonld-zone.read_zone.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cdnId": { "description": "Identifier of the CDN this zone is bound to. Read-only.", "example": 7, "type": [ "integer", "null" ] }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] } ] }, "Zone.jsonld-zone.read_zone_settings": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend.jsonld-zone.read_zone_settings" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig.jsonld-zone.read_zone_settings" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig.jsonld-zone.read_zone_settings" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader.jsonld-zone.read_zone_settings" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user.jsonld-zone.read_zone_settings" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings" } }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] } ] }, "Zone.jsonld-zone.read_zone_settings_zone.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the zone.", "example": 42, "type": "integer" }, "organization": { "description": "The organization that owns this zone, as an IRI. Required on creation.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "name": { "maxLength": 255, "description": "Human-readable zone name. Must be unique together with `tag` within the organization. Max 255 characters.", "example": "my-website", "type": "string" }, "tag": { "default": "prod", "type": "string", "enum": [ "prod", "stage", "dev" ], "description": "Environment tag used to categorize the zone. Defaults to `prod`. Must be unique together with `name` within the organization.", "example": "prod" }, "banToken": { "readOnly": true, "description": "Read-only secret token used to authorize BAN/PURGE cache-invalidation requests for this zone. Generated automatically at creation.", "example": "smoxy_ban_3f8c1a2b4d5e6f70819a2b3c4d5e6f708192a3b4c5d6e7f809a1b2c3d4e5f607", "type": "string" }, "createdAt": { "readOnly": true, "description": "Timestamp when the zone was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the zone was last updated (ISO 8601).", "example": "2026-01-20T14:05:00+00:00", "type": "string", "format": "date-time" }, "rewriteRules": { "readOnly": true, "description": "Rewrite rules attached to this zone, as IRIs. Read-only here; managed via the dedicated rewrite-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "configurationRules": { "readOnly": true, "description": "Configuration rules attached to this zone, as IRIs. Read-only here; managed via the dedicated configuration-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "accessRules": { "readOnly": true, "description": "Access rules attached to this zone, as IRIs. Read-only here; managed via the dedicated access-rule endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "securityScenarios": { "readOnly": true, "description": "Security scenarios attached to this zone, as IRIs. Read-only here; managed via the dedicated scenario endpoints.", "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } }, "enabled": { "description": "Whether the zone is enabled. When false the zone serves no traffic through the proxy. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "hasRedirects": { "description": "Whether the zone has a path-level redirect map. Maintained by the redirect-map import; read-only here. Gates the edge redirect lookup.", "default": false, "example": false, "type": "boolean" }, "defaultBackend": { "$ref": "#/components/schemas/DefaultBackend.jsonld-zone.read_zone_settings_zone.admin.read" }, "cachingDynamicEnabled": { "description": "Whether dynamic (HTML/JSON/XML) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingRespectCacheControl": { "description": "Whether origin `Cache-Control`/`Expires` headers are respected when deciding cache freshness. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingDynamicCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/CacheKeyConfig.jsonld-zone.read_zone_settings_zone.admin.read" }, { "type": "null" } ] }, "cachingStaticEnabled": { "description": "Whether static-asset (images/CSS/JS) caching is enabled for the zone. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cachingStaticCacheKey": { "anyOf": [ { "$ref": "#/components/schemas/StaticCacheKeyConfig.jsonld-zone.read_zone_settings_zone.admin.read" }, { "type": "null" } ] }, "cachingDefaultTtl": { "minimum": 0, "maximum": 31536000, "description": "Default cache TTL in seconds applied when the origin does not dictate one. Between 0 and 31536000 (1 year). Defaults to 604800 (7 days).", "default": 604800, "example": 604800, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "cachingIgnoredUrlParams": { "maxItems": 150, "uniqueItems": true, "description": "Query-string parameter names stripped from the URL before cache-key computation. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "utm_source", "utm_medium", "gclid" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingManagedIgnoredUrlParamsEnabled": { "description": "Whether the platform-managed list of ignored URL parameters is additionally stripped from the URL before cache-key computation. Managed entries are combined with cachingIgnoredUrlParams. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "cachingIgnoredCacheTags": { "maxItems": 150, "uniqueItems": true, "description": "Cache-tag values ignored when tagging cached responses. Unique entries, each up to 255 characters, at most 150 entries. Values are trimmed on save.", "example": [ "internal", "debug" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "cachingCustomCacheTagHeaders": { "type": "array", "items": { "$ref": "#/components/schemas/CacheTagHeader.jsonld-zone.read_zone_settings_zone.admin.read" } }, "headersResponseRemove": { "maxItems": 50, "description": "Response header names removed from responses before they are sent to the client. Each name may only contain characters allowed in HTTP header names (letters, digits and ! # $ % & ' * + . ^ _ ` | ~ -), up to 255 characters. Unique entries (compared case-insensitively), at most 50 entries. Values are trimmed on save. Headers required for correct response delivery (content-type, content-length, transfer-encoding, content-encoding, connection, upgrade, trailer) cannot be removed.", "example": [ "X-Powered-By", "X-Generator" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "debugHeadersEnabled": { "description": "Whether the proxy emits debug headers (e.g. cache status) on responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "serverTimingEnabled": { "description": "Whether Server-Timing response headers are emitted for performance diagnostics. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stripCacheTagHeaders": { "description": "Whether the custom cache tag headers defined for the zone are stripped from responses before they are sent to the client. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingSsi": { "description": "Whether Server Side Includes (SSI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "processingEsi": { "description": "Whether Edge Side Includes (ESI) processing is enabled. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "compressionCodecs": { "uniqueItems": true, "description": "Additional compression codecs enabled for responses delivered to clients. `br` (Brotli) and `gzip` are always active and cannot be disabled; the only accepted entry is `zstd`, which additionally offers Zstandard to clients that support it. For each response the best codec the client accepts is used (preference `zstd`, then `br`, then `gzip`). Newly created zones default to `[\"zstd\"]`. Send null or an empty list to disable zstd again. Entries are unique and trimmed on save. Changing this requires no cache clear.", "default": [ "zstd" ], "type": "array", "items": { "type": "string", "enum": [ "zstd" ] }, "example": [ "zstd" ] }, "underAttack": { "description": "Manual \"under attack\" panic switch. When true all visitors are challenged. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesErrorEnabled": { "description": "Whether the custom error page is served for error responses. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesMaintenanceActive": { "description": "Whether maintenance mode is active, serving the custom maintenance page. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesSecurityEnabled": { "description": "Whether the custom security (block) page is served for blocked requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "customPagesChallengeEnabled": { "description": "Whether the custom challenge page is served for challenged requests. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "basicAuthEnabled": { "description": "Whether HTTP Basic authentication is enforced on the zone. Null means unset (inherits the default). Credentials are managed via `basicAuthUsers`.", "example": false, "type": [ "boolean", "null" ] }, "basicAuthUsers": { "type": "array", "items": { "$ref": "#/components/schemas/basic-auth-user.jsonld-zone.read_zone_settings_zone.admin.read" }, "readOnly": true }, "securityEnabled": { "description": "Whether the security/WAF layer is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationEnabled": { "description": "Whether image optimization is enabled for the zone. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationWebpEnabled": { "description": "Whether images are re-encoded to WebP where supported. Null means unset (inherits the default).", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifEnabled": { "description": "Whether images are re-encoded to AVIF where supported. Null means unset (inherits the default). New zones default to true.", "example": true, "type": [ "boolean", "null" ] }, "imageOptimizationAvifQuality": { "minimum": 1, "maximum": 100, "description": "AVIF output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationWebpQuality": { "minimum": 1, "maximum": 100, "description": "WebP output quality, 1-100 (higher is better quality). New zones default to 50.", "example": 50, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityTarget": { "minimum": 0.0001, "maximum": 0.9999, "description": "Target JPEG quality as a fraction between 0.0001 and 0.9999 (higher is better quality). New zones default to 0.9997.", "example": 0.9997, "type": [ "number", "null" ] }, "imageOptimizationJpegEnabled": { "description": "Whether JPEG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationJpegQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationJpegQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationJpegQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationJpegQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "imageOptimizationPngEnabled": { "description": "Whether PNG images are recompressed when image optimization is enabled. New zones default to false.", "example": false, "type": [ "boolean", "null" ] }, "imageOptimizationPngQualityMin": { "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality, 10-100 (higher is better quality). Must not exceed `imageOptimizationPngQualityMax`. New zones default to 40.", "example": 40, "type": [ "integer", "null" ] }, "imageOptimizationPngQualityMax": { "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality, 10-100 (higher is better quality). Must be greater than or equal to `imageOptimizationPngQualityMin`. New zones default to 98.", "example": 98, "type": [ "integer", "null" ] }, "minifyHtml": { "description": "Whether HTML responses are minified. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cdnId": { "description": "Identifier of the CDN this zone is bound to. Read-only.", "example": 7, "type": [ "integer", "null" ] }, "staleCacheWhileOffline": { "description": "Whether stale cached content is served while the origin is offline. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "staleCacheWhileUpdating": { "description": "Whether stale cached content is served while a fresh copy is being fetched (stale-while-revalidate). Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheErrorResponse": { "description": "Whether error responses from the origin are cached. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "cacheControlPublicMaxAgeOverride": { "minimum": -1, "maximum": 31536000, "description": "Maximum age (in seconds) of the browser-side cache for responses delivered by smoxy, sent to clients as the Cache-Control max-age. When set, it overrides any max-age returned by the origin and the default TTL of the zone. -1 disables the override so browsers follow the server-side cache expiration; 0 instructs browsers not to cache. Between -1 and 31536000 (1 year). Defaults to -1.", "default": -1, "example": 3600, "type": "integer" }, "maxRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of rules (access + rewrite + configuration) allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 30.", "default": 30, "example": 30, "type": "integer" }, "maxWafRules": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of WAF rules allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "maxScenarios": { "minimum": 0, "exclusiveMinimum": 0, "description": "Maximum number of security scenarios allowed on the zone. Read-only; it may not be lowered below the number currently in use. Defaults to 3.", "default": 3, "example": 3, "type": "integer" }, "logForwardingEnabled": { "description": "Whether access logs are forwarded to an external endpoint. When true, `logForwardingHostname`, `logForwardingPort`, `logForwardingProtocol` and `logForwardingFormat` are all required. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "logForwardingHostname": { "maxLength": 255, "description": "Hostname or IP of the log-forwarding endpoint. Required when log forwarding is enabled. Max 255 characters. Private/forbidden IP ranges are rejected.", "example": "logs.example.com", "type": [ "string", "null" ] }, "logForwardingPort": { "minimum": 1, "maximum": 65535, "description": "Port of the log-forwarding endpoint, 1-65535. Required when log forwarding is enabled.", "example": 514, "type": [ "integer", "null" ] }, "logForwardingToken": { "maxLength": 255, "description": "Optional authentication token sent to the log-forwarding endpoint (e.g. a Datadog API key). Max 255 characters.", "example": "abc123def456", "type": [ "string", "null" ] }, "logForwardingProtocol": { "type": [ "string", "null" ], "enum": [ "udp", "tcp", "tcp_encrypted", "datadog", null ], "description": "Transport protocol used to forward logs. Required when log forwarding is enabled; null when it is disabled.", "example": "tcp" }, "logForwardingFormat": { "type": [ "string", "null" ], "enum": [ "plain", "json", null ], "description": "Payload format for forwarded logs. Required when log forwarding is enabled; null when it is disabled.", "example": "json" }, "createdBy": { "readOnly": true, "description": "The zone creator, exposed as their organization-member IRI (/api/organizations/{orgId}/members/{id}). Null when the creator is no longer a member of the organization.", "example": "/api/organizations/1/members/5", "type": [ "string", "null" ], "format": "iri-reference" }, "headersRequestSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings_zone.admin.read" } }, "headersResponseSet": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings_zone.admin.read" } }, "headersResponseAdd": { "type": "array", "items": { "$ref": "#/components/schemas/HeaderEntry.jsonld-zone.read_zone_settings_zone.admin.read" } }, "rulesUsed": { "readOnly": true, "description": "Number of rules currently in use (access + rewrite + configuration rules), counted against `maxRules`.", "example": 5, "type": "integer" }, "wafRulesUsed": { "readOnly": true, "description": "Number of WAF rules currently in use, counted against `maxWafRules`.", "example": 1, "type": "integer" }, "scenariosUsed": { "readOnly": true, "description": "Number of security scenarios currently in use, counted against `maxScenarios`.", "example": 2, "type": "integer" } }, "required": [ "organization", "name", "tag" ] } ] }, "access-rule-access_rule.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the access rule.", "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "type": "string", "format": "uuid" }, "zone": { "description": "The zone this access rule belongs to. Determined by the request URL and cannot be changed.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the rule. Required, up to 255 characters, and must be unique within the zone.", "example": "Block office IP range", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description explaining the purpose of the rule. Up to 5000 characters.", "example": "Blocks traffic originating from the corporate office subnet.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/AccessRuleConditionGroup" }, "action": { "type": "string", "enum": [ "allow", "block", "challenge", "skip" ], "description": "Action to take when conditions match", "example": "block" }, "skipTargets": { "type": "array", "nullable": true, "items": { "type": "string", "enum": [ "waf", "rateLimiting", "challenge" ] }, "description": "Security features to skip (required when action is 'skip')", "example": [ "waf", "rateLimiting" ] }, "order": { "description": "Execution order of the rule within the zone. Rules are returned sorted by this value in descending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are retained but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, no further access rules are evaluated after this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created (read-only).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated (read-only).", "example": "2026-01-20T14:45:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "conditions", "action" ] }, "access-rule-access_rule.write": { "type": "object", "required": [ "name", "conditions", "action" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the rule. Required, up to 255 characters, and must be unique within the zone.", "example": "Block office IP range", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description explaining the purpose of the rule. Up to 5000 characters.", "example": "Blocks traffic originating from the corporate office subnet.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/AccessRuleConditionGroup" }, "action": { "type": "string", "enum": [ "allow", "block", "challenge", "skip" ], "description": "Action to take when conditions match", "example": "block" }, "skipTargets": { "type": "array", "nullable": true, "items": { "type": "string", "enum": [ "waf", "rateLimiting", "challenge" ] }, "description": "Security features to skip (required when action is 'skip')", "example": [ "waf", "rateLimiting" ] }, "order": { "description": "Execution order of the rule within the zone. Rules are returned sorted by this value in descending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are retained but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, no further access rules are evaluated after this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "access-rule-access_rule.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the rule. Required, up to 255 characters, and must be unique within the zone.", "example": "Block office IP range", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description explaining the purpose of the rule. Up to 5000 characters.", "example": "Blocks traffic originating from the corporate office subnet.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/AccessRuleConditionGroup" }, "action": { "type": "string", "enum": [ "allow", "block", "challenge", "skip" ], "description": "Action to take when conditions match", "example": "block" }, "skipTargets": { "type": "array", "nullable": true, "items": { "type": "string", "enum": [ "waf", "rateLimiting", "challenge" ] }, "description": "Security features to skip (required when action is 'skip')", "example": [ "waf", "rateLimiting" ] }, "order": { "description": "Execution order of the rule within the zone. Rules are returned sorted by this value in descending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are retained but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, no further access rules are evaluated after this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "access-rule.jsonld-access_rule.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the access rule.", "example": "3fa85f64-5717-4562-b3fc-2c963f66afa6", "type": "string", "format": "uuid" }, "zone": { "description": "The zone this access rule belongs to. Determined by the request URL and cannot be changed.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the rule. Required, up to 255 characters, and must be unique within the zone.", "example": "Block office IP range", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description explaining the purpose of the rule. Up to 5000 characters.", "example": "Blocks traffic originating from the corporate office subnet.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/AccessRuleConditionGroup" }, "action": { "type": "string", "enum": [ "allow", "block", "challenge", "skip" ] }, "skipTargets": { "type": [ "array", "null" ], "items": { "type": "string" } }, "order": { "description": "Execution order of the rule within the zone. Rules are returned sorted by this value in descending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are retained but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, no further access rules are evaluated after this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created (read-only).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated (read-only).", "example": "2026-01-20T14:45:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "conditions", "action" ] } ] }, "allow-allow.read": { "type": "object", "properties": { "origin": { "description": "Entry origin: `manual` entries are admin-managed; `remote` entries are synced from machine-fetched CDN/proxy lists and are read-only (no item GET/DELETE).", "default": "manual", "type": "string", "enum": [ "manual", "remote" ], "example": "manual" }, "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] }, "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier for the entry: base64url of the source string (so dots and CIDR slashes are safe in a path segment).", "example": "MjAzLjAuMTEzLjU", "type": "string" } }, "required": [ "source" ] }, "allow-allow.write": { "type": "object", "required": [ "source", "type" ], "properties": { "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" } } }, "allow.jsonld-allow.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "origin": { "description": "Entry origin: `manual` entries are admin-managed; `remote` entries are synced from machine-fetched CDN/proxy lists and are read-only (no item GET/DELETE).", "default": "manual", "type": "string", "enum": [ "manual", "remote" ], "example": "manual" }, "geo": { "description": "Transient - geo of the source IP, populated by the providers on read for\n`type=ip` entries only.", "type": [ "object", "null" ], "additionalProperties": { "anyOf": [ { "type": "number" }, { "type": "integer" }, { "type": "string" }, { "type": "null" } ] } }, "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier for the entry: base64url of the source string (so dots and CIDR slashes are safe in a path segment).", "example": "MjAzLjAuMTEzLjU", "type": "string" } }, "required": [ "source" ] } ], "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] } } }, "api-token-api_token.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the API token (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the token, used to identify it in listings. Must be non-blank, at most 255 characters, and unique among the owning user's tokens.", "example": "CI deployment token", "type": "string" }, "lastUsedAt": { "description": "Timestamp of the most recent successful authentication with this token, or null if it has never been used.", "example": "2026-06-30T14:23:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "expiresAt": { "description": "Optional expiration date. When set it must be in the future and no more than 2 years ahead. When null, the token never expires. Once this date has passed the token is treated as expired and rejected during authentication.", "example": "2027-06-30T00:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "active": { "description": "Whether the token is enabled. Defaults to true. An inactive (or expired) token is rejected during authentication.", "default": true, "example": true, "type": "boolean" }, "readOnly": { "description": "Whether the token is restricted to read operations. When true, only safe HTTP methods (GET, HEAD, OPTIONS) are accepted and any write request is rejected with 403 Forbidden. Defaults to false and cannot be changed after creation.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the token was created. Set automatically on creation.", "example": "2026-06-30T09:00:00+00:00", "type": "string", "format": "date-time" }, "organizations": { "description": "Organizations this token is restricted to, given as organization IRIs. An empty array means the token has access to every organization the owning user is a member of. When creating a token the requesting user must be a member of each listed organization.", "example": [ "/api/organizations/12", "/api/organizations/34" ], "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } } }, "required": [ "name" ] }, "api-token-api_token.read_api_token.read.create": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the API token (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the token, used to identify it in listings. Must be non-blank, at most 255 characters, and unique among the owning user's tokens.", "example": "CI deployment token", "type": "string" }, "plainToken": { "description": "The full secret API token, prefixed with `smoxy_live_`. Present only in the response to token creation and returned exactly once - it is stored hashed on the server and can never be retrieved again. Send it as a Bearer token to authenticate API requests.", "example": "smoxy_live_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": [ "string", "null" ] }, "lastUsedAt": { "description": "Timestamp of the most recent successful authentication with this token, or null if it has never been used.", "example": "2026-06-30T14:23:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "expiresAt": { "description": "Optional expiration date. When set it must be in the future and no more than 2 years ahead. When null, the token never expires. Once this date has passed the token is treated as expired and rejected during authentication.", "example": "2027-06-30T00:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "active": { "description": "Whether the token is enabled. Defaults to true. An inactive (or expired) token is rejected during authentication.", "default": true, "example": true, "type": "boolean" }, "readOnly": { "description": "Whether the token is restricted to read operations. When true, only safe HTTP methods (GET, HEAD, OPTIONS) are accepted and any write request is rejected with 403 Forbidden. Defaults to false and cannot be changed after creation.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the token was created. Set automatically on creation.", "example": "2026-06-30T09:00:00+00:00", "type": "string", "format": "date-time" }, "organizations": { "description": "Organizations this token is restricted to, given as organization IRIs. An empty array means the token has access to every organization the owning user is a member of. When creating a token the requesting user must be a member of each listed organization.", "example": [ "/api/organizations/12", "/api/organizations/34" ], "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } } }, "required": [ "name" ] }, "api-token-api_token.write": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable label for the token, used to identify it in listings. Must be non-blank, at most 255 characters, and unique among the owning user's tokens.", "example": "CI deployment token", "type": "string" }, "expiresAt": { "description": "Optional expiration date. When set it must be in the future and no more than 2 years ahead. When null, the token never expires. Once this date has passed the token is treated as expired and rejected during authentication.", "example": "2027-06-30T00:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "readOnly": { "description": "Whether the token is restricted to read operations. When true, only safe HTTP methods (GET, HEAD, OPTIONS) are accepted and any write request is rejected with 403 Forbidden. Defaults to false and cannot be changed after creation.", "default": false, "example": false, "type": "boolean" }, "organizations": { "description": "Organizations this token is restricted to, given as organization IRIs. An empty array means the token has access to every organization the owning user is a member of. When creating a token the requesting user must be a member of each listed organization.", "example": [ "/api/organizations/12", "/api/organizations/34" ], "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } } } }, "api-token.jsonld-api_token.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the API token (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the token, used to identify it in listings. Must be non-blank, at most 255 characters, and unique among the owning user's tokens.", "example": "CI deployment token", "type": "string" }, "lastUsedAt": { "description": "Timestamp of the most recent successful authentication with this token, or null if it has never been used.", "example": "2026-06-30T14:23:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "expiresAt": { "description": "Optional expiration date. When set it must be in the future and no more than 2 years ahead. When null, the token never expires. Once this date has passed the token is treated as expired and rejected during authentication.", "example": "2027-06-30T00:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "active": { "description": "Whether the token is enabled. Defaults to true. An inactive (or expired) token is rejected during authentication.", "default": true, "example": true, "type": "boolean" }, "readOnly": { "description": "Whether the token is restricted to read operations. When true, only safe HTTP methods (GET, HEAD, OPTIONS) are accepted and any write request is rejected with 403 Forbidden. Defaults to false and cannot be changed after creation.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the token was created. Set automatically on creation.", "example": "2026-06-30T09:00:00+00:00", "type": "string", "format": "date-time" }, "organizations": { "description": "Organizations this token is restricted to, given as organization IRIs. An empty array means the token has access to every organization the owning user is a member of. When creating a token the requesting user must be a member of each listed organization.", "example": [ "/api/organizations/12", "/api/organizations/34" ], "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } } }, "required": [ "name" ] } ] }, "api-token.jsonld-api_token.read_api_token.read.create": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the API token (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the token, used to identify it in listings. Must be non-blank, at most 255 characters, and unique among the owning user's tokens.", "example": "CI deployment token", "type": "string" }, "plainToken": { "description": "The full secret API token, prefixed with `smoxy_live_`. Present only in the response to token creation and returned exactly once - it is stored hashed on the server and can never be retrieved again. Send it as a Bearer token to authenticate API requests.", "example": "smoxy_live_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b", "type": [ "string", "null" ] }, "lastUsedAt": { "description": "Timestamp of the most recent successful authentication with this token, or null if it has never been used.", "example": "2026-06-30T14:23:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "expiresAt": { "description": "Optional expiration date. When set it must be in the future and no more than 2 years ahead. When null, the token never expires. Once this date has passed the token is treated as expired and rejected during authentication.", "example": "2027-06-30T00:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "active": { "description": "Whether the token is enabled. Defaults to true. An inactive (or expired) token is rejected during authentication.", "default": true, "example": true, "type": "boolean" }, "readOnly": { "description": "Whether the token is restricted to read operations. When true, only safe HTTP methods (GET, HEAD, OPTIONS) are accepted and any write request is rejected with 403 Forbidden. Defaults to false and cannot be changed after creation.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the token was created. Set automatically on creation.", "example": "2026-06-30T09:00:00+00:00", "type": "string", "format": "date-time" }, "organizations": { "description": "Organizations this token is restricted to, given as organization IRIs. An empty array means the token has access to every organization the owning user is a member of. When creating a token the requesting user must be a member of each listed organization.", "example": [ "/api/organizations/12", "/api/organizations/34" ], "type": "array", "items": { "type": "string", "format": "iri-reference", "example": "https://example.com/" } } }, "required": [ "name" ] } ] }, "app-log": { "type": "object", "properties": { "ts": { "type": "string" }, "level": { "type": "string" }, "service": { "type": "string" }, "box": { "type": "string" }, "env": { "type": "string" }, "zone_id": { "type": "string" }, "request_id": { "type": "string" }, "module": { "type": "string" }, "msg": { "type": "string" }, "fields": { "type": "object" }, "category": { "type": "string" } } }, "app-log.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "fields": { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } } } } ] }, "audit-log-audit_log.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the audit log entry (UUID v7, time-ordered).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "userId": { "description": "UUID of the user who performed the action, or null for system or unauthenticated changes.", "example": "0192f8a1-4b2c-7d3e-8f10-abcdef012345", "type": [ "string", "null" ], "format": "uuid" }, "userEmail": { "description": "Email address of the acting user, captured at the time of the change. Null when unavailable.", "example": "jane@example.com", "type": [ "string", "null" ] }, "userDisplayName": { "description": "Display name of the acting user, captured at the time of the change. Null when unavailable.", "example": "Jane Doe", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "create", "update", "delete" ], "description": "The kind of change recorded. `create` - the entity was created. `update` - the entity was modified (see `changes` for the field diff). `delete` - the entity was deleted (see `changes` for the pre-deletion snapshot).", "example": "update" }, "zoneId": { "description": "Denormalised zone id the change occurred in, for zone-scoped audited entities (Zone, AccessRule, ConfigurationRule, RewriteRule, BasicAuthUser and optionally Hostname). Null for entities that are not zone-scoped. Not a foreign key: it retains the historical zone id even after the zone is deleted.", "example": 42, "type": [ "integer", "null" ] }, "entityType": { "description": "Type of the audited entity in kebab-case, e.g. `zone`, `access-rule`, `basic-auth-user`, `certificate`, `redirect`.", "example": "zone", "type": "string" }, "entityId": { "description": "Identifier of the audited entity as a string: a UUID for UUID-keyed entities, otherwise the numeric id.", "example": "128", "type": "string" }, "entityLabel": { "description": "Human-readable label for the audited entity captured at the time of the change (e.g. a zone hostname or a username), so the row is displayable without dereferencing the entity. Null when no label applies.", "example": "shop.example.com", "type": [ "string", "null" ] }, "changes": { "type": "object", "nullable": true, "additionalProperties": true, "description": "What changed. For `update` actions, a per-field diff mapping each changed field to its old and new value (`{\"field\": {\"old\": ..., \"new\": ...}}`). For `delete` actions, a full snapshot of the entity as it was before deletion. Null for `create` actions. Sensitive fields (passwords, private keys, tokens) are redacted.", "example": { "name": { "old": "Old name", "new": "New name" } } }, "ipAddress": { "description": "Client IP address recorded for the change (IPv4 or IPv6). Null when unavailable.", "example": "203.0.113.7", "type": [ "string", "null" ] }, "createdAt": { "description": "Timestamp when the change was recorded, with microsecond precision (ISO 8601, UTC).", "example": "2026-01-16T12:00:00.123456+00:00", "type": [ "string", "null" ], "format": "date-time" } } }, "audit-log.jsonld-audit_log.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the audit log entry (UUID v7, time-ordered).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "userId": { "description": "UUID of the user who performed the action, or null for system or unauthenticated changes.", "example": "0192f8a1-4b2c-7d3e-8f10-abcdef012345", "type": [ "string", "null" ], "format": "uuid" }, "userEmail": { "description": "Email address of the acting user, captured at the time of the change. Null when unavailable.", "example": "jane@example.com", "type": [ "string", "null" ] }, "userDisplayName": { "description": "Display name of the acting user, captured at the time of the change. Null when unavailable.", "example": "Jane Doe", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "create", "update", "delete" ], "description": "The kind of change recorded. `create` - the entity was created. `update` - the entity was modified (see `changes` for the field diff). `delete` - the entity was deleted (see `changes` for the pre-deletion snapshot).", "example": "update" }, "zoneId": { "description": "Denormalised zone id the change occurred in, for zone-scoped audited entities (Zone, AccessRule, ConfigurationRule, RewriteRule, BasicAuthUser and optionally Hostname). Null for entities that are not zone-scoped. Not a foreign key: it retains the historical zone id even after the zone is deleted.", "example": 42, "type": [ "integer", "null" ] }, "entityType": { "description": "Type of the audited entity in kebab-case, e.g. `zone`, `access-rule`, `basic-auth-user`, `certificate`, `redirect`.", "example": "zone", "type": "string" }, "entityId": { "description": "Identifier of the audited entity as a string: a UUID for UUID-keyed entities, otherwise the numeric id.", "example": "128", "type": "string" }, "entityLabel": { "description": "Human-readable label for the audited entity captured at the time of the change (e.g. a zone hostname or a username), so the row is displayable without dereferencing the entity. Null when no label applies.", "example": "shop.example.com", "type": [ "string", "null" ] }, "changes": { "type": "object", "nullable": true, "additionalProperties": true, "description": "What changed. For `update` actions, a per-field diff mapping each changed field to its old and new value (`{\"field\": {\"old\": ..., \"new\": ...}}`). For `delete` actions, a full snapshot of the entity as it was before deletion. Null for `create` actions. Sensitive fields (passwords, private keys, tokens) are redacted.", "example": { "name": { "old": "Old name", "new": "New name" } } }, "ipAddress": { "description": "Client IP address recorded for the change (IPv4 or IPv6). Null when unavailable.", "example": "203.0.113.7", "type": [ "string", "null" ] }, "createdAt": { "description": "Timestamp when the change was recorded, with microsecond precision (ISO 8601, UTC).", "example": "2026-01-16T12:00:00.123456+00:00", "type": [ "string", "null" ], "format": "date-time" } } } ] }, "basic-auth-user-basic_auth_user.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "zone": { "description": "The zone this basic auth user belongs to. Read-only; the zone is derived from the request URI.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" }, "comment": { "maxLength": 1000, "description": "Optional free-text note describing this user (e.g. its purpose or owner). Up to 1000 characters.", "example": "Read-only access for the analytics team", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the user was created (ISO 8601). Read-only, set automatically.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the user was last updated (ISO 8601). Read-only, set automatically.", "example": "2026-01-16T14:05:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "zone", "username" ] }, "basic-auth-user-basic_auth_user.write": { "type": "object", "required": [ "username" ], "properties": { "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" }, "plainPassword": { "minLength": 8, "maxLength": 255, "description": "Plaintext password, used for input only. It is hashed server-side and never persisted or returned. Between 8 and 255 characters. Required when creating a user; on update, omit it to keep the current password.", "example": "s3cr3tP@ssw0rd", "type": [ "string", "null" ] }, "comment": { "maxLength": 1000, "description": "Optional free-text note describing this user (e.g. its purpose or owner). Up to 1000 characters.", "example": "Read-only access for the analytics team", "type": [ "string", "null" ] } } }, "basic-auth-user-basic_auth_user.write.jsonMergePatch": { "type": "object", "properties": { "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" }, "plainPassword": { "minLength": 8, "maxLength": 255, "description": "Plaintext password, used for input only. It is hashed server-side and never persisted or returned. Between 8 and 255 characters. Required when creating a user; on update, omit it to keep the current password.", "example": "s3cr3tP@ssw0rd", "type": [ "string", "null" ] }, "comment": { "maxLength": 1000, "description": "Optional free-text note describing this user (e.g. its purpose or owner). Up to 1000 characters.", "example": "Read-only access for the analytics team", "type": [ "string", "null" ] } } }, "basic-auth-user-zone.read_zone_settings": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" } }, "required": [ "username" ] }, "basic-auth-user-zone.read_zone_settings_zone.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" } }, "required": [ "username" ] }, "basic-auth-user-zone.write_zone_settings": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" } }, "required": [ "username" ] }, "basic-auth-user.jsonld-basic_auth_user.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "zone": { "description": "The zone this basic auth user belongs to. Read-only; the zone is derived from the request URI.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" }, "comment": { "maxLength": 1000, "description": "Optional free-text note describing this user (e.g. its purpose or owner). Up to 1000 characters.", "example": "Read-only access for the analytics team", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the user was created (ISO 8601). Read-only, set automatically.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the user was last updated (ISO 8601). Read-only, set automatically.", "example": "2026-01-16T14:05:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "zone", "username" ] } ] }, "basic-auth-user.jsonld-zone.read_zone_settings": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" } }, "required": [ "username" ] } ] }, "basic-auth-user.jsonld-zone.read_zone_settings_zone.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the basic auth user (UUID v4). Read-only, generated on creation.", "example": "9f8b2c1a-4d3e-4f5a-8b6c-7d8e9f0a1b2c", "type": "string", "format": "uuid" }, "username": { "minLength": 1, "maxLength": 255, "description": "Login username for HTTP Basic Authentication. Required, 1-255 characters, and must be unique within the zone. Leading and trailing whitespace is trimmed.", "example": "jdoe", "type": "string" } }, "required": [ "username" ] } ] }, "billing": { "type": "object", "properties": { "customerExists": { "default": false, "type": "boolean" }, "hasSubscription": { "default": false, "type": "boolean" }, "subscriptionStatus": { "type": [ "string", "null" ] }, "planHandle": { "description": "Plan handle: 'smoxy' when subscribed, 'free' otherwise.", "default": "free", "type": "string" }, "checkoutSessionId": { "type": [ "string", "null" ] } } }, "billing.SubscribeInput": { "type": "object", "properties": { "customer": { "anyOf": [ { "$ref": "#/components/schemas/BillingCustomerInput" }, { "type": "null" } ] } } }, "billing.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "customerExists": { "default": false, "type": "boolean" }, "hasSubscription": { "default": false, "type": "boolean" }, "subscriptionStatus": { "type": [ "string", "null" ] }, "planHandle": { "description": "Plan handle: 'smoxy' when subscribed, 'free' otherwise.", "default": "free", "type": "string" }, "checkoutSessionId": { "type": [ "string", "null" ] } } } ] }, "block-block.read": { "type": "object", "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] }, "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier: base64url (no padding) of the source string, so dots and CIDR slashes are safe in a single path segment.", "example": "MjAzLjAuMTEzLjEw", "type": "string" } }, "required": [ "source" ] }, "block-block.update.jsonMergePatch": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" } } }, "block-block.write": { "type": "object", "required": [ "source", "type" ], "properties": { "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" } } }, "block.jsonld-block.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "geo": { "description": "Transient - geo of the source IP (same shape as the lookup endpoint's\n`geo`), populated by the providers on read for `type=ip` entries only.", "type": [ "object", "null" ], "additionalProperties": { "anyOf": [ { "type": "number" }, { "type": "integer" }, { "type": "string" }, { "type": "null" } ] } }, "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier: base64url (no padding) of the source string, so dots and CIDR slashes are safe in a single path segment.", "example": "MjAzLjAuMTEzLjEw", "type": "string" } }, "required": [ "source" ] } ], "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] } } }, "cache-clear-cache-clear.read": { "type": "object", "required": [ "action" ], "properties": { "action": { "enum": [ "all", "tag", "uri", "html", "images", "assets" ], "type": "string", "description": "What to clear: `all` clears the whole zone cache; `tag` clears all entries matching the given `tags`; `uri` clears a single URI (requires `hostname` and `uri`); `html`, `images` and `assets` clear all cached content of that class (HTML documents, images, or other static files such as CSS, JS and fonts) across the zone.", "example": "all" }, "cacheCleared": { "description": "Whether the zone cache was cleared.", "default": false, "type": "boolean" }, "cdnCleared": { "description": "Whether the CDN cache was purged as well. `false` when the zone or the targeted URI does not serve content through the CDN; that is a no-op, not a failure.", "default": false, "type": "boolean" } } }, "cache-clear-cache-clear.write": { "type": "object", "required": [ "action" ], "properties": { "action": { "enum": [ "all", "tag", "uri", "html", "images", "assets" ], "type": "string", "description": "What to clear: `all` clears the whole zone cache; `tag` clears all entries matching the given `tags`; `uri` clears a single URI (requires `hostname` and `uri`); `html`, `images` and `assets` clear all cached content of that class (HTML documents, images, or other static files such as CSS, JS and fonts) across the zone.", "example": "all" }, "tags": { "description": "Cache tags whose entries should be cleared. Required when `action` is `tag`, ignored otherwise.", "example": [ "product-12", "nav" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "uri": { "description": "Path of the cached resource to clear. Required when `action` is `uri`, ignored otherwise.", "example": "/products/12", "type": [ "string", "null" ] }, "hostname": { "description": "Hostname the URI is served on; must belong to the zone. Required when `action` is `uri`, ignored otherwise.", "example": "www.example.com", "type": [ "string", "null" ] } } }, "cache-clear.jsonld-cache-clear.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "required": [ "action" ], "properties": { "action": { "enum": [ "all", "tag", "uri", "html", "images", "assets" ], "type": "string", "description": "What to clear: `all` clears the whole zone cache; `tag` clears all entries matching the given `tags`; `uri` clears a single URI (requires `hostname` and `uri`); `html`, `images` and `assets` clear all cached content of that class (HTML documents, images, or other static files such as CSS, JS and fonts) across the zone.", "example": "all" }, "cacheCleared": { "description": "Whether the zone cache was cleared.", "default": false, "type": "boolean" }, "cdnCleared": { "description": "Whether the CDN cache was purged as well. `false` when the zone or the targeted URI does not serve content through the CDN; that is a no-op, not a failure.", "default": false, "type": "boolean" } } } ] }, "cdn-log": { "type": "object", "properties": { "timestamp": { "type": "string" }, "zone_id": { "type": "string" }, "pull_zone_id": { "type": "integer" }, "request_id": { "type": "string" }, "cache_status": { "type": "string" }, "status_code": { "type": "integer" }, "bytes_sent": { "type": "integer" }, "remote_ip": { "type": "string" }, "country_code": { "type": "string" }, "edge_location": { "type": "string" }, "scheme": { "type": "string" }, "host": { "type": "string" }, "path": { "type": "string" }, "url": { "type": "string" }, "user_agent": { "type": "string" }, "referer": { "type": "string" }, "ja4_fingerprint": { "type": "string" }, "asn": { "type": "integer" }, "asn_organization": { "type": "string" }, "is_eu": { "type": "integer" } } }, "cdn-log.jsonld": { "type": "object", "properties": { "timestamp": { "type": "string" }, "zone_id": { "type": "string" }, "pull_zone_id": { "type": "integer" }, "request_id": { "type": "string" }, "cache_status": { "type": "string" }, "status_code": { "type": "integer" }, "bytes_sent": { "type": "integer" }, "remote_ip": { "type": "string" }, "country_code": { "type": "string" }, "edge_location": { "type": "string" }, "scheme": { "type": "string" }, "host": { "type": "string" }, "path": { "type": "string" }, "url": { "type": "string" }, "user_agent": { "type": "string" }, "referer": { "type": "string" }, "ja4_fingerprint": { "type": "string" }, "asn": { "type": "integer" }, "asn_organization": { "type": "string" }, "is_eu": { "type": "integer" } } }, "certificate-attempt-certificate.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } }, "certificate-attempt-certificate.read_certificate.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } }, "certificate-attempt-certificate_attempt.list": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "errorCode": { "type": "string", "nullable": true, "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error" ], "description": "Machine-readable error classification. Only present when `status` is `failed`; null otherwise. ACME values: `rate_limit`, `cname_record_missing`, `cname_record_invalid`, `dns_provision_failed`, `acme_error`. Upload values: `upload_invalid_pem`, `upload_key_mismatch`, `upload_expired`, `upload_san_mismatch`, `upload_invalid_chain`. `internal_error` covers any unexpected failure.", "example": "acme_error" }, "errorMessage": { "description": "Human-readable error detail for a failed attempt (e.g. the ACME error message or validation failure reason). Null unless the attempt failed.", "example": "DNS challenge validation failed", "type": [ "string", "null" ] }, "sansSnapshot": { "description": "Snapshot of the Subject Alternative Names (SANs) the certificate was expected to cover at the time of this attempt.", "example": [ "example.com", "www.example.com" ], "type": "array", "items": { "type": "string" } }, "issuedExpiresAt": { "description": "Expiry date (ISO 8601) of the certificate issued or imported by this attempt. Populated on success; null otherwise.", "example": "2026-09-29T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } }, "certificate-attempt-certificate_attempt.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "errorCode": { "type": "string", "nullable": true, "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error" ], "description": "Machine-readable error classification. Only present when `status` is `failed`; null otherwise. ACME values: `rate_limit`, `cname_record_missing`, `cname_record_invalid`, `dns_provision_failed`, `acme_error`. Upload values: `upload_invalid_pem`, `upload_key_mismatch`, `upload_expired`, `upload_san_mismatch`, `upload_invalid_chain`. `internal_error` covers any unexpected failure.", "example": "acme_error" }, "errorMessage": { "description": "Human-readable error detail for a failed attempt (e.g. the ACME error message or validation failure reason). Null unless the attempt failed.", "example": "DNS challenge validation failed", "type": [ "string", "null" ] }, "sansSnapshot": { "description": "Snapshot of the Subject Alternative Names (SANs) the certificate was expected to cover at the time of this attempt.", "example": [ "example.com", "www.example.com" ], "type": "array", "items": { "type": "string" } }, "issuedExpiresAt": { "description": "Expiry date (ISO 8601) of the certificate issued or imported by this attempt. Populated on success; null otherwise.", "example": "2026-09-29T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "steps": { "type": "array", "items": { "$ref": "#/components/schemas/CertificateAttemptStep-certificate_attempt.read" } } } }, "certificate-attempt.jsonld-certificate.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } } ] }, "certificate-attempt.jsonld-certificate.read_certificate.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } } ] }, "certificate-attempt.jsonld-certificate_attempt.list": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "errorCode": { "type": "string", "nullable": true, "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error" ], "description": "Machine-readable error classification. Only present when `status` is `failed`; null otherwise. ACME values: `rate_limit`, `cname_record_missing`, `cname_record_invalid`, `dns_provision_failed`, `acme_error`. Upload values: `upload_invalid_pem`, `upload_key_mismatch`, `upload_expired`, `upload_san_mismatch`, `upload_invalid_chain`. `internal_error` covers any unexpected failure.", "example": "acme_error" }, "errorMessage": { "description": "Human-readable error detail for a failed attempt (e.g. the ACME error message or validation failure reason). Null unless the attempt failed.", "example": "DNS challenge validation failed", "type": [ "string", "null" ] }, "sansSnapshot": { "description": "Snapshot of the Subject Alternative Names (SANs) the certificate was expected to cover at the time of this attempt.", "example": [ "example.com", "www.example.com" ], "type": "array", "items": { "type": "string" } }, "issuedExpiresAt": { "description": "Expiry date (ISO 8601) of the certificate issued or imported by this attempt. Populated on success; null otherwise.", "example": "2026-09-29T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" } } } ] }, "certificate-attempt.jsonld-certificate_attempt.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of this certificate attempt.", "example": "9f1c2d3e-4b5a-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "acme_issue", "acme_renew", "upload" ], "description": "The kind of operation this attempt represents: `acme_issue` (first-time ACME issuance), `acme_renew` (ACME renewal of an existing certificate), or `upload` (import of a customer-supplied certificate).", "example": "acme_renew" }, "status": { "type": "string", "enum": [ "processing", "succeeded", "failed" ], "description": "Overall lifecycle status of the attempt: `processing` (in flight), `succeeded` (completed and certificate persisted), or `failed` (see `errorCode` / `errorMessage`).", "example": "succeeded" }, "startedAt": { "readOnly": true, "description": "Timestamp (ISO 8601) when the attempt began.", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "finishedAt": { "description": "Timestamp (ISO 8601) when the attempt finished, whether it succeeded or failed. Null while the attempt is still processing.", "example": "2026-07-01T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "errorCode": { "type": "string", "nullable": true, "enum": [ "rate_limit", "cname_record_missing", "cname_record_invalid", "dns_provision_failed", "acme_error", "upload_invalid_pem", "upload_key_mismatch", "upload_expired", "upload_san_mismatch", "upload_invalid_chain", "internal_error" ], "description": "Machine-readable error classification. Only present when `status` is `failed`; null otherwise. ACME values: `rate_limit`, `cname_record_missing`, `cname_record_invalid`, `dns_provision_failed`, `acme_error`. Upload values: `upload_invalid_pem`, `upload_key_mismatch`, `upload_expired`, `upload_san_mismatch`, `upload_invalid_chain`. `internal_error` covers any unexpected failure.", "example": "acme_error" }, "errorMessage": { "description": "Human-readable error detail for a failed attempt (e.g. the ACME error message or validation failure reason). Null unless the attempt failed.", "example": "DNS challenge validation failed", "type": [ "string", "null" ] }, "sansSnapshot": { "description": "Snapshot of the Subject Alternative Names (SANs) the certificate was expected to cover at the time of this attempt.", "example": [ "example.com", "www.example.com" ], "type": "array", "items": { "type": "string" } }, "issuedExpiresAt": { "description": "Expiry date (ISO 8601) of the certificate issued or imported by this attempt. Populated on success; null otherwise.", "example": "2026-09-29T09:16:42+00:00", "type": [ "string", "null" ], "format": "date-time" }, "steps": { "type": "array", "items": { "$ref": "#/components/schemas/CertificateAttemptStep.jsonld-certificate_attempt.read" } } } } ] }, "certificate-certificate.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the certificate (UUID v4).", "example": "9f8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d", "type": "string", "format": "uuid" }, "domainName": { "maxLength": 255, "description": "Apex (root) domain the certificate is issued for, e.g. \"example.com\". Subdomains are rejected. Required when creating a certificate and lower-cased on write. Maximum 255 characters.", "example": "example.com", "type": "string" }, "type": { "type": "string", "enum": [ "auto_managed", "custom" ], "description": "How the certificate is provisioned. `auto_managed` certificates are issued and renewed automatically via ACME; `custom` certificates carry user-uploaded certificate and private key data. Uploading certificate content onto an auto-managed certificate implicitly switches it to `custom`. Defaults to `auto_managed`.", "example": "auto_managed" }, "status": { "type": "string", "enum": [ "pending", "active", "expired", "renewing", "failed" ], "description": "Read-only lifecycle status of the certificate. `pending` - awaiting first issuance; `active` - issued and valid; `expired` - past its expiry; `renewing` - an ACME renewal is in progress; `failed` - the last issuance or upload failed. Defaults to `pending`.", "example": "active" }, "certificateData": { "description": "PEM-encoded leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Uploading new content is parsed and verified before it is stored.", "example": "-----BEGIN CERTIFICATE-----\nMIIC...snip...IDAQAB\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "privateKeyData": { "description": "PEM-encoded private key matching the leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Verified to match the certificate on upload.", "example": "-----BEGIN PRIVATE KEY-----\nMIIE...snip...QIDAQ\n-----END PRIVATE KEY-----", "type": [ "string", "null" ] }, "chainData": { "description": "Optional PEM-encoded intermediate CA chain served alongside the leaf certificate.", "example": "-----BEGIN CERTIFICATE-----\nMIID...snip...b3RQ\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "expiresAt": { "description": "Read-only expiry timestamp of the certificate (ISO 8601). Populated once the certificate is issued or its uploaded content is parsed; null while pending.", "example": "2026-09-30T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "issuer": { "maxLength": 255, "description": "Read-only issuer (CA) of the certificate, extracted from the issued or uploaded certificate. Maximum 255 characters.", "example": "Let's Encrypt", "type": [ "string", "null" ] }, "fingerprint": { "maxLength": 255, "description": "Read-only SHA-256 fingerprint of the certificate. Maximum 255 characters.", "example": "sha256:3b:0a:1f:...:9c:2d", "type": [ "string", "null" ] }, "nextRenewalAt": { "description": "Read-only timestamp (ISO 8601) at which smoxy is scheduled to automatically renew this `auto_managed` certificate. Derived from the certificate authority's suggested renewal window, falling back to 30 days before expiry. Null for `custom` certificates and while no renewal has been scheduled yet.", "example": "2026-08-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "sans": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-san-certificate.read" } }, "lastAttempt": { "anyOf": [ { "$ref": "#/components/schemas/certificate-attempt-certificate.read" }, { "type": "null" } ] }, "createdAt": { "readOnly": true, "description": "Read-only creation timestamp of the certificate (ISO 8601).", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Read-only timestamp of the last update to the certificate (ISO 8601).", "example": "2026-07-01T09:20:00+00:00", "type": "string", "format": "date-time" }, "organizationId": { "readOnly": true, "description": "Read-only ID of the organization that owns the certificate (derived from its domain).", "example": 42, "type": "integer" }, "attemptCount": { "readOnly": true, "description": "Read-only total number of issuance, renewal and upload attempts recorded for the certificate.", "example": 3, "type": "integer" } }, "required": [ "domainName", "type", "status" ] }, "certificate-certificate.write.jsonMergePatch": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "auto_managed", "custom" ], "description": "How the certificate is provisioned. `auto_managed` certificates are issued and renewed automatically via ACME; `custom` certificates carry user-uploaded certificate and private key data. Uploading certificate content onto an auto-managed certificate implicitly switches it to `custom`. Defaults to `auto_managed`.", "example": "auto_managed" }, "certificateData": { "description": "PEM-encoded leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Uploading new content is parsed and verified before it is stored.", "example": "-----BEGIN CERTIFICATE-----\nMIIC...snip...IDAQAB\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "privateKeyData": { "description": "PEM-encoded private key matching the leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Verified to match the certificate on upload.", "example": "-----BEGIN PRIVATE KEY-----\nMIIE...snip...QIDAQ\n-----END PRIVATE KEY-----", "type": [ "string", "null" ] }, "chainData": { "description": "Optional PEM-encoded intermediate CA chain served alongside the leaf certificate.", "example": "-----BEGIN CERTIFICATE-----\nMIID...snip...b3RQ\n-----END CERTIFICATE-----", "type": [ "string", "null" ] } } }, "certificate-certificate.write_certificate.create": { "type": "object", "required": [ "domainName", "type" ], "properties": { "domainName": { "maxLength": 255, "description": "Apex (root) domain the certificate is issued for, e.g. \"example.com\". Subdomains are rejected. Required when creating a certificate and lower-cased on write. Maximum 255 characters.", "example": "example.com", "type": "string" }, "type": { "type": "string", "enum": [ "auto_managed", "custom" ], "description": "How the certificate is provisioned. `auto_managed` certificates are issued and renewed automatically via ACME; `custom` certificates carry user-uploaded certificate and private key data. Uploading certificate content onto an auto-managed certificate implicitly switches it to `custom`. Defaults to `auto_managed`.", "example": "auto_managed" }, "certificateData": { "description": "PEM-encoded leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Uploading new content is parsed and verified before it is stored.", "example": "-----BEGIN CERTIFICATE-----\nMIIC...snip...IDAQAB\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "privateKeyData": { "description": "PEM-encoded private key matching the leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Verified to match the certificate on upload.", "example": "-----BEGIN PRIVATE KEY-----\nMIIE...snip...QIDAQ\n-----END PRIVATE KEY-----", "type": [ "string", "null" ] }, "chainData": { "description": "Optional PEM-encoded intermediate CA chain served alongside the leaf certificate.", "example": "-----BEGIN CERTIFICATE-----\nMIID...snip...b3RQ\n-----END CERTIFICATE-----", "type": [ "string", "null" ] } } }, "certificate-san": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "certificate": { "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "dnsLastCheckedAt": { "description": "When the SAN's DNS was last checked. Null until the first check runs.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "dnsNextCheckAt": { "description": "When the SAN's DNS is next scheduled to be checked. Null when no check is scheduled.", "example": "2026-07-02T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" }, "createdAt": { "readOnly": true, "description": "When the SAN was created.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "When the SAN was last updated.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] }, "certificate-san-certificate.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" } }, "required": [ "name" ] }, "certificate-san-certificate.read_certificate.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" } }, "required": [ "name" ] }, "certificate-san-certificate_san.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "dnsLastCheckedAt": { "description": "When the SAN's DNS was last checked. Null until the first check runs.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "dnsNextCheckAt": { "description": "When the SAN's DNS is next scheduled to be checked. Null when no check is scheduled.", "example": "2026-07-02T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" }, "createdAt": { "readOnly": true, "description": "When the SAN was created.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "When the SAN was last updated.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] }, "certificate-san-certificate_san.write": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" } } }, "certificate-san.jsonld-certificate.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" } }, "required": [ "name" ] } ] }, "certificate-san.jsonld-certificate.read_certificate.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" } }, "required": [ "name" ] } ] }, "certificate-san.jsonld-certificate_san.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the SAN (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "name": { "maxLength": 253, "description": "The SAN host name. Stored lower-cased. Must be a valid ASCII/punycode DNS name (max 253 characters); use punycode (xn--) labels for internationalized domains. May be a wildcard (\"*.example.com\") and must belong to the certificate's domain.", "example": "www.example.com", "type": "string" }, "dnsStatus": { "default": "unknown", "type": "string", "enum": [ "unknown", "valid", "missing" ], "description": "DNS validation status of the SAN: \"unknown\" before the first check, \"valid\" when the required CNAME/DNS record was found, \"missing\" when it was not. Set by the DNS check; read-only.", "example": "valid" }, "dnsLastCheckedAt": { "description": "When the SAN's DNS was last checked. Null until the first check runs.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "dnsNextCheckAt": { "description": "When the SAN's DNS is next scheduled to be checked. Null when no check is scheduled.", "example": "2026-07-02T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "sslStatus": { "default": "not_covered", "type": "string", "enum": [ "not_covered", "covered" ], "description": "Whether the issued certificate currently covers this SAN: \"covered\" when the SAN is included in the active certificate, otherwise \"not_covered\". Read-only.", "example": "covered" }, "createdAt": { "readOnly": true, "description": "When the SAN was created.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "When the SAN was last updated.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] } ] }, "certificate.CertificateRenewOutput-certificate.read": { "type": "object" }, "certificate.CertificateRenewOutput.jsonld-certificate.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object" } ] }, "certificate.jsonld-certificate.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the certificate (UUID v4).", "example": "9f8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d", "type": "string", "format": "uuid" }, "domainName": { "maxLength": 255, "description": "Apex (root) domain the certificate is issued for, e.g. \"example.com\". Subdomains are rejected. Required when creating a certificate and lower-cased on write. Maximum 255 characters.", "example": "example.com", "type": "string" }, "type": { "type": "string", "enum": [ "auto_managed", "custom" ], "description": "How the certificate is provisioned. `auto_managed` certificates are issued and renewed automatically via ACME; `custom` certificates carry user-uploaded certificate and private key data. Uploading certificate content onto an auto-managed certificate implicitly switches it to `custom`. Defaults to `auto_managed`.", "example": "auto_managed" }, "status": { "type": "string", "enum": [ "pending", "active", "expired", "renewing", "failed" ], "description": "Read-only lifecycle status of the certificate. `pending` - awaiting first issuance; `active` - issued and valid; `expired` - past its expiry; `renewing` - an ACME renewal is in progress; `failed` - the last issuance or upload failed. Defaults to `pending`.", "example": "active" }, "certificateData": { "description": "PEM-encoded leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Uploading new content is parsed and verified before it is stored.", "example": "-----BEGIN CERTIFICATE-----\nMIIC...snip...IDAQAB\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "privateKeyData": { "description": "PEM-encoded private key matching the leaf certificate. Required for `custom` certificates and must be omitted for `auto_managed` ones. Verified to match the certificate on upload.", "example": "-----BEGIN PRIVATE KEY-----\nMIIE...snip...QIDAQ\n-----END PRIVATE KEY-----", "type": [ "string", "null" ] }, "chainData": { "description": "Optional PEM-encoded intermediate CA chain served alongside the leaf certificate.", "example": "-----BEGIN CERTIFICATE-----\nMIID...snip...b3RQ\n-----END CERTIFICATE-----", "type": [ "string", "null" ] }, "expiresAt": { "description": "Read-only expiry timestamp of the certificate (ISO 8601). Populated once the certificate is issued or its uploaded content is parsed; null while pending.", "example": "2026-09-30T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "issuer": { "maxLength": 255, "description": "Read-only issuer (CA) of the certificate, extracted from the issued or uploaded certificate. Maximum 255 characters.", "example": "Let's Encrypt", "type": [ "string", "null" ] }, "fingerprint": { "maxLength": 255, "description": "Read-only SHA-256 fingerprint of the certificate. Maximum 255 characters.", "example": "sha256:3b:0a:1f:...:9c:2d", "type": [ "string", "null" ] }, "nextRenewalAt": { "description": "Read-only timestamp (ISO 8601) at which smoxy is scheduled to automatically renew this `auto_managed` certificate. Derived from the certificate authority's suggested renewal window, falling back to 30 days before expiry. Null for `custom` certificates and while no renewal has been scheduled yet.", "example": "2026-08-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "sans": { "type": "array", "items": { "$ref": "#/components/schemas/certificate-san.jsonld-certificate.read" } }, "lastAttempt": { "anyOf": [ { "$ref": "#/components/schemas/certificate-attempt.jsonld-certificate.read" }, { "type": "null" } ] }, "createdAt": { "readOnly": true, "description": "Read-only creation timestamp of the certificate (ISO 8601).", "example": "2026-07-01T09:15:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Read-only timestamp of the last update to the certificate (ISO 8601).", "example": "2026-07-01T09:20:00+00:00", "type": "string", "format": "date-time" }, "organizationId": { "readOnly": true, "description": "Read-only ID of the organization that owns the certificate (derived from its domain).", "example": 42, "type": "integer" }, "attemptCount": { "readOnly": true, "description": "Read-only total number of issuance, renewal and upload attempts recorded for the certificate.", "example": 3, "type": "integer" } }, "required": [ "domainName", "type", "status" ] } ] }, "change-password-user.change-password": { "type": "object", "required": [ "currentPassword", "newPassword" ], "properties": { "currentPassword": { "type": [ "string", "null" ] }, "newPassword": { "minLength": 8, "maxLength": 255, "pattern": "^((?=.*[a-z])(?=.*[A-Z])(?=.*\\d).*)$", "type": [ "string", "null" ] } } }, "configuration-rule-configuration_rule.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the configuration rule.", "example": "0197c4e3-6f2a-7b3c-9d1e-2f4a6b8c0d1e", "type": "string", "format": "uuid" }, "zone": { "description": "IRI of the zone this configuration rule belongs to. Set from the request path and cannot be changed.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable rule name. Required, at most 255 characters, and unique within the zone.", "example": "Cache API responses", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. At most 5000 characters.", "example": "Enable dynamic caching for requests under /api/.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/ConditionGroup" }, "order": { "description": "Evaluation order (ascending): rules are applied from the lowest value to the highest. When omitted on create the rule is appended after the current highest order; setting it on update re-sequences the sibling rules so the order stays contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are skipped during evaluation. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, rule evaluation stops after this rule matches, so lower-priority rules are not applied. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created (read-only).", "example": "2026-01-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated (read-only).", "example": "2026-01-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "settingsOverrides": { "type": "object", "description": "Settings that override zone defaults when rule conditions match. Only non-null values are returned.", "properties": { "cachingDynamicEnabled": { "type": "boolean", "nullable": true, "description": "Enable dynamic content caching" }, "cachingRespectCacheControl": { "type": "boolean", "nullable": true, "description": "Respect cache-control headers from origin (bypass cache for private, no-cache, max-age=0, no-store)" }, "cachingDynamicCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for dynamic content. The URI path is the inherent baseline of the dynamic cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the dynamic cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByCookie": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cookie names to include in cache key" }, "varyByCountry": { "type": "boolean", "nullable": true, "description": "Cache a separate copy per visitor country" }, "varyByHeader": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Request header names whose values are included in the cache key" } } }, "cachingStaticEnabled": { "type": "boolean", "nullable": true, "description": "Enable static content caching" }, "cachingStaticCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for static content. The URI path is the inherent baseline of the static cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the static cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByQueryString": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Query string parameters to include in cache key" } } }, "cachingDefaultTtl": { "type": "integer", "nullable": true, "minimum": 0, "description": "Default TTL in seconds for cached content" }, "cachingIgnoredUrlParams": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "URL parameters to ignore in cache key" }, "cachingManagedIgnoredUrlParamsEnabled": { "type": "boolean", "nullable": true, "description": "Override whether the platform-managed ignored URL parameter list applies when this rule matches (null inherits the zone setting)" }, "cachingIgnoredCacheTags": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cache tags to ignore" }, "cachingCustomCacheTagHeaders": { "type": "array", "nullable": true, "maxItems": 4, "description": "Custom headers for cache tag extraction (maximum 4 entries)", "items": { "type": "object", "properties": { "header": { "type": "string", "description": "Header name" }, "delimiter": { "type": "string", "maxLength": 10, "description": "Delimiter for multiple tags" } }, "required": [ "header", "delimiter" ] } }, "cacheControlPublicMaxAgeOverride": { "type": "integer", "nullable": true, "minimum": -1, "maximum": 31536000, "description": "Override the browser-side Cache-Control max-age (in seconds) sent to clients when this rule matches. -1 disables the override, 0 instructs browsers not to cache; null inherits the zone setting." }, "headersRequestSet": { "type": "array", "nullable": true, "description": "Headers to add to backend requests", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseSet": { "type": "array", "nullable": true, "description": "Headers to add to client responses", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseAdd": { "type": "array", "nullable": true, "description": "Headers added to client responses as an additional occurrence: emitted alongside the origin header of the same name (delivered more than once) instead of overwriting it, or set once if the origin sent none. Only headers that may legally repeat are allowed (e.g. Set-Cookie, Vary, Link, Cache-Control, CORS Access-Control-Allow-*); single-valued headers such as Content-Type, Location, ETag are rejected - use headersResponseSet for those.", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseRemove": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Override the response header names removed from client responses when this rule matches (null inherits the zone list, an empty list removes none)" }, "debugHeadersEnabled": { "type": "boolean", "nullable": true, "description": "Enable debug headers in responses" }, "stripCacheTagHeaders": { "type": "boolean", "nullable": true, "description": "Override whether custom cache tag headers are stripped from responses when this rule matches (null inherits the zone setting)" }, "processingSsi": { "type": "boolean", "nullable": true, "description": "Enable Server Side Includes processing" }, "processingEsi": { "type": "boolean", "nullable": true, "description": "Enable Edge Side Includes processing" }, "customPagesMaintenanceActive": { "type": "boolean", "nullable": true, "description": "Activate maintenance mode" }, "securityEnabled": { "type": "boolean", "nullable": true, "description": "Override the zone WAF security toggle for this rule" }, "enabled": { "type": "boolean", "nullable": true, "description": "Override the zone master smartproxy toggle for this rule" }, "imageOptimizationEnabled": { "type": "boolean", "nullable": true, "description": "Enable image optimization" }, "imageOptimizationWebpEnabled": { "type": "boolean", "nullable": true, "description": "Enable WebP format conversion" }, "imageOptimizationAvifEnabled": { "type": "boolean", "nullable": true, "description": "Enable AVIF format conversion" }, "imageOptimizationAvifQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "AVIF conversion quality (1-100)" }, "imageOptimizationWebpQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "WebP conversion quality (1-100)" }, "imageOptimizationJpegQualityTarget": { "type": "number", "format": "float", "nullable": true, "minimum": 0.0001, "maximum": 0.9999, "description": "JPEG SSIM quality target (0.0001-0.9999)" }, "imageOptimizationJpegEnabled": { "type": "boolean", "nullable": true, "description": "Enable JPEG recompression" }, "imageOptimizationJpegQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality (10-100)" }, "imageOptimizationJpegQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality (10-100)" }, "imageOptimizationPngEnabled": { "type": "boolean", "nullable": true, "description": "Enable PNG recompression" }, "imageOptimizationPngQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality (10-100)" }, "imageOptimizationPngQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality (10-100)" }, "minifyHtml": { "type": "boolean", "nullable": true, "description": "Enable HTML minification" }, "basicAuth": { "type": "object", "nullable": true, "description": "Override basic auth settings. Enable/disable basic auth or restrict to specific users.", "properties": { "enabled": { "type": "boolean", "description": "Enable or disable basic auth" }, "allowedUserIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "UUIDs of basic auth users allowed. Null means all zone users." } }, "required": [ "enabled" ] }, "defaultBackend": { "type": "object", "nullable": true, "description": "Override the zone default backend. Pick an origin server or a load balancer belonging to the rule zone.", "properties": { "type": { "type": "string", "enum": [ "origin", "load_balancer" ], "description": "Backend kind" }, "id": { "type": "string", "format": "uuid", "description": "UUID of the origin server or load balancer" } }, "required": [ "type", "id" ] }, "backendPortOverride": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 65535, "description": "Override the backend port. Applies on top of whichever backend is resolved (zone default or rule DEFAULT_BACKEND)." } }, "additionalProperties": false } }, "required": [ "name", "conditions" ] }, "configuration-rule-configuration_rule.write": { "type": "object", "required": [ "name", "conditions" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable rule name. Required, at most 255 characters, and unique within the zone.", "example": "Cache API responses", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. At most 5000 characters.", "example": "Enable dynamic caching for requests under /api/.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/ConditionGroup" }, "order": { "description": "Evaluation order (ascending): rules are applied from the lowest value to the highest. When omitted on create the rule is appended after the current highest order; setting it on update re-sequences the sibling rules so the order stays contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are skipped during evaluation. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, rule evaluation stops after this rule matches, so lower-priority rules are not applied. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "settingsOverrides": { "type": "object", "description": "Settings that override zone defaults when rule conditions match. Only non-null values are returned.", "properties": { "cachingDynamicEnabled": { "type": "boolean", "nullable": true, "description": "Enable dynamic content caching" }, "cachingRespectCacheControl": { "type": "boolean", "nullable": true, "description": "Respect cache-control headers from origin (bypass cache for private, no-cache, max-age=0, no-store)" }, "cachingDynamicCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for dynamic content. The URI path is the inherent baseline of the dynamic cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the dynamic cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByCookie": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cookie names to include in cache key" }, "varyByCountry": { "type": "boolean", "nullable": true, "description": "Cache a separate copy per visitor country" }, "varyByHeader": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Request header names whose values are included in the cache key" } } }, "cachingStaticEnabled": { "type": "boolean", "nullable": true, "description": "Enable static content caching" }, "cachingStaticCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for static content. The URI path is the inherent baseline of the static cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the static cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByQueryString": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Query string parameters to include in cache key" } } }, "cachingDefaultTtl": { "type": "integer", "nullable": true, "minimum": 0, "description": "Default TTL in seconds for cached content" }, "cachingIgnoredUrlParams": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "URL parameters to ignore in cache key" }, "cachingManagedIgnoredUrlParamsEnabled": { "type": "boolean", "nullable": true, "description": "Override whether the platform-managed ignored URL parameter list applies when this rule matches (null inherits the zone setting)" }, "cachingIgnoredCacheTags": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cache tags to ignore" }, "cachingCustomCacheTagHeaders": { "type": "array", "nullable": true, "maxItems": 4, "description": "Custom headers for cache tag extraction (maximum 4 entries)", "items": { "type": "object", "properties": { "header": { "type": "string", "description": "Header name" }, "delimiter": { "type": "string", "maxLength": 10, "description": "Delimiter for multiple tags" } }, "required": [ "header", "delimiter" ] } }, "cacheControlPublicMaxAgeOverride": { "type": "integer", "nullable": true, "minimum": -1, "maximum": 31536000, "description": "Override the browser-side Cache-Control max-age (in seconds) sent to clients when this rule matches. -1 disables the override, 0 instructs browsers not to cache; null inherits the zone setting." }, "headersRequestSet": { "type": "array", "nullable": true, "description": "Headers to add to backend requests", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseSet": { "type": "array", "nullable": true, "description": "Headers to add to client responses", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseAdd": { "type": "array", "nullable": true, "description": "Headers added to client responses as an additional occurrence: emitted alongside the origin header of the same name (delivered more than once) instead of overwriting it, or set once if the origin sent none. Only headers that may legally repeat are allowed (e.g. Set-Cookie, Vary, Link, Cache-Control, CORS Access-Control-Allow-*); single-valued headers such as Content-Type, Location, ETag are rejected - use headersResponseSet for those.", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseRemove": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Override the response header names removed from client responses when this rule matches (null inherits the zone list, an empty list removes none)" }, "debugHeadersEnabled": { "type": "boolean", "nullable": true, "description": "Enable debug headers in responses" }, "stripCacheTagHeaders": { "type": "boolean", "nullable": true, "description": "Override whether custom cache tag headers are stripped from responses when this rule matches (null inherits the zone setting)" }, "processingSsi": { "type": "boolean", "nullable": true, "description": "Enable Server Side Includes processing" }, "processingEsi": { "type": "boolean", "nullable": true, "description": "Enable Edge Side Includes processing" }, "customPagesMaintenanceActive": { "type": "boolean", "nullable": true, "description": "Activate maintenance mode" }, "securityEnabled": { "type": "boolean", "nullable": true, "description": "Override the zone WAF security toggle for this rule" }, "enabled": { "type": "boolean", "nullable": true, "description": "Override the zone master smartproxy toggle for this rule" }, "imageOptimizationEnabled": { "type": "boolean", "nullable": true, "description": "Enable image optimization" }, "imageOptimizationWebpEnabled": { "type": "boolean", "nullable": true, "description": "Enable WebP format conversion" }, "imageOptimizationAvifEnabled": { "type": "boolean", "nullable": true, "description": "Enable AVIF format conversion" }, "imageOptimizationAvifQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "AVIF conversion quality (1-100)" }, "imageOptimizationWebpQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "WebP conversion quality (1-100)" }, "imageOptimizationJpegQualityTarget": { "type": "number", "format": "float", "nullable": true, "minimum": 0.0001, "maximum": 0.9999, "description": "JPEG SSIM quality target (0.0001-0.9999)" }, "imageOptimizationJpegEnabled": { "type": "boolean", "nullable": true, "description": "Enable JPEG recompression" }, "imageOptimizationJpegQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality (10-100)" }, "imageOptimizationJpegQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality (10-100)" }, "imageOptimizationPngEnabled": { "type": "boolean", "nullable": true, "description": "Enable PNG recompression" }, "imageOptimizationPngQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality (10-100)" }, "imageOptimizationPngQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality (10-100)" }, "minifyHtml": { "type": "boolean", "nullable": true, "description": "Enable HTML minification" }, "basicAuth": { "type": "object", "nullable": true, "description": "Override basic auth settings. Enable/disable basic auth or restrict to specific users.", "properties": { "enabled": { "type": "boolean", "description": "Enable or disable basic auth" }, "allowedUserIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "UUIDs of basic auth users allowed. Null means all zone users." } }, "required": [ "enabled" ] }, "defaultBackend": { "type": "object", "nullable": true, "description": "Override the zone default backend. Pick an origin server or a load balancer belonging to the rule zone.", "properties": { "type": { "type": "string", "enum": [ "origin", "load_balancer" ], "description": "Backend kind" }, "id": { "type": "string", "format": "uuid", "description": "UUID of the origin server or load balancer" } }, "required": [ "type", "id" ] }, "backendPortOverride": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 65535, "description": "Override the backend port. Applies on top of whichever backend is resolved (zone default or rule DEFAULT_BACKEND)." } }, "additionalProperties": false } } }, "configuration-rule-configuration_rule.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable rule name. Required, at most 255 characters, and unique within the zone.", "example": "Cache API responses", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. At most 5000 characters.", "example": "Enable dynamic caching for requests under /api/.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/ConditionGroup" }, "order": { "description": "Evaluation order (ascending): rules are applied from the lowest value to the highest. When omitted on create the rule is appended after the current highest order; setting it on update re-sequences the sibling rules so the order stays contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are skipped during evaluation. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, rule evaluation stops after this rule matches, so lower-priority rules are not applied. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "settingsOverrides": { "type": "object", "description": "Settings that override zone defaults when rule conditions match. Only non-null values are returned.", "properties": { "cachingDynamicEnabled": { "type": "boolean", "nullable": true, "description": "Enable dynamic content caching" }, "cachingRespectCacheControl": { "type": "boolean", "nullable": true, "description": "Respect cache-control headers from origin (bypass cache for private, no-cache, max-age=0, no-store)" }, "cachingDynamicCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for dynamic content. The URI path is the inherent baseline of the dynamic cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the dynamic cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByCookie": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cookie names to include in cache key" }, "varyByCountry": { "type": "boolean", "nullable": true, "description": "Cache a separate copy per visitor country" }, "varyByHeader": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Request header names whose values are included in the cache key" } } }, "cachingStaticEnabled": { "type": "boolean", "nullable": true, "description": "Enable static content caching" }, "cachingStaticCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for static content. The URI path is the inherent baseline of the static cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the static cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByQueryString": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Query string parameters to include in cache key" } } }, "cachingDefaultTtl": { "type": "integer", "nullable": true, "minimum": 0, "description": "Default TTL in seconds for cached content" }, "cachingIgnoredUrlParams": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "URL parameters to ignore in cache key" }, "cachingManagedIgnoredUrlParamsEnabled": { "type": "boolean", "nullable": true, "description": "Override whether the platform-managed ignored URL parameter list applies when this rule matches (null inherits the zone setting)" }, "cachingIgnoredCacheTags": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cache tags to ignore" }, "cachingCustomCacheTagHeaders": { "type": "array", "nullable": true, "maxItems": 4, "description": "Custom headers for cache tag extraction (maximum 4 entries)", "items": { "type": "object", "properties": { "header": { "type": "string", "description": "Header name" }, "delimiter": { "type": "string", "maxLength": 10, "description": "Delimiter for multiple tags" } }, "required": [ "header", "delimiter" ] } }, "cacheControlPublicMaxAgeOverride": { "type": "integer", "nullable": true, "minimum": -1, "maximum": 31536000, "description": "Override the browser-side Cache-Control max-age (in seconds) sent to clients when this rule matches. -1 disables the override, 0 instructs browsers not to cache; null inherits the zone setting." }, "headersRequestSet": { "type": "array", "nullable": true, "description": "Headers to add to backend requests", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseSet": { "type": "array", "nullable": true, "description": "Headers to add to client responses", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseAdd": { "type": "array", "nullable": true, "description": "Headers added to client responses as an additional occurrence: emitted alongside the origin header of the same name (delivered more than once) instead of overwriting it, or set once if the origin sent none. Only headers that may legally repeat are allowed (e.g. Set-Cookie, Vary, Link, Cache-Control, CORS Access-Control-Allow-*); single-valued headers such as Content-Type, Location, ETag are rejected - use headersResponseSet for those.", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseRemove": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Override the response header names removed from client responses when this rule matches (null inherits the zone list, an empty list removes none)" }, "debugHeadersEnabled": { "type": "boolean", "nullable": true, "description": "Enable debug headers in responses" }, "stripCacheTagHeaders": { "type": "boolean", "nullable": true, "description": "Override whether custom cache tag headers are stripped from responses when this rule matches (null inherits the zone setting)" }, "processingSsi": { "type": "boolean", "nullable": true, "description": "Enable Server Side Includes processing" }, "processingEsi": { "type": "boolean", "nullable": true, "description": "Enable Edge Side Includes processing" }, "customPagesMaintenanceActive": { "type": "boolean", "nullable": true, "description": "Activate maintenance mode" }, "securityEnabled": { "type": "boolean", "nullable": true, "description": "Override the zone WAF security toggle for this rule" }, "enabled": { "type": "boolean", "nullable": true, "description": "Override the zone master smartproxy toggle for this rule" }, "imageOptimizationEnabled": { "type": "boolean", "nullable": true, "description": "Enable image optimization" }, "imageOptimizationWebpEnabled": { "type": "boolean", "nullable": true, "description": "Enable WebP format conversion" }, "imageOptimizationAvifEnabled": { "type": "boolean", "nullable": true, "description": "Enable AVIF format conversion" }, "imageOptimizationAvifQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "AVIF conversion quality (1-100)" }, "imageOptimizationWebpQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "WebP conversion quality (1-100)" }, "imageOptimizationJpegQualityTarget": { "type": "number", "format": "float", "nullable": true, "minimum": 0.0001, "maximum": 0.9999, "description": "JPEG SSIM quality target (0.0001-0.9999)" }, "imageOptimizationJpegEnabled": { "type": "boolean", "nullable": true, "description": "Enable JPEG recompression" }, "imageOptimizationJpegQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality (10-100)" }, "imageOptimizationJpegQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality (10-100)" }, "imageOptimizationPngEnabled": { "type": "boolean", "nullable": true, "description": "Enable PNG recompression" }, "imageOptimizationPngQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality (10-100)" }, "imageOptimizationPngQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality (10-100)" }, "minifyHtml": { "type": "boolean", "nullable": true, "description": "Enable HTML minification" }, "basicAuth": { "type": "object", "nullable": true, "description": "Override basic auth settings. Enable/disable basic auth or restrict to specific users.", "properties": { "enabled": { "type": "boolean", "description": "Enable or disable basic auth" }, "allowedUserIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "UUIDs of basic auth users allowed. Null means all zone users." } }, "required": [ "enabled" ] }, "defaultBackend": { "type": "object", "nullable": true, "description": "Override the zone default backend. Pick an origin server or a load balancer belonging to the rule zone.", "properties": { "type": { "type": "string", "enum": [ "origin", "load_balancer" ], "description": "Backend kind" }, "id": { "type": "string", "format": "uuid", "description": "UUID of the origin server or load balancer" } }, "required": [ "type", "id" ] }, "backendPortOverride": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 65535, "description": "Override the backend port. Applies on top of whichever backend is resolved (zone default or rule DEFAULT_BACKEND)." } }, "additionalProperties": false } } }, "configuration-rule.jsonld-configuration_rule.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the configuration rule.", "example": "0197c4e3-6f2a-7b3c-9d1e-2f4a6b8c0d1e", "type": "string", "format": "uuid" }, "zone": { "description": "IRI of the zone this configuration rule belongs to. Set from the request path and cannot be changed.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable rule name. Required, at most 255 characters, and unique within the zone.", "example": "Cache API responses", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. At most 5000 characters.", "example": "Enable dynamic caching for requests under /api/.", "type": [ "string", "null" ] }, "conditions": { "minItems": 1, "$ref": "#/components/schemas/ConditionGroup" }, "order": { "description": "Evaluation order (ascending): rules are applied from the lowest value to the highest. When omitted on create the rule is appended after the current highest order; setting it on update re-sequences the sibling rules so the order stays contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are skipped during evaluation. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "stopOnMatch": { "description": "When true, rule evaluation stops after this rule matches, so lower-priority rules are not applied. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created (read-only).", "example": "2026-01-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated (read-only).", "example": "2026-01-15T10:30:00+00:00", "type": "string", "format": "date-time" }, "settingsOverrides": { "description": "Settings that override zone defaults when rule conditions match. Only non-null values are returned. See OverridableSetting enum for available settings.", "type": "object", "additionalProperties": true } }, "required": [ "name", "conditions" ] } ], "properties": { "settingsOverrides": { "type": "object", "description": "Settings that override zone defaults when rule conditions match. Only non-null values are returned.", "properties": { "cachingDynamicEnabled": { "type": "boolean", "nullable": true, "description": "Enable dynamic content caching" }, "cachingRespectCacheControl": { "type": "boolean", "nullable": true, "description": "Respect cache-control headers from origin (bypass cache for private, no-cache, max-age=0, no-store)" }, "cachingDynamicCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for dynamic content. The URI path is the inherent baseline of the dynamic cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the dynamic cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByCookie": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cookie names to include in cache key" }, "varyByCountry": { "type": "boolean", "nullable": true, "description": "Cache a separate copy per visitor country" }, "varyByHeader": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Request header names whose values are included in the cache key" } } }, "cachingStaticEnabled": { "type": "boolean", "nullable": true, "description": "Enable static content caching" }, "cachingStaticCacheKey": { "type": "object", "nullable": true, "description": "Cache key configuration for static content. The URI path is the inherent baseline of the static cache key and is always present (responses always emit `uri: true`); only the optional varies are configurable.", "properties": { "uri": { "type": "boolean", "readOnly": true, "default": true, "description": "Always true - URI is the inherent baseline of the static cache key and cannot be disabled." }, "varyByHostname": { "type": "boolean", "nullable": true, "description": "Include hostname in cache key" }, "varyByQueryString": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Query string parameters to include in cache key" } } }, "cachingDefaultTtl": { "type": "integer", "nullable": true, "minimum": 0, "description": "Default TTL in seconds for cached content" }, "cachingIgnoredUrlParams": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "URL parameters to ignore in cache key" }, "cachingManagedIgnoredUrlParamsEnabled": { "type": "boolean", "nullable": true, "description": "Override whether the platform-managed ignored URL parameter list applies when this rule matches (null inherits the zone setting)" }, "cachingIgnoredCacheTags": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Cache tags to ignore" }, "cachingCustomCacheTagHeaders": { "type": "array", "nullable": true, "maxItems": 4, "description": "Custom headers for cache tag extraction (maximum 4 entries)", "items": { "type": "object", "properties": { "header": { "type": "string", "description": "Header name" }, "delimiter": { "type": "string", "maxLength": 10, "description": "Delimiter for multiple tags" } }, "required": [ "header", "delimiter" ] } }, "cacheControlPublicMaxAgeOverride": { "type": "integer", "nullable": true, "minimum": -1, "maximum": 31536000, "description": "Override the browser-side Cache-Control max-age (in seconds) sent to clients when this rule matches. -1 disables the override, 0 instructs browsers not to cache; null inherits the zone setting." }, "headersRequestSet": { "type": "array", "nullable": true, "description": "Headers to add to backend requests", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseSet": { "type": "array", "nullable": true, "description": "Headers to add to client responses", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseAdd": { "type": "array", "nullable": true, "description": "Headers added to client responses as an additional occurrence: emitted alongside the origin header of the same name (delivered more than once) instead of overwriting it, or set once if the origin sent none. Only headers that may legally repeat are allowed (e.g. Set-Cookie, Vary, Link, Cache-Control, CORS Access-Control-Allow-*); single-valued headers such as Content-Type, Location, ETag are rejected - use headersResponseSet for those.", "items": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 255, "description": "Header name" }, "value": { "type": "string", "description": "Header value" } }, "required": [ "name", "value" ] } }, "headersResponseRemove": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Override the response header names removed from client responses when this rule matches (null inherits the zone list, an empty list removes none)" }, "debugHeadersEnabled": { "type": "boolean", "nullable": true, "description": "Enable debug headers in responses" }, "stripCacheTagHeaders": { "type": "boolean", "nullable": true, "description": "Override whether custom cache tag headers are stripped from responses when this rule matches (null inherits the zone setting)" }, "processingSsi": { "type": "boolean", "nullable": true, "description": "Enable Server Side Includes processing" }, "processingEsi": { "type": "boolean", "nullable": true, "description": "Enable Edge Side Includes processing" }, "customPagesMaintenanceActive": { "type": "boolean", "nullable": true, "description": "Activate maintenance mode" }, "securityEnabled": { "type": "boolean", "nullable": true, "description": "Override the zone WAF security toggle for this rule" }, "enabled": { "type": "boolean", "nullable": true, "description": "Override the zone master smartproxy toggle for this rule" }, "imageOptimizationEnabled": { "type": "boolean", "nullable": true, "description": "Enable image optimization" }, "imageOptimizationWebpEnabled": { "type": "boolean", "nullable": true, "description": "Enable WebP format conversion" }, "imageOptimizationAvifEnabled": { "type": "boolean", "nullable": true, "description": "Enable AVIF format conversion" }, "imageOptimizationAvifQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "AVIF conversion quality (1-100)" }, "imageOptimizationWebpQuality": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 100, "description": "WebP conversion quality (1-100)" }, "imageOptimizationJpegQualityTarget": { "type": "number", "format": "float", "nullable": true, "minimum": 0.0001, "maximum": 0.9999, "description": "JPEG SSIM quality target (0.0001-0.9999)" }, "imageOptimizationJpegEnabled": { "type": "boolean", "nullable": true, "description": "Enable JPEG recompression" }, "imageOptimizationJpegQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum JPEG recompression quality (10-100)" }, "imageOptimizationJpegQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum JPEG recompression quality (10-100)" }, "imageOptimizationPngEnabled": { "type": "boolean", "nullable": true, "description": "Enable PNG recompression" }, "imageOptimizationPngQualityMin": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Minimum PNG recompression quality (10-100)" }, "imageOptimizationPngQualityMax": { "type": "integer", "nullable": true, "minimum": 10, "maximum": 100, "description": "Maximum PNG recompression quality (10-100)" }, "minifyHtml": { "type": "boolean", "nullable": true, "description": "Enable HTML minification" }, "basicAuth": { "type": "object", "nullable": true, "description": "Override basic auth settings. Enable/disable basic auth or restrict to specific users.", "properties": { "enabled": { "type": "boolean", "description": "Enable or disable basic auth" }, "allowedUserIds": { "type": "array", "items": { "type": "string", "format": "uuid" }, "nullable": true, "description": "UUIDs of basic auth users allowed. Null means all zone users." } }, "required": [ "enabled" ] }, "defaultBackend": { "type": "object", "nullable": true, "description": "Override the zone default backend. Pick an origin server or a load balancer belonging to the rule zone.", "properties": { "type": { "type": "string", "enum": [ "origin", "load_balancer" ], "description": "Backend kind" }, "id": { "type": "string", "format": "uuid", "description": "UUID of the origin server or load balancer" } }, "required": [ "type", "id" ] }, "backendPortOverride": { "type": "integer", "nullable": true, "minimum": 1, "maximum": 65535, "description": "Override the backend port. Applies on top of whichever backend is resolved (zone default or rule DEFAULT_BACKEND)." } }, "additionalProperties": false } } }, "custom-page": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "error", "maintenance", "security", "challenge" ] }, "html": { "type": [ "string", "null" ] } } }, "custom-page.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "type": { "type": "string", "enum": [ "error", "maintenance", "security", "challenge" ] }, "html": { "type": [ "string", "null" ] } } } ] }, "dns-record-dns_record.read": { "type": "object", "properties": { "recordId": { "description": "Numeric identifier for this DNS record. Read-only; combined with the domain UUID to form the resource `id`.", "example": 123456, "type": "integer" }, "domainId": { "description": "UUID (RFC 4122) of the managed domain this record belongs to.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string" }, "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorStatus": { "description": "Current health-monitor status. Read-only.", "example": 0, "type": "integer" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" }, "id": { "readOnly": true, "description": "Composite resource identifier in the form `{domainId}:{recordId}`.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e:123456", "type": "string" }, "typeString": { "readOnly": true, "description": "Human-readable DNS record-type label derived from `type` (e.g. \"A\", \"CNAME\", \"MX\"). Read-only.", "example": "A", "type": "string" } } }, "dns-record-dns_record.write": { "type": "object", "properties": { "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" } } }, "dns-record-dns_record.write.jsonMergePatch": { "type": "object", "properties": { "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" } } }, "dns-record-domain.read_domain.item": { "type": "object", "properties": { "recordId": { "description": "Numeric identifier for this DNS record. Read-only; combined with the domain UUID to form the resource `id`.", "example": 123456, "type": "integer" }, "domainId": { "description": "UUID (RFC 4122) of the managed domain this record belongs to.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string" }, "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorStatus": { "description": "Current health-monitor status. Read-only.", "example": 0, "type": "integer" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" }, "id": { "readOnly": true, "description": "Composite resource identifier in the form `{domainId}:{recordId}`.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e:123456", "type": "string" }, "typeString": { "readOnly": true, "description": "Human-readable DNS record-type label derived from `type` (e.g. \"A\", \"CNAME\", \"MX\"). Read-only.", "example": "A", "type": "string" } } }, "dns-record.jsonld-dns_record.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "recordId": { "description": "Numeric identifier for this DNS record. Read-only; combined with the domain UUID to form the resource `id`.", "example": 123456, "type": "integer" }, "domainId": { "description": "UUID (RFC 4122) of the managed domain this record belongs to.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string" }, "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorStatus": { "description": "Current health-monitor status. Read-only.", "example": 0, "type": "integer" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" }, "id": { "readOnly": true, "description": "Composite resource identifier in the form `{domainId}:{recordId}`.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e:123456", "type": "string" }, "typeString": { "readOnly": true, "description": "Human-readable DNS record-type label derived from `type` (e.g. \"A\", \"CNAME\", \"MX\"). Read-only.", "example": "A", "type": "string" } } } ] }, "dns-record.jsonld-domain.read_domain.item": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "recordId": { "description": "Numeric identifier for this DNS record. Read-only; combined with the domain UUID to form the resource `id`.", "example": 123456, "type": "integer" }, "domainId": { "description": "UUID (RFC 4122) of the managed domain this record belongs to.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string" }, "type": { "type": "integer", "enum": [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 ], "description": "Numeric DNS record-type code: 0=A, 1=AAAA, 2=CNAME, 3=TXT, 4=MX, 5=Redirect, 6=Flatten, 7=PullZone, 8=SRV, 9=CAA, 10=PTR, 11=Script, 12=NS, 13=SVCB, 14=HTTPS. On create/update you may send either the integer code or the equivalent string label (e.g. \"A\", \"CNAME\").", "example": 0 }, "ttl": { "description": "Time-to-live in seconds. When supplied, must be between 15 and 86400; defaults to 3600 when omitted on create.", "example": 3600, "type": "integer" }, "value": { "description": "The record's value/target; its meaning depends on `type` (e.g. an IPv4 address for A, a hostname for CNAME/MX, text for TXT). Required on create.", "example": "192.0.2.1", "type": "string" }, "name": { "description": "Record name / subdomain label relative to the domain (use \"@\" to target the apex). Required on create.", "example": "www", "type": "string" }, "weight": { "description": "Relative weight, 0-65535. Only allowed for A, AAAA, CNAME and SRV records.", "example": 0, "type": "integer" }, "priority": { "description": "Priority, 0-65535. Only allowed for MX, SRV, HTTPS and SVCB records. May be null; send null on update to clear it.", "example": 10, "type": [ "integer", "null" ] }, "port": { "description": "Target port, 0-65535. Only allowed for SRV records.", "example": 0, "type": "integer" }, "flags": { "description": "CAA flags byte, 0-255. Only allowed for CAA records.", "example": 0, "type": "integer" }, "tag": { "description": "CAA property tag (e.g. \"issue\", \"issuewild\", \"iodef\"). Only allowed for CAA records.", "example": "issue", "type": "string" }, "monitorStatus": { "description": "Current health-monitor status. Read-only.", "example": 0, "type": "integer" }, "monitorType": { "type": "integer", "enum": [ 0, 1, 2, 3 ], "description": "Health-monitoring mode: 0=None, 1=Ping, 2=Http, 3=Monitor. Only applicable to A, AAAA and CNAME records.", "example": 0 }, "comment": { "description": "Free-text note attached to the record.", "example": "Primary web server", "type": "string" }, "id": { "readOnly": true, "description": "Composite resource identifier in the form `{domainId}:{recordId}`.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e:123456", "type": "string" }, "typeString": { "readOnly": true, "description": "Human-readable DNS record-type label derived from `type` (e.g. \"A\", \"CNAME\", \"MX\"). Read-only.", "example": "A", "type": "string" } } } ] }, "domain-domain.create": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "description": "The apex (root) domain name managed by this zone. Stored lowercase and limited to 255 characters. Must be a registrable apex domain with a recognised top-level domain - subdomains such as \"sub.example.com\" are rejected. Internationalised names must be supplied in punycode (xn--) form.", "example": "example.com", "type": "string" } } }, "domain-domain.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the domain (UUID v4).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "The apex (root) domain name managed by this zone. Stored lowercase and limited to 255 characters. Must be a registrable apex domain with a recognised top-level domain - subdomains such as \"sub.example.com\" are rejected. Internationalised names must be supplied in punycode (xn--) form.", "example": "example.com", "type": "string" }, "shared": { "description": "Whether this is a shared domain. Shared domains are managed centrally and their certificate is a shared certificate, so hostnames from any organization may be attached without the usual same-organization restriction. Read-only.", "default": false, "example": false, "type": "boolean" }, "dnsEnabled": { "description": "Whether managed DNS is enabled for this domain. When enabled, a managed DNS zone backs the domain and its DNS records can be imported, exported, and edited; import and export require this to be true. This is the only field writable via the update (PATCH) operation.", "default": false, "example": true, "type": "boolean" }, "dnsStatus": { "default": "inactive", "type": "string", "enum": [ "inactive", "active" ], "description": "Provisioning status of the domain's managed DNS zone. `inactive` - no managed DNS zone is active yet (the default). `active` - the managed DNS zone is provisioned and serving records.", "example": "active" }, "dnsRecordCount": { "description": "Cached number of DNS records present in the managed DNS zone.", "default": 0, "example": 12, "type": "integer" }, "createdAt": { "readOnly": true, "description": "Timestamp when the domain was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the domain was last updated (ISO 8601).", "example": "2026-01-16T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] }, "domain-domain.read_domain.item": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the domain (UUID v4).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "The apex (root) domain name managed by this zone. Stored lowercase and limited to 255 characters. Must be a registrable apex domain with a recognised top-level domain - subdomains such as \"sub.example.com\" are rejected. Internationalised names must be supplied in punycode (xn--) form.", "example": "example.com", "type": "string" }, "shared": { "description": "Whether this is a shared domain. Shared domains are managed centrally and their certificate is a shared certificate, so hostnames from any organization may be attached without the usual same-organization restriction. Read-only.", "default": false, "example": false, "type": "boolean" }, "dnsEnabled": { "description": "Whether managed DNS is enabled for this domain. When enabled, a managed DNS zone backs the domain and its DNS records can be imported, exported, and edited; import and export require this to be true. This is the only field writable via the update (PATCH) operation.", "default": false, "example": true, "type": "boolean" }, "dnsStatus": { "default": "inactive", "type": "string", "enum": [ "inactive", "active" ], "description": "Provisioning status of the domain's managed DNS zone. `inactive` - no managed DNS zone is active yet (the default). `active` - the managed DNS zone is provisioned and serving records.", "example": "active" }, "dnsRecordCount": { "description": "Cached number of DNS records present in the managed DNS zone.", "default": 0, "example": 12, "type": "integer" }, "dnsRecords": { "type": "array", "items": { "$ref": "#/components/schemas/dns-record-domain.read_domain.item" } }, "createdAt": { "readOnly": true, "description": "Timestamp when the domain was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the domain was last updated (ISO 8601).", "example": "2026-01-16T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] }, "domain-domain.write.jsonMergePatch": { "type": "object", "properties": { "dnsEnabled": { "description": "Whether managed DNS is enabled for this domain. When enabled, a managed DNS zone backs the domain and its DNS records can be imported, exported, and edited; import and export require this to be true. This is the only field writable via the update (PATCH) operation.", "default": false, "example": true, "type": "boolean" } } }, "domain.DnsImportOutput-domain.read": { "type": "object" }, "domain.DnsImportOutput.jsonld-domain.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object" } ] }, "domain.DomainDnsCheckOutput": { "type": "object", "properties": { "nameservers": { "type": "array", "items": { "type": "string" } } } }, "domain.DomainDnsCheckOutput.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "nameservers": { "type": "array", "items": { "type": "string" } } } } ] }, "domain.jsonld-domain.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the domain (UUID v4).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "The apex (root) domain name managed by this zone. Stored lowercase and limited to 255 characters. Must be a registrable apex domain with a recognised top-level domain - subdomains such as \"sub.example.com\" are rejected. Internationalised names must be supplied in punycode (xn--) form.", "example": "example.com", "type": "string" }, "shared": { "description": "Whether this is a shared domain. Shared domains are managed centrally and their certificate is a shared certificate, so hostnames from any organization may be attached without the usual same-organization restriction. Read-only.", "default": false, "example": false, "type": "boolean" }, "dnsEnabled": { "description": "Whether managed DNS is enabled for this domain. When enabled, a managed DNS zone backs the domain and its DNS records can be imported, exported, and edited; import and export require this to be true. This is the only field writable via the update (PATCH) operation.", "default": false, "example": true, "type": "boolean" }, "dnsStatus": { "default": "inactive", "type": "string", "enum": [ "inactive", "active" ], "description": "Provisioning status of the domain's managed DNS zone. `inactive` - no managed DNS zone is active yet (the default). `active` - the managed DNS zone is provisioned and serving records.", "example": "active" }, "dnsRecordCount": { "description": "Cached number of DNS records present in the managed DNS zone.", "default": 0, "example": 12, "type": "integer" }, "createdAt": { "readOnly": true, "description": "Timestamp when the domain was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the domain was last updated (ISO 8601).", "example": "2026-01-16T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] } ] }, "domain.jsonld-domain.read_domain.item": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the domain (UUID v4).", "example": "0193b6c2-8f1a-7c3d-9e2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "The apex (root) domain name managed by this zone. Stored lowercase and limited to 255 characters. Must be a registrable apex domain with a recognised top-level domain - subdomains such as \"sub.example.com\" are rejected. Internationalised names must be supplied in punycode (xn--) form.", "example": "example.com", "type": "string" }, "shared": { "description": "Whether this is a shared domain. Shared domains are managed centrally and their certificate is a shared certificate, so hostnames from any organization may be attached without the usual same-organization restriction. Read-only.", "default": false, "example": false, "type": "boolean" }, "dnsEnabled": { "description": "Whether managed DNS is enabled for this domain. When enabled, a managed DNS zone backs the domain and its DNS records can be imported, exported, and edited; import and export require this to be true. This is the only field writable via the update (PATCH) operation.", "default": false, "example": true, "type": "boolean" }, "dnsStatus": { "default": "inactive", "type": "string", "enum": [ "inactive", "active" ], "description": "Provisioning status of the domain's managed DNS zone. `inactive` - no managed DNS zone is active yet (the default). `active` - the managed DNS zone is provisioned and serving records.", "example": "active" }, "dnsRecordCount": { "description": "Cached number of DNS records present in the managed DNS zone.", "default": 0, "example": 12, "type": "integer" }, "dnsRecords": { "type": "array", "items": { "$ref": "#/components/schemas/dns-record.jsonld-domain.read_domain.item" } }, "createdAt": { "readOnly": true, "description": "Timestamp when the domain was created (ISO 8601).", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the domain was last updated (ISO 8601).", "example": "2026-01-16T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name" ] } ] }, "hostname-hostname.create_hostname.write": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "description": "Fully-qualified hostname (e.g. www.example.com). Required, unique, at most 255 characters, must be a syntactically valid hostname, and is normalized to lowercase.", "example": "www.example.com", "type": "string" }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "hostname-hostname.dns.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the hostname (UUIDv4).", "example": "9f1b2c3d-4e5f-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Fully-qualified hostname (e.g. www.example.com). Required, unique, at most 255 characters, must be a syntactically valid hostname, and is normalized to lowercase.", "example": "www.example.com", "type": "string" }, "cnameTarget": { "description": "System-generated unique CNAME target the customer points their DNS at. Read-only; assigned automatically when the hostname is created.", "type": [ "string", "null" ] }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "dnsTargetStatus": { "default": "pending", "type": "string", "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "Result of the most recent DNS target verification (read-only). \"pending\" - not yet verified (initial state, or reset after a failed check); \"valid\" - DNS points at the expected target (matching CNAME, or an apex resolving to enough Smoxy A records); \"degraded\" - apex resolving to only some of the expected Smoxy A records; \"invalid\" - DNS does not point at the expected target; \"proxied\" - the A records resolve through a known CDN proxy range.", "example": "pending" }, "dnsObservedValue": { "description": "The DNS value observed during the last check - the resolved CNAME target, or the comma-separated A records - or null if nothing was resolved. Read-only.", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "description": "Timestamp of the last DNS target check, or null if it has never been checked. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "createdAt": { "readOnly": true, "description": "Timestamp when the hostname was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the hostname was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "aRecordTargets": { "readOnly": true, "description": "For an apex hostname, the IP addresses the customer must set as A records at the apex - the IPs the hostname's CNAME target currently resolves to. Empty for non-apex hostnames or when the target cannot be resolved. Read-only.", "example": [ "203.0.113.10", "203.0.113.11" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "isApex": { "readOnly": true, "description": "Whether this hostname is the apex (root) of its domain - its name equals the domain name. An apex hostname cannot use the generated CNAME and must be pointed at the A-record targets instead. Read-only.", "example": false, "type": "boolean" }, "recordName": { "readOnly": true, "description": "The DNS record host/name the customer creates for this hostname: \"@\" for an apex hostname, otherwise the label - the hostname name with the trailing \".\" stripped (e.g. \"www\" for \"www.example.com\"). Read-only.", "example": "@", "type": "string" } }, "required": [ "name" ] }, "hostname-hostname.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the hostname (UUIDv4).", "example": "9f1b2c3d-4e5f-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "domain": { "description": "The domain this hostname belongs to, as an IRI. Derived from the hostname name and resolved or created for the owning organization when the hostname is created; read-only.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "zone": { "description": "The zone that owns this hostname, as an IRI, or null when the hostname is owned by a redirect. Writable as the target of a zone-to-zone move (PATCH within a zone) and of the zone-to-redirect reassignment PATCH.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "redirect": { "description": "The redirect that owns this hostname, as an IRI, or null when the hostname is owned by a zone. A hostname always has exactly one owner - either a zone or a redirect. Reassigned via the reassignment PATCH rather than written directly.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Fully-qualified hostname (e.g. www.example.com). Required, unique, at most 255 characters, must be a syntactically valid hostname, and is normalized to lowercase.", "example": "www.example.com", "type": "string" }, "cnameTarget": { "description": "System-generated unique CNAME target the customer points their DNS at. Read-only; assigned automatically when the hostname is created.", "type": [ "string", "null" ] }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "dnsTargetStatus": { "default": "pending", "type": "string", "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "Result of the most recent DNS target verification (read-only). \"pending\" - not yet verified (initial state, or reset after a failed check); \"valid\" - DNS points at the expected target (matching CNAME, or an apex resolving to enough Smoxy A records); \"degraded\" - apex resolving to only some of the expected Smoxy A records; \"invalid\" - DNS does not point at the expected target; \"proxied\" - the A records resolve through a known CDN proxy range.", "example": "pending" }, "dnsObservedValue": { "description": "The DNS value observed during the last check - the resolved CNAME target, or the comma-separated A records - or null if nothing was resolved. Read-only.", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "description": "Timestamp of the last DNS target check, or null if it has never been checked. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "createdAt": { "readOnly": true, "description": "Timestamp when the hostname was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the hostname was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "sharedCertificate": { "readOnly": true, "description": "Whether this hostname sits on a shared domain - covered by a shared certificate the consuming organization does not own and cannot manage. The frontend setup guide uses this to skip the SSL check. Read-only.", "example": false, "type": "boolean" }, "isApex": { "readOnly": true, "description": "Whether this hostname is the apex (root) of its domain - its name equals the domain name. An apex hostname cannot use the generated CNAME and must be pointed at the A-record targets instead. Read-only.", "example": false, "type": "boolean" } }, "required": [ "name" ] }, "hostname-hostname.reassign.jsonMergePatch": { "type": "object", "properties": { "zone": { "description": "The zone that owns this hostname, as an IRI, or null when the hostname is owned by a redirect. Writable as the target of a zone-to-zone move (PATCH within a zone) and of the zone-to-redirect reassignment PATCH.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "redirect": { "description": "The redirect that owns this hostname, as an IRI, or null when the hostname is owned by a zone. A hostname always has exactly one owner - either a zone or a redirect. Reassigned via the reassignment PATCH rather than written directly.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "reassignRedirectTargetHostname": { "description": "Write-only. Target of the redirect to create when converting this hostname to a redirect-owned hostname via the reassignment PATCH: a hostname optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"); a target containing a path or query string requires \"reassignRedirectMode\" \"domain\". Must be sent together with \"reassignRedirectMode\". Not persisted and always null on read.", "example": "example.com", "type": [ "string", "null" ] }, "reassignRedirectMode": { "description": "Write-only. Mode of the redirect to create when converting this hostname to a redirect-owned hostname via the reassignment PATCH. Must be sent together with \"reassignRedirectTargetHostname\". Either \"path\" or \"domain\"; \"domain\" is required when the target contains a path or query string.", "type": "string", "enum": [ "path", "domain" ], "example": "path" } } }, "hostname-hostname.write_hostname.zone.write.jsonMergePatch": { "type": "object", "properties": { "zone": { "description": "The zone that owns this hostname, as an IRI, or null when the hostname is owned by a redirect. Writable as the target of a zone-to-zone move (PATCH within a zone) and of the zone-to-redirect reassignment PATCH.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "hostname.jsonld-hostname.dns.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the hostname (UUIDv4).", "example": "9f1b2c3d-4e5f-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Fully-qualified hostname (e.g. www.example.com). Required, unique, at most 255 characters, must be a syntactically valid hostname, and is normalized to lowercase.", "example": "www.example.com", "type": "string" }, "cnameTarget": { "description": "System-generated unique CNAME target the customer points their DNS at. Read-only; assigned automatically when the hostname is created.", "type": [ "string", "null" ] }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "dnsTargetStatus": { "default": "pending", "type": "string", "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "Result of the most recent DNS target verification (read-only). \"pending\" - not yet verified (initial state, or reset after a failed check); \"valid\" - DNS points at the expected target (matching CNAME, or an apex resolving to enough Smoxy A records); \"degraded\" - apex resolving to only some of the expected Smoxy A records; \"invalid\" - DNS does not point at the expected target; \"proxied\" - the A records resolve through a known CDN proxy range.", "example": "pending" }, "dnsObservedValue": { "description": "The DNS value observed during the last check - the resolved CNAME target, or the comma-separated A records - or null if nothing was resolved. Read-only.", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "description": "Timestamp of the last DNS target check, or null if it has never been checked. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "createdAt": { "readOnly": true, "description": "Timestamp when the hostname was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the hostname was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "aRecordTargets": { "readOnly": true, "description": "For an apex hostname, the IP addresses the customer must set as A records at the apex - the IPs the hostname's CNAME target currently resolves to. Empty for non-apex hostnames or when the target cannot be resolved. Read-only.", "example": [ "203.0.113.10", "203.0.113.11" ], "type": [ "array", "null" ], "items": { "type": "string" } }, "isApex": { "readOnly": true, "description": "Whether this hostname is the apex (root) of its domain - its name equals the domain name. An apex hostname cannot use the generated CNAME and must be pointed at the A-record targets instead. Read-only.", "example": false, "type": "boolean" }, "recordName": { "readOnly": true, "description": "The DNS record host/name the customer creates for this hostname: \"@\" for an apex hostname, otherwise the label - the hostname name with the trailing \".\" stripped (e.g. \"www\" for \"www.example.com\"). Read-only.", "example": "@", "type": "string" } }, "required": [ "name" ] } ] }, "hostname.jsonld-hostname.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the hostname (UUIDv4).", "example": "9f1b2c3d-4e5f-6789-abcd-ef0123456789", "type": "string", "format": "uuid" }, "domain": { "description": "The domain this hostname belongs to, as an IRI. Derived from the hostname name and resolved or created for the owning organization when the hostname is created; read-only.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "zone": { "description": "The zone that owns this hostname, as an IRI, or null when the hostname is owned by a redirect. Writable as the target of a zone-to-zone move (PATCH within a zone) and of the zone-to-redirect reassignment PATCH.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "redirect": { "description": "The redirect that owns this hostname, as an IRI, or null when the hostname is owned by a zone. A hostname always has exactly one owner - either a zone or a redirect. Reassigned via the reassignment PATCH rather than written directly.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Fully-qualified hostname (e.g. www.example.com). Required, unique, at most 255 characters, must be a syntactically valid hostname, and is normalized to lowercase.", "example": "www.example.com", "type": "string" }, "cnameTarget": { "description": "System-generated unique CNAME target the customer points their DNS at. Read-only; assigned automatically when the hostname is created.", "type": [ "string", "null" ] }, "cdnEnabled": { "description": "Whether the CDN pull zone is enabled for this hostname. Toggling this provisions or tears down the CDN configuration. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "dnsTargetStatus": { "default": "pending", "type": "string", "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "Result of the most recent DNS target verification (read-only). \"pending\" - not yet verified (initial state, or reset after a failed check); \"valid\" - DNS points at the expected target (matching CNAME, or an apex resolving to enough Smoxy A records); \"degraded\" - apex resolving to only some of the expected Smoxy A records; \"invalid\" - DNS does not point at the expected target; \"proxied\" - the A records resolve through a known CDN proxy range.", "example": "pending" }, "dnsObservedValue": { "description": "The DNS value observed during the last check - the resolved CNAME target, or the comma-separated A records - or null if nothing was resolved. Read-only.", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "description": "Timestamp of the last DNS target check, or null if it has never been checked. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "createdAt": { "readOnly": true, "description": "Timestamp when the hostname was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the hostname was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "sharedCertificate": { "readOnly": true, "description": "Whether this hostname sits on a shared domain - covered by a shared certificate the consuming organization does not own and cannot manage. The frontend setup guide uses this to skip the SSL check. Read-only.", "example": false, "type": "boolean" }, "isApex": { "readOnly": true, "description": "Whether this hostname is the apex (root) of its domain - its name equals the domain name. An apex hostname cannot use the generated CNAME and must be pointed at the A-record targets instead. Read-only.", "example": false, "type": "boolean" } }, "required": [ "name" ] } ] }, "invitation": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the invitation (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "organization": { "description": "The organization this invitation grants access to, exposed as its IRI.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" }, "status": { "type": "string", "enum": [ "pending", "accepted", "declined", "expired", "cancelled" ], "description": "Read-only lifecycle status of the invitation. Starts as \"pending\"; becomes \"accepted\" or \"declined\" by the invitee, \"expired\" once the TTL passes, or \"cancelled\" when revoked.", "example": "pending" }, "invitedBy": { "readOnly": true, "description": "The inviter as their organization-member IRI within this invitation's organization (serialized as \"invitedBy\" on the org-scoped endpoints). Null when there is no inviter or they are no longer a member of the organization.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" }, "createdAt": { "readOnly": true, "description": "Timestamp when the invitation was created (set on persist).", "example": "2026-07-01T10:15:30+00:00", "type": "string", "format": "date-time" }, "expiresAt": { "description": "Timestamp when the invitation expires. Derived from the INVITATION_TTL_DAYS configuration; once passed, the invitation can no longer be accepted and is eventually marked \"expired\".", "example": "2026-07-08T10:15:30+00:00", "type": "string", "format": "date-time" }, "acceptedAt": { "readOnly": true, "description": "Timestamp when the invitation was accepted, or null if it has not been accepted.", "example": "2026-07-02T09:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "expired": { "readOnly": true, "type": "boolean" } }, "required": [ "email", "role", "status" ] }, "invitation-invitation.read_invitation.read.me": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the invitation (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "organization": { "$ref": "#/components/schemas/organization-invitation.read_invitation.read.me" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" }, "status": { "type": "string", "enum": [ "pending", "accepted", "declined", "expired", "cancelled" ], "description": "Read-only lifecycle status of the invitation. Starts as \"pending\"; becomes \"accepted\" or \"declined\" by the invitee, \"expired\" once the TTL passes, or \"cancelled\" when revoked.", "example": "pending" }, "invitedBy": { "anyOf": [ { "$ref": "#/components/schemas/User-invitation.read_invitation.read.me" }, { "type": "null" } ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the invitation was created (set on persist).", "example": "2026-07-01T10:15:30+00:00", "type": "string", "format": "date-time" }, "expiresAt": { "description": "Timestamp when the invitation expires. Derived from the INVITATION_TTL_DAYS configuration; once passed, the invitation can no longer be accepted and is eventually marked \"expired\".", "example": "2026-07-08T10:15:30+00:00", "type": "string", "format": "date-time" }, "acceptedAt": { "readOnly": true, "description": "Timestamp when the invitation was accepted, or null if it has not been accepted.", "example": "2026-07-02T09:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "email", "role", "status" ] }, "invitation-invitation.read_invitation.read.org": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the invitation (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "organization": { "description": "The organization this invitation grants access to, exposed as its IRI.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" }, "status": { "type": "string", "enum": [ "pending", "accepted", "declined", "expired", "cancelled" ], "description": "Read-only lifecycle status of the invitation. Starts as \"pending\"; becomes \"accepted\" or \"declined\" by the invitee, \"expired\" once the TTL passes, or \"cancelled\" when revoked.", "example": "pending" }, "createdAt": { "readOnly": true, "description": "Timestamp when the invitation was created (set on persist).", "example": "2026-07-01T10:15:30+00:00", "type": "string", "format": "date-time" }, "expiresAt": { "description": "Timestamp when the invitation expires. Derived from the INVITATION_TTL_DAYS configuration; once passed, the invitation can no longer be accepted and is eventually marked \"expired\".", "example": "2026-07-08T10:15:30+00:00", "type": "string", "format": "date-time" }, "acceptedAt": { "readOnly": true, "description": "Timestamp when the invitation was accepted, or null if it has not been accepted.", "example": "2026-07-02T09:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "invitedBy": { "readOnly": true, "description": "The inviter as their organization-member IRI within this invitation's organization (serialized as \"invitedBy\" on the org-scoped endpoints). Null when there is no inviter or they are no longer a member of the organization.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" } }, "required": [ "email", "role", "status" ] }, "invitation-invitation.write": { "type": "object", "required": [ "email", "role" ], "properties": { "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" } } }, "invitation.jsonld-invitation.read_invitation.read.me": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the invitation (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "organization": { "$ref": "#/components/schemas/organization.jsonld-invitation.read_invitation.read.me" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" }, "status": { "type": "string", "enum": [ "pending", "accepted", "declined", "expired", "cancelled" ], "description": "Read-only lifecycle status of the invitation. Starts as \"pending\"; becomes \"accepted\" or \"declined\" by the invitee, \"expired\" once the TTL passes, or \"cancelled\" when revoked.", "example": "pending" }, "invitedBy": { "anyOf": [ { "$ref": "#/components/schemas/User.jsonld-invitation.read_invitation.read.me" }, { "type": "null" } ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the invitation was created (set on persist).", "example": "2026-07-01T10:15:30+00:00", "type": "string", "format": "date-time" }, "expiresAt": { "description": "Timestamp when the invitation expires. Derived from the INVITATION_TTL_DAYS configuration; once passed, the invitation can no longer be accepted and is eventually marked \"expired\".", "example": "2026-07-08T10:15:30+00:00", "type": "string", "format": "date-time" }, "acceptedAt": { "readOnly": true, "description": "Timestamp when the invitation was accepted, or null if it has not been accepted.", "example": "2026-07-02T09:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "email", "role", "status" ] } ] }, "invitation.jsonld-invitation.read_invitation.read.org": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the invitation (UUID v4).", "example": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d", "type": "string", "format": "uuid" }, "organization": { "description": "The organization this invitation grants access to, exposed as its IRI.", "example": "/api/organizations/1", "type": "string", "format": "iri-reference" }, "email": { "format": "email", "maxLength": 180, "description": "Email address of the person being invited. Required, must be a valid email, max 180 characters. Stored lowercased and trimmed.", "externalDocs": { "url": "https://schema.org/email" }, "example": "alice@example.com", "type": "string" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "Organization role the invitee will be granted on acceptance. OWNER can manage members and delete the organization; MANAGER can modify the organization and manage zones; VIEWER is read-only. Only an existing OWNER may grant the OWNER role.", "example": "MANAGER" }, "status": { "type": "string", "enum": [ "pending", "accepted", "declined", "expired", "cancelled" ], "description": "Read-only lifecycle status of the invitation. Starts as \"pending\"; becomes \"accepted\" or \"declined\" by the invitee, \"expired\" once the TTL passes, or \"cancelled\" when revoked.", "example": "pending" }, "createdAt": { "readOnly": true, "description": "Timestamp when the invitation was created (set on persist).", "example": "2026-07-01T10:15:30+00:00", "type": "string", "format": "date-time" }, "expiresAt": { "description": "Timestamp when the invitation expires. Derived from the INVITATION_TTL_DAYS configuration; once passed, the invitation can no longer be accepted and is eventually marked \"expired\".", "example": "2026-07-08T10:15:30+00:00", "type": "string", "format": "date-time" }, "acceptedAt": { "readOnly": true, "description": "Timestamp when the invitation was accepted, or null if it has not been accepted.", "example": "2026-07-02T09:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "invitedBy": { "readOnly": true, "description": "The inviter as their organization-member IRI within this invitation's organization (serialized as \"invitedBy\" on the org-scoped endpoints). Null when there is no inviter or they are no longer a member of the organization.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" } }, "required": [ "email", "role", "status" ] } ] }, "ip-list-ip_list.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of the IP list.", "example": "0197c9a3-5f2e-7b41-9c8d-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "organization": { "description": "The organization that owns this IP list (read-only).", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the IP list. Required, 1-255 characters, and unique within the organization.", "example": "Office allowlist", "type": "string" }, "description": { "maxLength": 1000, "description": "Optional free-text description of the IP list (max 1000 characters).", "example": "Corporate office egress ranges", "type": [ "string", "null" ] }, "entries": { "maxItems": 500, "description": "IP addresses and/or CIDR blocks that make up the list. Each entry must be a valid IPv4/IPv6 address or a canonical CIDR block (host bits must be zero, e.g. \"203.0.113.0/24\"). Entries must be unique and non-overlapping (an entry contained within another is rejected), at most 500 entries, and each entry is trimmed of surrounding whitespace. IPv4-mapped IPv6 addresses (e.g. \"::ffff:1.2.3.4\") are not allowed.", "example": [ "203.0.113.0/24", "198.51.100.7", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } }, "createdAt": { "readOnly": true, "description": "Timestamp when the IP list was created (read-only).", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the IP list was last updated (read-only).", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "entries" ] }, "ip-list-ip_list.write": { "type": "object", "required": [ "name", "entries" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the IP list. Required, 1-255 characters, and unique within the organization.", "example": "Office allowlist", "type": "string" }, "description": { "maxLength": 1000, "description": "Optional free-text description of the IP list (max 1000 characters).", "example": "Corporate office egress ranges", "type": [ "string", "null" ] }, "entries": { "maxItems": 500, "description": "IP addresses and/or CIDR blocks that make up the list. Each entry must be a valid IPv4/IPv6 address or a canonical CIDR block (host bits must be zero, e.g. \"203.0.113.0/24\"). Entries must be unique and non-overlapping (an entry contained within another is rejected), at most 500 entries, and each entry is trimmed of surrounding whitespace. IPv4-mapped IPv6 addresses (e.g. \"::ffff:1.2.3.4\") are not allowed.", "example": [ "203.0.113.0/24", "198.51.100.7", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } } } }, "ip-list-ip_list.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the IP list. Required, 1-255 characters, and unique within the organization.", "example": "Office allowlist", "type": "string" }, "description": { "maxLength": 1000, "description": "Optional free-text description of the IP list (max 1000 characters).", "example": "Corporate office egress ranges", "type": [ "string", "null" ] }, "entries": { "maxItems": 500, "description": "IP addresses and/or CIDR blocks that make up the list. Each entry must be a valid IPv4/IPv6 address or a canonical CIDR block (host bits must be zero, e.g. \"203.0.113.0/24\"). Entries must be unique and non-overlapping (an entry contained within another is rejected), at most 500 entries, and each entry is trimmed of surrounding whitespace. IPv4-mapped IPv6 addresses (e.g. \"::ffff:1.2.3.4\") are not allowed.", "example": [ "203.0.113.0/24", "198.51.100.7", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } } } }, "ip-list.jsonld-ip_list.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier (UUID v4) of the IP list.", "example": "0197c9a3-5f2e-7b41-9c8d-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "organization": { "description": "The organization that owns this IP list (read-only).", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the IP list. Required, 1-255 characters, and unique within the organization.", "example": "Office allowlist", "type": "string" }, "description": { "maxLength": 1000, "description": "Optional free-text description of the IP list (max 1000 characters).", "example": "Corporate office egress ranges", "type": [ "string", "null" ] }, "entries": { "maxItems": 500, "description": "IP addresses and/or CIDR blocks that make up the list. Each entry must be a valid IPv4/IPv6 address or a canonical CIDR block (host bits must be zero, e.g. \"203.0.113.0/24\"). Entries must be unique and non-overlapping (an entry contained within another is rejected), at most 500 entries, and each entry is trimmed of surrounding whitespace. IPv4-mapped IPv6 addresses (e.g. \"::ffff:1.2.3.4\") are not allowed.", "example": [ "203.0.113.0/24", "198.51.100.7", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } }, "createdAt": { "readOnly": true, "description": "Timestamp when the IP list was created (read-only).", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the IP list was last updated (read-only).", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "entries" ] } ] }, "legacy-api-token-legacy_api_token.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the legacy API token record.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "legacyOrgId": { "description": "Legacy integer organization id the token is scoped to, or null for an account-wide token. Retained from the legacy hub because it is part of the signed payload.", "example": 1234, "type": [ "integer", "null" ] }, "expiredAt": { "description": "When the token expires, or null if it never expires. A token past this instant no longer authenticates.", "example": "2024-12-31T23:59:59+00:00", "type": [ "string", "null" ], "format": "date-time" }, "comment": { "description": "Free-text note the user attached to the token in the legacy hub, or null if none. Up to 255 characters.", "example": "CI deploy token", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "When the token record was created in the new hub (set on import).", "example": "2024-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "tokenPreview": { "readOnly": true, "description": "A short, non-reversible preview of the token (first 8 characters of the selector followed by an ellipsis) so users can recognise a token without exposing the full key.", "example": "a1b2c3d4…", "type": "string" } } }, "legacy-api-token.jsonld-legacy_api_token.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the legacy API token record.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "legacyOrgId": { "description": "Legacy integer organization id the token is scoped to, or null for an account-wide token. Retained from the legacy hub because it is part of the signed payload.", "example": 1234, "type": [ "integer", "null" ] }, "expiredAt": { "description": "When the token expires, or null if it never expires. A token past this instant no longer authenticates.", "example": "2024-12-31T23:59:59+00:00", "type": [ "string", "null" ], "format": "date-time" }, "comment": { "description": "Free-text note the user attached to the token in the legacy hub, or null if none. Up to 255 characters.", "example": "CI deploy token", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "When the token record was created in the new hub (set on import).", "example": "2024-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "tokenPreview": { "readOnly": true, "description": "A short, non-reversible preview of the token (first 8 characters of the selector followed by an ellipsis) so users can recognise a token without exposing the full key.", "example": "a1b2c3d4…", "type": "string" } } } ] }, "load-balancer-load_balancer.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the load balancer (UUID v4), assigned by the server.", "example": "0f9d6a2e-4c3b-4e1a-9f2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable name of the load balancer. Required, up to 255 characters, and must be unique within the organization.", "example": "eu-web-pool", "type": "string" }, "method": { "type": "string", "enum": [ "random", "ip_hash" ], "description": "Algorithm used to distribute traffic across the load balancer's origin servers. `random` distributes requests across the origins at random; `ip_hash` consistently routes requests from the same client IP to the same origin.", "example": "random" }, "requestHostname": { "maxLength": 255, "description": "Optional Host header value forwarded to the origin servers. When set, must be a valid hostname without wildcards (up to 255 characters). Leave null or empty to keep the default behavior.", "example": "origin.example.com", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the load balancer was created (ISO 8601). Read-only, set by the server.", "example": "2025-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the load balancer was last updated (ISO 8601). Read-only, set by the server.", "example": "2025-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/LoadBalancerOrigin-load_balancer.read" } } }, "required": [ "name", "method" ] }, "load-balancer-load_balancer.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the load balancer. Required, up to 255 characters, and must be unique within the organization.", "example": "eu-web-pool", "type": "string" }, "method": { "type": "string", "enum": [ "random", "ip_hash" ], "description": "Algorithm used to distribute traffic across the load balancer's origin servers. `random` distributes requests across the origins at random; `ip_hash` consistently routes requests from the same client IP to the same origin.", "example": "random" }, "requestHostname": { "maxLength": 255, "description": "Optional Host header value forwarded to the origin servers. When set, must be a valid hostname without wildcards (up to 255 characters). Leave null or empty to keep the default behavior.", "example": "origin.example.com", "type": [ "string", "null" ] }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/LoadBalancerOrigin-load_balancer.write" } } } }, "load-balancer-load_balancer.write_load_balancer.create": { "type": "object", "required": [ "name", "method" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the load balancer. Required, up to 255 characters, and must be unique within the organization.", "example": "eu-web-pool", "type": "string" }, "method": { "type": "string", "enum": [ "random", "ip_hash" ], "description": "Algorithm used to distribute traffic across the load balancer's origin servers. `random` distributes requests across the origins at random; `ip_hash` consistently routes requests from the same client IP to the same origin.", "example": "random" }, "requestHostname": { "maxLength": 255, "description": "Optional Host header value forwarded to the origin servers. When set, must be a valid hostname without wildcards (up to 255 characters). Leave null or empty to keep the default behavior.", "example": "origin.example.com", "type": [ "string", "null" ] }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/LoadBalancerOrigin-load_balancer.write_load_balancer.create" } } } }, "load-balancer.jsonld-load_balancer.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the load balancer (UUID v4), assigned by the server.", "example": "0f9d6a2e-4c3b-4e1a-9f2b-1a2b3c4d5e6f", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable name of the load balancer. Required, up to 255 characters, and must be unique within the organization.", "example": "eu-web-pool", "type": "string" }, "method": { "type": "string", "enum": [ "random", "ip_hash" ], "description": "Algorithm used to distribute traffic across the load balancer's origin servers. `random` distributes requests across the origins at random; `ip_hash` consistently routes requests from the same client IP to the same origin.", "example": "random" }, "requestHostname": { "maxLength": 255, "description": "Optional Host header value forwarded to the origin servers. When set, must be a valid hostname without wildcards (up to 255 characters). Leave null or empty to keep the default behavior.", "example": "origin.example.com", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the load balancer was created (ISO 8601). Read-only, set by the server.", "example": "2025-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the load balancer was last updated (ISO 8601). Read-only, set by the server.", "example": "2025-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/LoadBalancerOrigin.jsonld-load_balancer.read" } } }, "required": [ "name", "method" ] } ] }, "mail-log-mail_log.read": { "type": "object", "description": "Append-only record of a transactional email that was sent. One row per\nrecipient address. Written best-effort by {@see \\App\\Service\\EmailService};\na logging failure never blocks the send. Rotated after 30 days by the\nscheduled PruneMailLogs job.", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the mail log entry (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "email_verification", "password_reset", "password_changed", "organization_invitation", "bunny_cdn_cert_sync_failure", "certificate_renewal_failure_digest", "certificate_san_dns_missing_report" ], "description": "The kind of email that was sent.", "example": "certificate_san_dns_missing_report" }, "recipientEmail": { "description": "The recipient email address the message was sent to.", "example": "owner@example.com", "type": "string" }, "organizationId": { "description": "The id of the organization this email relates to, or null for account-level emails.", "example": 42, "type": [ "integer", "null" ] }, "sentAt": { "description": "When the email was sent.", "example": "2026-07-21T08:00:00+00:00", "type": "string", "format": "date-time" } } }, "mail-log.jsonld-mail_log.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the mail log entry (UUID v4).", "example": "9d1e8a4c-6b2f-4d3e-8a1b-2c3d4e5f6a7b", "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "email_verification", "password_reset", "password_changed", "organization_invitation", "bunny_cdn_cert_sync_failure", "certificate_renewal_failure_digest", "certificate_san_dns_missing_report" ], "description": "The kind of email that was sent.", "example": "certificate_san_dns_missing_report" }, "recipientEmail": { "description": "The recipient email address the message was sent to.", "example": "owner@example.com", "type": "string" }, "organizationId": { "description": "The id of the organization this email relates to, or null for account-level emails.", "example": 42, "type": [ "integer", "null" ] }, "sentAt": { "description": "When the email was sent.", "example": "2026-07-21T08:00:00+00:00", "type": "string", "format": "date-time" } } } ], "description": "Append-only record of a transactional email that was sent. One row per\nrecipient address. Written best-effort by {@see \\App\\Service\\EmailService};\na logging failure never blocks the send. Rotated after 30 days by the\nscheduled PruneMailLogs job." }, "member-organization_member.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the membership record.", "example": "5c2e1f9a-3b7d-4c6e-8a1f-0b2d3e4f5a6b", "type": "string", "format": "uuid" }, "user": { "$ref": "#/components/schemas/User-organization_member.read" }, "organization": { "description": "The organization this membership belongs to.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "The member's role within the organization, which determines their permissions.\n- `OWNER` - Full control: manage members (invite, change roles, remove), modify and delete the organization, and manage zones. An organization must always have at least one OWNER, and only an existing OWNER can grant the OWNER role.\n- `MANAGER` - Can modify the organization and manage zones, but cannot manage members or delete the organization.\n- `VIEWER` - Read-only access to the organization's resources.", "example": "MANAGER" }, "invitedBy": { "anyOf": [ { "$ref": "#/components/schemas/User-organization_member.read" }, { "type": "null" } ] }, "joinedAt": { "readOnly": true, "description": "Timestamp when the user joined the organization. Set automatically when the membership is created and never changes.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "user", "role" ] }, "member-organization_member.update.jsonMergePatch": { "type": "object", "properties": { "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "The member's role within the organization, which determines their permissions.\n- `OWNER` - Full control: manage members (invite, change roles, remove), modify and delete the organization, and manage zones. An organization must always have at least one OWNER, and only an existing OWNER can grant the OWNER role.\n- `MANAGER` - Can modify the organization and manage zones, but cannot manage members or delete the organization.\n- `VIEWER` - Read-only access to the organization's resources.", "example": "MANAGER" } } }, "member.jsonld-organization_member.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the membership record.", "example": "5c2e1f9a-3b7d-4c6e-8a1f-0b2d3e4f5a6b", "type": "string", "format": "uuid" }, "user": { "$ref": "#/components/schemas/User.jsonld-organization_member.read" }, "organization": { "description": "The organization this membership belongs to.", "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "role": { "type": "string", "enum": [ "OWNER", "MANAGER", "VIEWER" ], "description": "The member's role within the organization, which determines their permissions.\n- `OWNER` - Full control: manage members (invite, change roles, remove), modify and delete the organization, and manage zones. An organization must always have at least one OWNER, and only an existing OWNER can grant the OWNER role.\n- `MANAGER` - Can modify the organization and manage zones, but cannot manage members or delete the organization.\n- `VIEWER` - Read-only access to the organization's resources.", "example": "MANAGER" }, "invitedBy": { "anyOf": [ { "$ref": "#/components/schemas/User.jsonld-organization_member.read" }, { "type": "null" } ] }, "joinedAt": { "readOnly": true, "description": "Timestamp when the user joined the organization. Set automatically when the membership is created and never changes.", "example": "2025-06-15T10:30:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "user", "role" ] } ] }, "optimizer-job": { "type": "object", "properties": { "ts": { "type": "string" }, "zone_id": { "type": "string" }, "status": { "type": "string" }, "drop_reason": { "type": "string" }, "image_type": { "type": "string" }, "target_format": { "type": "string" }, "trigger": { "type": "string" }, "url": { "type": "string" }, "original_size_n": { "type": "integer" }, "variant_size_n": { "type": "integer" }, "bytes_saved_n": { "type": "integer" }, "compression_ratio_n": { "type": "number" }, "remote_load_ms_n": { "type": "number" }, "encode_ms_n": { "type": "number" }, "total_ms_n": { "type": "number" }, "box": { "type": "string" }, "host": { "type": "string" } } }, "optimizer-job-log": { "type": "object", "properties": { "ts": { "type": "string" }, "level": { "type": "string" }, "service": { "type": "string" }, "box": { "type": "string" }, "env": { "type": "string" }, "zone_id": { "type": "string" }, "request_id": { "type": "string" }, "module": { "type": "string" }, "msg": { "type": "string" }, "fields": { "type": "object" }, "category": { "type": "string" } } }, "optimizer-job-log.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "fields": { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } } } } ] }, "optimizer-job.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "fields": { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } } } } ] }, "organization-domain.admin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" } }, "required": [ "name" ] }, "organization-invitation.read_invitation.read.me": { "type": "object", "required": [ "name" ], "properties": { "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" } } }, "organization-organization.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" }, "plan": { "default": "FREE", "type": "string", "enum": [ "FREE", "SMOXY", "CUSTOM" ], "description": "Subscription plan of the organization. Defaults to FREE on creation. Read-only.", "example": "FREE" }, "trialEndsAt": { "description": "Timestamp when the organization's trial period ends, or null if there is no active trial. Defaults to 30 days after creation; cleared automatically when a paid external customer number is assigned. Read-only.", "example": "2026-07-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "scalecommerce": { "description": "Whether this organization is a scalecommerce customer. Defaults to false. Read-only.", "default": false, "example": false, "type": "boolean" }, "require2fa": { "description": "When true, every member of this organization must have 2FA enabled;\nmembers without it are forced into enrollment on their next login.", "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the organization was created (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the organization was last updated (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "myRole": { "readOnly": true, "description": "Role of the requesting user on this organization (OWNER, MANAGER, or VIEWER). Null when the requester has no membership of their own, for example a system administrator inspecting a foreign organization, and on endpoints that do not resolve it.", "type": [ "string", "null" ], "enum": [ "OWNER", "MANAGER", "VIEWER", null ] }, "externalCustomerId": { "readOnly": true, "description": "External customer number linked to this organization's billing account, or null if none is set. Read-only.", "example": "CUST-000123", "type": [ "string", "null" ] } }, "required": [ "name" ] }, "organization-organization.read_organization.admin": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" }, "plan": { "default": "FREE", "type": "string", "enum": [ "FREE", "SMOXY", "CUSTOM" ], "description": "Subscription plan of the organization. Defaults to FREE on creation. Read-only.", "example": "FREE" }, "cidrRanges": { "maxItems": 50, "description": "CIDR ranges that constrain which addresses customers may configure as origin servers in this organization. An empty list means no restriction. Maximum 50 entries; each must be a valid CIDR. Read-only.", "example": [ "203.0.113.0/24", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } }, "trialEndsAt": { "description": "Timestamp when the organization's trial period ends, or null if there is no active trial. Defaults to 30 days after creation; cleared automatically when a paid external customer number is assigned. Read-only.", "example": "2026-07-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "scalecommerce": { "description": "Whether this organization is a scalecommerce customer. Defaults to false. Read-only.", "default": false, "example": false, "type": "boolean" }, "require2fa": { "description": "When true, every member of this organization must have 2FA enabled;\nmembers without it are forced into enrollment on their next login.", "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the organization was created (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the organization was last updated (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "myRole": { "readOnly": true, "description": "Role of the requesting user on this organization (OWNER, MANAGER, or VIEWER). Null when the requester has no membership of their own, for example a system administrator inspecting a foreign organization, and on endpoints that do not resolve it.", "type": [ "string", "null" ], "enum": [ "OWNER", "MANAGER", "VIEWER", null ] }, "externalCustomerId": { "readOnly": true, "description": "External customer number linked to this organization's billing account, or null if none is set. Read-only.", "example": "CUST-000123", "type": [ "string", "null" ] } }, "required": [ "name" ] }, "organization.OrganizationAdminInput-organization.write_organization.admin": { "type": "object", "properties": { "plan": { "type": [ "string", "null" ], "enum": [ "FREE", "SMOXY", "CUSTOM", null ] }, "scalecommerce": { "type": [ "boolean", "null" ] }, "trialEndsAt": { "type": [ "string", "null" ], "format": "date-time" }, "cidrRanges": { "description": "CIDR ranges that constrain which addresses customers can configure as\norigin servers inside this organization. Empty list means no restriction.", "type": [ "array", "null" ], "items": { "type": "string" } }, "externalCustomerId": { "maxLength": 255, "type": [ "string", "null" ] }, "name": { "maxLength": 255, "type": [ "string", "null" ] }, "require2fa": { "description": "Toggle enforcement of 2FA for all members. Only an OWNER may change this;\nthe OrganizationProcessor authorizes the change via the MANAGE_SECURITY\nvoter. Null means \"not provided\" (leave unchanged) on a PATCH.", "type": [ "boolean", "null" ] } }, "required": [ "name" ] }, "organization.OrganizationAdminInput-organization.write_organization.admin.jsonMergePatch": { "type": "object", "properties": { "plan": { "type": [ "string", "null" ], "enum": [ "FREE", "SMOXY", "CUSTOM", null ] }, "scalecommerce": { "type": [ "boolean", "null" ] }, "trialEndsAt": { "type": [ "string", "null" ], "format": "date-time" }, "cidrRanges": { "description": "CIDR ranges that constrain which addresses customers can configure as\norigin servers inside this organization. Empty list means no restriction.", "type": [ "array", "null" ], "items": { "type": "string" } }, "externalCustomerId": { "maxLength": 255, "type": [ "string", "null" ] }, "name": { "maxLength": 255, "type": [ "string", "null" ] }, "require2fa": { "description": "Toggle enforcement of 2FA for all members. Only an OWNER may change this;\nthe OrganizationProcessor authorizes the change via the MANAGE_SECURITY\nvoter. Null means \"not provided\" (leave unchanged) on a PATCH.", "type": [ "boolean", "null" ] } } }, "organization.OrganizationPublicInput-organization.write": { "type": "object", "required": [ "name" ], "properties": { "name": { "maxLength": 255, "type": [ "string", "null" ] }, "require2fa": { "description": "Toggle enforcement of 2FA for all members. Only an OWNER may change this;\nthe OrganizationProcessor authorizes the change via the MANAGE_SECURITY\nvoter. Null means \"not provided\" (leave unchanged) on a PATCH.", "type": [ "boolean", "null" ] } } }, "organization.OrganizationPublicInput-organization.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "type": [ "string", "null" ] }, "require2fa": { "description": "Toggle enforcement of 2FA for all members. Only an OWNER may change this;\nthe OrganizationProcessor authorizes the change via the MANAGE_SECURITY\nvoter. Null means \"not provided\" (leave unchanged) on a PATCH.", "type": [ "boolean", "null" ] } } }, "organization.jsonld-domain.admin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" } }, "required": [ "name" ] } ] }, "organization.jsonld-invitation.read_invitation.read.me": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "required": [ "name" ], "properties": { "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" } } } ] }, "organization.jsonld-organization.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" }, "plan": { "default": "FREE", "type": "string", "enum": [ "FREE", "SMOXY", "CUSTOM" ], "description": "Subscription plan of the organization. Defaults to FREE on creation. Read-only.", "example": "FREE" }, "trialEndsAt": { "description": "Timestamp when the organization's trial period ends, or null if there is no active trial. Defaults to 30 days after creation; cleared automatically when a paid external customer number is assigned. Read-only.", "example": "2026-07-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "scalecommerce": { "description": "Whether this organization is a scalecommerce customer. Defaults to false. Read-only.", "default": false, "example": false, "type": "boolean" }, "require2fa": { "description": "When true, every member of this organization must have 2FA enabled;\nmembers without it are forced into enrollment on their next login.", "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the organization was created (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the organization was last updated (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "myRole": { "readOnly": true, "description": "Role of the requesting user on this organization (OWNER, MANAGER, or VIEWER). Null when the requester has no membership of their own, for example a system administrator inspecting a foreign organization, and on endpoints that do not resolve it.", "type": [ "string", "null" ], "enum": [ "OWNER", "MANAGER", "VIEWER", null ] }, "externalCustomerId": { "readOnly": true, "description": "External customer number linked to this organization's billing account, or null if none is set. Read-only.", "example": "CUST-000123", "type": [ "string", "null" ] } }, "required": [ "name" ] } ] }, "organization.jsonld-organization.read_organization.admin": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique numeric identifier of the organization.", "example": 42, "anyOf": [ { "type": "integer" }, { "type": "string" } ] }, "name": { "minLength": 3, "maxLength": 255, "description": "Human-readable organization name. Must be unique across all organizations and 3–255 characters long (leading/trailing whitespace is trimmed).", "example": "Acme GmbH", "type": "string" }, "plan": { "default": "FREE", "type": "string", "enum": [ "FREE", "SMOXY", "CUSTOM" ], "description": "Subscription plan of the organization. Defaults to FREE on creation. Read-only.", "example": "FREE" }, "cidrRanges": { "maxItems": 50, "description": "CIDR ranges that constrain which addresses customers may configure as origin servers in this organization. An empty list means no restriction. Maximum 50 entries; each must be a valid CIDR. Read-only.", "example": [ "203.0.113.0/24", "2001:db8::/32" ], "type": "array", "items": { "type": "string" } }, "trialEndsAt": { "description": "Timestamp when the organization's trial period ends, or null if there is no active trial. Defaults to 30 days after creation; cleared automatically when a paid external customer number is assigned. Read-only.", "example": "2026-07-31T12:00:00+00:00", "type": [ "string", "null" ], "format": "date-time" }, "scalecommerce": { "description": "Whether this organization is a scalecommerce customer. Defaults to false. Read-only.", "default": false, "example": false, "type": "boolean" }, "require2fa": { "description": "When true, every member of this organization must have 2FA enabled;\nmembers without it are forced into enrollment on their next login.", "default": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the organization was created (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the organization was last updated (read-only).", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "myRole": { "readOnly": true, "description": "Role of the requesting user on this organization (OWNER, MANAGER, or VIEWER). Null when the requester has no membership of their own, for example a system administrator inspecting a foreign organization, and on endpoints that do not resolve it.", "type": [ "string", "null" ], "enum": [ "OWNER", "MANAGER", "VIEWER", null ] }, "externalCustomerId": { "readOnly": true, "description": "External customer number linked to this organization's billing account, or null if none is set. Read-only.", "example": "CUST-000123", "type": [ "string", "null" ] } }, "required": [ "name" ] } ] }, "origin-server-load_balancer.read": { "type": "object" }, "origin-server-origin.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the origin server (UUID). Read-only.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the origin server. Required, at most 255 characters, and must be unique within the organization.", "example": "primary-eu-west", "type": "string" }, "protocol": { "description": "Protocol the proxy uses to connect to the origin server. The protocol is not pinned to the port: non-canonical combinations such as http+443 or https+80 are accepted on purpose (e.g. TLS terminated on a non-default port, or HTTPS reverse-proxied in front of an internal HTTP service).", "type": "string", "enum": [ "http", "https" ], "example": "https" }, "address": { "maxLength": 255, "oneOf": [ { "format": "ipv6" } ], "description": "Network target the proxy connects to for this origin: a valid hostname (wildcards not allowed) or an IP address (IPv4 or IPv6). Required, at most 255 characters. Rejected if it resolves to a forbidden internal range (loopback, RFC1918, link-local, cloud metadata) to prevent SSRF. The address+port pair must be unique within the organization.", "example": "origin.example.com", "type": "string" }, "port": { "minimum": 1, "maximum": 65535, "description": "TCP port the proxy connects to on the origin. Required; any value in 1..65535 is allowed and is intentionally not pinned to the protocol default. The address+port pair must be unique within the organization.", "example": 443, "type": "integer" }, "requestHostname": { "maxLength": 255, "description": "Optional override for the upstream `Host` header sent to the origin. When null, the incoming request's Host is forwarded unchanged. Must be a valid hostname (wildcards not allowed) if set; at most 255 characters. Not subject to the origin address deny-list, since it only rewrites the outgoing Host header and never participates in route selection.", "example": "internal-app.example.com", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the origin server was created. Read-only.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the origin server was last updated. Read-only.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "protocol", "address", "port" ] }, "origin-server-origin.write": { "type": "object", "required": [ "name", "protocol", "address", "port" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable label for the origin server. Required, at most 255 characters, and must be unique within the organization.", "example": "primary-eu-west", "type": "string" }, "protocol": { "description": "Protocol the proxy uses to connect to the origin server. The protocol is not pinned to the port: non-canonical combinations such as http+443 or https+80 are accepted on purpose (e.g. TLS terminated on a non-default port, or HTTPS reverse-proxied in front of an internal HTTP service).", "type": "string", "enum": [ "http", "https" ], "example": "https" }, "address": { "maxLength": 255, "oneOf": [ { "format": "ipv6" } ], "description": "Network target the proxy connects to for this origin: a valid hostname (wildcards not allowed) or an IP address (IPv4 or IPv6). Required, at most 255 characters. Rejected if it resolves to a forbidden internal range (loopback, RFC1918, link-local, cloud metadata) to prevent SSRF. The address+port pair must be unique within the organization.", "example": "origin.example.com", "type": "string" }, "port": { "minimum": 1, "maximum": 65535, "description": "TCP port the proxy connects to on the origin. Required; any value in 1..65535 is allowed and is intentionally not pinned to the protocol default. The address+port pair must be unique within the organization.", "example": 443, "type": "integer" }, "requestHostname": { "maxLength": 255, "description": "Optional override for the upstream `Host` header sent to the origin. When null, the incoming request's Host is forwarded unchanged. Must be a valid hostname (wildcards not allowed) if set; at most 255 characters. Not subject to the origin address deny-list, since it only rewrites the outgoing Host header and never participates in route selection.", "example": "internal-app.example.com", "type": [ "string", "null" ] } } }, "origin-server-origin.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable label for the origin server. Required, at most 255 characters, and must be unique within the organization.", "example": "primary-eu-west", "type": "string" }, "protocol": { "description": "Protocol the proxy uses to connect to the origin server. The protocol is not pinned to the port: non-canonical combinations such as http+443 or https+80 are accepted on purpose (e.g. TLS terminated on a non-default port, or HTTPS reverse-proxied in front of an internal HTTP service).", "type": "string", "enum": [ "http", "https" ], "example": "https" }, "address": { "maxLength": 255, "oneOf": [ { "format": "ipv6" } ], "description": "Network target the proxy connects to for this origin: a valid hostname (wildcards not allowed) or an IP address (IPv4 or IPv6). Required, at most 255 characters. Rejected if it resolves to a forbidden internal range (loopback, RFC1918, link-local, cloud metadata) to prevent SSRF. The address+port pair must be unique within the organization.", "example": "origin.example.com", "type": "string" }, "port": { "minimum": 1, "maximum": 65535, "description": "TCP port the proxy connects to on the origin. Required; any value in 1..65535 is allowed and is intentionally not pinned to the protocol default. The address+port pair must be unique within the organization.", "example": 443, "type": "integer" }, "requestHostname": { "maxLength": 255, "description": "Optional override for the upstream `Host` header sent to the origin. When null, the incoming request's Host is forwarded unchanged. Must be a valid hostname (wildcards not allowed) if set; at most 255 characters. Not subject to the origin address deny-list, since it only rewrites the outgoing Host header and never participates in route selection.", "example": "internal-app.example.com", "type": [ "string", "null" ] } } }, "origin-server.jsonld-load_balancer.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object" } ] }, "origin-server.jsonld-origin.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the origin server (UUID). Read-only.", "example": "0f8fad5b-d9cb-469f-a165-70867728950e", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "description": "Human-readable label for the origin server. Required, at most 255 characters, and must be unique within the organization.", "example": "primary-eu-west", "type": "string" }, "protocol": { "description": "Protocol the proxy uses to connect to the origin server. The protocol is not pinned to the port: non-canonical combinations such as http+443 or https+80 are accepted on purpose (e.g. TLS terminated on a non-default port, or HTTPS reverse-proxied in front of an internal HTTP service).", "type": "string", "enum": [ "http", "https" ], "example": "https" }, "address": { "maxLength": 255, "oneOf": [ { "format": "ipv6" } ], "description": "Network target the proxy connects to for this origin: a valid hostname (wildcards not allowed) or an IP address (IPv4 or IPv6). Required, at most 255 characters. Rejected if it resolves to a forbidden internal range (loopback, RFC1918, link-local, cloud metadata) to prevent SSRF. The address+port pair must be unique within the organization.", "example": "origin.example.com", "type": "string" }, "port": { "minimum": 1, "maximum": 65535, "description": "TCP port the proxy connects to on the origin. Required; any value in 1..65535 is allowed and is intentionally not pinned to the protocol default. The address+port pair must be unique within the organization.", "example": 443, "type": "integer" }, "requestHostname": { "maxLength": 255, "description": "Optional override for the upstream `Host` header sent to the origin. When null, the incoming request's Host is forwarded unchanged. Must be a valid hostname (wildcards not allowed) if set; at most 255 characters. Not subject to the origin address deny-list, since it only rewrites the outgoing Host header and never participates in route selection.", "example": "internal-app.example.com", "type": [ "string", "null" ] }, "createdAt": { "readOnly": true, "description": "Timestamp when the origin server was created. Read-only.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the origin server was last updated. Read-only.", "example": "2026-01-15T09:30:00+00:00", "type": "string", "format": "date-time" } }, "required": [ "name", "protocol", "address", "port" ] } ] }, "redirect-map": { "type": "object", "description": "A single redirect within a zone's path-level redirect map: an exact source ->\ntarget with a mode and HTTP status. A zone has exactly one redirect map, stored\nas a single blob and projected to the edge; this plain (non-entity) API Platform\nresource is the paginated read model of that map, one collection member per\nredirect. See ingress/docs/redirects.md.", "properties": { "source": { "description": "Exact match key, \"host/path\".", "default": "", "example": "www.example.com/old", "type": "string" }, "target": { "description": "Redirect target: a full URL, or a host when mode is H.", "default": "", "example": "https://www.example.com/new", "type": "string" }, "mode": { "default": "L", "type": "string", "enum": [ "L", "Q", "H" ], "description": "L = literal (target is the final URL); Q = preserve-query (the incoming query string is appended to the target); H = host-swap (keep the incoming path, swap only the host).", "example": "L" }, "status": { "default": 301, "type": "integer", "enum": [ 301, 302, 307, 308 ], "description": "HTTP redirect status code.", "example": 301 } } }, "redirect-map.RedirectMapImportResult": { "type": "object", "description": "A single redirect within a zone's path-level redirect map: an exact source ->\ntarget with a mode and HTTP status. A zone has exactly one redirect map, stored\nas a single blob and projected to the edge; this plain (non-entity) API Platform\nresource is the paginated read model of that map, one collection member per\nredirect. See ingress/docs/redirects.md.", "properties": { "imported": { "description": "Number of redirects stored after validation.", "default": 0, "example": 3, "type": "integer" }, "collapsed": { "description": "Number of redirect chains collapsed into a single hop.", "default": 0, "example": 1, "type": "integer" }, "errors": { "description": "A message per row that was skipped or rejected.", "type": "array", "items": { "type": "string" } } } }, "redirect-map.RedirectMapImportResult.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "imported": { "description": "Number of redirects stored after validation.", "default": 0, "example": 3, "type": "integer" }, "collapsed": { "description": "Number of redirect chains collapsed into a single hop.", "default": 0, "example": 1, "type": "integer" }, "errors": { "description": "A message per row that was skipped or rejected.", "type": "array", "items": { "type": "string" } } } } ], "description": "A single redirect within a zone's path-level redirect map: an exact source ->\ntarget with a mode and HTTP status. A zone has exactly one redirect map, stored\nas a single blob and projected to the edge; this plain (non-entity) API Platform\nresource is the paginated read model of that map, one collection member per\nredirect. See ingress/docs/redirects.md." }, "redirect-map.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "source": { "description": "Exact match key, \"host/path\".", "default": "", "example": "www.example.com/old", "type": "string" }, "target": { "description": "Redirect target: a full URL, or a host when mode is H.", "default": "", "example": "https://www.example.com/new", "type": "string" }, "mode": { "default": "L", "type": "string", "enum": [ "L", "Q", "H" ], "description": "L = literal (target is the final URL); Q = preserve-query (the incoming query string is appended to the target); H = host-swap (keep the incoming path, swap only the host).", "example": "L" }, "status": { "default": 301, "type": "integer", "enum": [ 301, 302, 307, 308 ], "description": "HTTP redirect status code.", "example": 301 } } } ], "description": "A single redirect within a zone's path-level redirect map: an exact source ->\ntarget with a mode and HTTP status. A zone has exactly one redirect map, stored\nas a single blob and projected to the edge; this plain (non-entity) API Platform\nresource is the paginated read model of that map, one collection member per\nredirect. See ingress/docs/redirects.md." }, "redirect-redirect.create_redirect.write": { "type": "object", "required": [ "targetHostname", "mode" ], "properties": { "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" }, "sourceHostname": { "description": "The incoming hostname whose requests are redirected. Set once when the redirect is created (a Hostname is created under the source hostname's root domain) and read-only thereafter. Stored lower-cased.", "example": "old.example.com", "type": "string" } } }, "redirect-redirect.dns.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Auto-generated unique identifier of the redirect.", "example": 42, "type": "integer" }, "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" }, "createdAt": { "readOnly": true, "description": "Timestamp when the redirect was created.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the redirect was last updated.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "sourceHostname": { "description": "The incoming hostname whose requests are redirected. Set once when the redirect is created (a Hostname is created under the source hostname's root domain) and read-only thereafter. Stored lower-cased.", "example": "old.example.com", "type": "string" }, "cnameTarget": { "readOnly": true, "description": "Auto-generated unique CNAME target for the source hostname. The customer must point the source hostname's DNS CNAME record at this value for the redirect to take effect. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsTargetStatus": { "readOnly": true, "type": "string", "nullable": true, "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "DNS verification status of the source hostname's CNAME target. `pending` - not yet checked or currently unverified; `valid` - CNAME resolves to the expected target; `degraded` - partially correct; `invalid` - points to the wrong value; `proxied` - resolves through a proxy (e.g. Cloudflare). Read-only.", "example": "pending" }, "dnsObservedValue": { "readOnly": true, "description": "The DNS value actually observed for the source hostname during the last check (e.g. the resolved CNAME target). Null if never checked. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "readOnly": true, "description": "Timestamp of the last DNS target check for the source hostname. Null if never checked. Read-only.", "example": "2026-07-01T12:34:56+00:00", "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "targetHostname", "mode" ] }, "redirect-redirect.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Auto-generated unique identifier of the redirect.", "example": 42, "type": "integer" }, "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" }, "createdAt": { "readOnly": true, "description": "Timestamp when the redirect was created.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the redirect was last updated.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "sourceHostname": { "description": "The incoming hostname whose requests are redirected. Set once when the redirect is created (a Hostname is created under the source hostname's root domain) and read-only thereafter. Stored lower-cased.", "example": "old.example.com", "type": "string" }, "cnameTarget": { "readOnly": true, "description": "Auto-generated unique CNAME target for the source hostname. The customer must point the source hostname's DNS CNAME record at this value for the redirect to take effect. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsTargetStatus": { "readOnly": true, "type": "string", "nullable": true, "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "DNS verification status of the source hostname's CNAME target. `pending` - not yet checked or currently unverified; `valid` - CNAME resolves to the expected target; `degraded` - partially correct; `invalid` - points to the wrong value; `proxied` - resolves through a proxy (e.g. Cloudflare). Read-only.", "example": "pending" }, "dnsObservedValue": { "readOnly": true, "description": "The DNS value actually observed for the source hostname during the last check (e.g. the resolved CNAME target). Null if never checked. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "readOnly": true, "description": "Timestamp of the last DNS target check for the source hostname. Null if never checked. Read-only.", "example": "2026-07-01T12:34:56+00:00", "type": [ "string", "null" ], "format": "date-time" }, "domain": { "readOnly": true, "description": "The root domain the source hostname belongs to. Null if no source hostname or the domain is not resolvable. Read-only.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" } }, "required": [ "targetHostname", "mode" ] }, "redirect-redirect.write.jsonMergePatch": { "type": "object", "properties": { "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" } } }, "redirect.jsonld-redirect.dns.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Auto-generated unique identifier of the redirect.", "example": 42, "type": "integer" }, "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" }, "createdAt": { "readOnly": true, "description": "Timestamp when the redirect was created.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the redirect was last updated.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "sourceHostname": { "description": "The incoming hostname whose requests are redirected. Set once when the redirect is created (a Hostname is created under the source hostname's root domain) and read-only thereafter. Stored lower-cased.", "example": "old.example.com", "type": "string" }, "cnameTarget": { "readOnly": true, "description": "Auto-generated unique CNAME target for the source hostname. The customer must point the source hostname's DNS CNAME record at this value for the redirect to take effect. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsTargetStatus": { "readOnly": true, "type": "string", "nullable": true, "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "DNS verification status of the source hostname's CNAME target. `pending` - not yet checked or currently unverified; `valid` - CNAME resolves to the expected target; `degraded` - partially correct; `invalid` - points to the wrong value; `proxied` - resolves through a proxy (e.g. Cloudflare). Read-only.", "example": "pending" }, "dnsObservedValue": { "readOnly": true, "description": "The DNS value actually observed for the source hostname during the last check (e.g. the resolved CNAME target). Null if never checked. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "readOnly": true, "description": "Timestamp of the last DNS target check for the source hostname. Null if never checked. Read-only.", "example": "2026-07-01T12:34:56+00:00", "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "targetHostname", "mode" ] } ] }, "redirect.jsonld-redirect.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Auto-generated unique identifier of the redirect.", "example": 42, "type": "integer" }, "targetHostname": { "maxLength": 255, "description": "Destination that incoming requests to the source hostname are redirected to: a valid, non-empty hostname (no wildcards), optionally followed by a path and query string (e.g. \"www.example.com/en/sales\"). No scheme or fragment, at most 255 characters. A target containing a path or query string requires mode \"domain\". The hostname part is stored lower-cased.", "example": "www.example.com", "type": "string" }, "mode": { "default": "path", "type": "string", "enum": [ "path", "domain" ], "description": "Redirect mode determining how the source hostname is redirected to the target. `path` appends the incoming request path to the target hostname; `domain` redirects to the target as-is and is required when the target contains a path or query string. Defaults to `path`.", "example": "path" }, "createdAt": { "readOnly": true, "description": "Timestamp when the redirect was created.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the redirect was last updated.", "example": "2026-07-01T12:34:56+00:00", "type": "string", "format": "date-time" }, "sourceHostname": { "description": "The incoming hostname whose requests are redirected. Set once when the redirect is created (a Hostname is created under the source hostname's root domain) and read-only thereafter. Stored lower-cased.", "example": "old.example.com", "type": "string" }, "cnameTarget": { "readOnly": true, "description": "Auto-generated unique CNAME target for the source hostname. The customer must point the source hostname's DNS CNAME record at this value for the redirect to take effect. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsTargetStatus": { "readOnly": true, "type": "string", "nullable": true, "enum": [ "pending", "valid", "degraded", "invalid", "proxied" ], "description": "DNS verification status of the source hostname's CNAME target. `pending` - not yet checked or currently unverified; `valid` - CNAME resolves to the expected target; `degraded` - partially correct; `invalid` - points to the wrong value; `proxied` - resolves through a proxy (e.g. Cloudflare). Read-only.", "example": "pending" }, "dnsObservedValue": { "readOnly": true, "description": "The DNS value actually observed for the source hostname during the last check (e.g. the resolved CNAME target). Null if never checked. Read-only.", "example": "abc123.cname.smoxy.eu", "type": [ "string", "null" ] }, "dnsLastCheckedAt": { "readOnly": true, "description": "Timestamp of the last DNS target check for the source hostname. Null if never checked. Read-only.", "example": "2026-07-01T12:34:56+00:00", "type": [ "string", "null" ], "format": "date-time" }, "domain": { "readOnly": true, "description": "The root domain the source hostname belongs to. Null if no source hostname or the domain is not resolvable. Read-only.", "type": [ "string", "null" ], "format": "iri-reference", "example": "https://example.com/" } }, "required": [ "targetHostname", "mode" ] } ] }, "rewrite-rule-rewrite_rule.read": { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "zone": { "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the rule. Must be unique within the zone. Max 255 characters.", "example": "Redirect old blog paths", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. Max 5000 characters.", "example": "Rewrites legacy /blog/* URLs to the new /articles/* structure.", "type": [ "string", "null" ] }, "operator": { "type": "string", "enum": [ "equal", "regex", "regex_case_insensitive" ], "description": "How the source pattern is matched against the request URL. `equal` matches the path literally; `regex` matches with a case-sensitive regular expression; `regex_case_insensitive` matches with a case-insensitive regular expression. For the regex variants the source pattern must be a safe regular expression, and the target may reference its capture groups.", "example": "regex" }, "sourcePattern": { "maxLength": 2000, "description": "The URL/path pattern the rule matches. Interpreted literally for the `equal` operator or as a regular expression for the regex operators (in which case it must be a safe expression). Max 2000 characters.", "example": "^/blog/(.*)$", "type": "string" }, "target": { "maxLength": 2000, "description": "The replacement the matched URL is rewritten to. For regex operators this is a replacement template that may splice capture groups via `$1`, `$2`, … (or `${1}` form); `$0` is the whole match and `\\$` is a literal dollar sign. Any referenced group index must exist in the source pattern. Max 2000 characters.", "example": "/articles/$1", "type": "string" }, "order": { "description": "Execution order of the rule within the zone (lower runs first). If omitted on create the rule is appended to the end; when set explicitly, other rules are re-sequenced to keep the ordering contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not applied to traffic. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "createdAt": { "readOnly": true, "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "type": "string", "format": "date-time" } }, "required": [ "name", "operator", "sourcePattern", "target" ] }, "rewrite-rule-rewrite_rule.write": { "type": "object", "required": [ "name", "operator", "sourcePattern", "target" ], "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the rule. Must be unique within the zone. Max 255 characters.", "example": "Redirect old blog paths", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. Max 5000 characters.", "example": "Rewrites legacy /blog/* URLs to the new /articles/* structure.", "type": [ "string", "null" ] }, "operator": { "type": "string", "enum": [ "equal", "regex", "regex_case_insensitive" ], "description": "How the source pattern is matched against the request URL. `equal` matches the path literally; `regex` matches with a case-sensitive regular expression; `regex_case_insensitive` matches with a case-insensitive regular expression. For the regex variants the source pattern must be a safe regular expression, and the target may reference its capture groups.", "example": "regex" }, "sourcePattern": { "maxLength": 2000, "description": "The URL/path pattern the rule matches. Interpreted literally for the `equal` operator or as a regular expression for the regex operators (in which case it must be a safe expression). Max 2000 characters.", "example": "^/blog/(.*)$", "type": "string" }, "target": { "maxLength": 2000, "description": "The replacement the matched URL is rewritten to. For regex operators this is a replacement template that may splice capture groups via `$1`, `$2`, … (or `${1}` form); `$0` is the whole match and `\\$` is a literal dollar sign. Any referenced group index must exist in the source pattern. Max 2000 characters.", "example": "/articles/$1", "type": "string" }, "order": { "description": "Execution order of the rule within the zone (lower runs first). If omitted on create the rule is appended to the end; when set explicitly, other rules are re-sequenced to keep the ordering contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not applied to traffic. Defaults to true.", "default": true, "example": true, "type": "boolean" } } }, "rewrite-rule-rewrite_rule.write.jsonMergePatch": { "type": "object", "properties": { "name": { "maxLength": 255, "description": "Human-readable name of the rule. Must be unique within the zone. Max 255 characters.", "example": "Redirect old blog paths", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. Max 5000 characters.", "example": "Rewrites legacy /blog/* URLs to the new /articles/* structure.", "type": [ "string", "null" ] }, "operator": { "type": "string", "enum": [ "equal", "regex", "regex_case_insensitive" ], "description": "How the source pattern is matched against the request URL. `equal` matches the path literally; `regex` matches with a case-sensitive regular expression; `regex_case_insensitive` matches with a case-insensitive regular expression. For the regex variants the source pattern must be a safe regular expression, and the target may reference its capture groups.", "example": "regex" }, "sourcePattern": { "maxLength": 2000, "description": "The URL/path pattern the rule matches. Interpreted literally for the `equal` operator or as a regular expression for the regex operators (in which case it must be a safe expression). Max 2000 characters.", "example": "^/blog/(.*)$", "type": "string" }, "target": { "maxLength": 2000, "description": "The replacement the matched URL is rewritten to. For regex operators this is a replacement template that may splice capture groups via `$1`, `$2`, … (or `${1}` form); `$0` is the whole match and `\\$` is a literal dollar sign. Any referenced group index must exist in the source pattern. Max 2000 characters.", "example": "/articles/$1", "type": "string" }, "order": { "description": "Execution order of the rule within the zone (lower runs first). If omitted on create the rule is appended to the end; when set explicitly, other rules are re-sequenced to keep the ordering contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not applied to traffic. Defaults to true.", "default": true, "example": true, "type": "boolean" } } }, "rewrite-rule.jsonld-rewrite_rule.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "type": "string", "format": "uuid" }, "zone": { "type": "string", "format": "iri-reference", "example": "https://example.com/" }, "name": { "maxLength": 255, "description": "Human-readable name of the rule. Must be unique within the zone. Max 255 characters.", "example": "Redirect old blog paths", "type": "string" }, "description": { "maxLength": 5000, "description": "Optional free-text description of what the rule does. Max 5000 characters.", "example": "Rewrites legacy /blog/* URLs to the new /articles/* structure.", "type": [ "string", "null" ] }, "operator": { "type": "string", "enum": [ "equal", "regex", "regex_case_insensitive" ], "description": "How the source pattern is matched against the request URL. `equal` matches the path literally; `regex` matches with a case-sensitive regular expression; `regex_case_insensitive` matches with a case-insensitive regular expression. For the regex variants the source pattern must be a safe regular expression, and the target may reference its capture groups.", "example": "regex" }, "sourcePattern": { "maxLength": 2000, "description": "The URL/path pattern the rule matches. Interpreted literally for the `equal` operator or as a regular expression for the regex operators (in which case it must be a safe expression). Max 2000 characters.", "example": "^/blog/(.*)$", "type": "string" }, "target": { "maxLength": 2000, "description": "The replacement the matched URL is rewritten to. For regex operators this is a replacement template that may splice capture groups via `$1`, `$2`, … (or `${1}` form); `$0` is the whole match and `\\$` is a literal dollar sign. Any referenced group index must exist in the source pattern. Max 2000 characters.", "example": "/articles/$1", "type": "string" }, "order": { "description": "Execution order of the rule within the zone (lower runs first). If omitted on create the rule is appended to the end; when set explicitly, other rules are re-sequenced to keep the ordering contiguous.", "default": 0, "example": 0, "type": "integer" }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not applied to traffic. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "createdAt": { "readOnly": true, "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "type": "string", "format": "date-time" } }, "required": [ "name", "operator", "sourcePattern", "target" ] } ] }, "scenario-decision": { "type": "object", "properties": { "timestamp": { "type": "string" }, "scenario": { "type": "string" }, "ip": { "type": "string" }, "tenant_id": { "type": "string" }, "score_delta": { "type": "number" }, "score_after": { "type": "number" }, "action": { "type": "string" }, "testing": { "type": "integer" }, "duration_sec": { "type": "number" }, "reason": { "type": "string" }, "request_id": { "type": "string" } } }, "scenario-decision.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "fields": { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } } } } ] }, "search-search.read": { "type": "object", "properties": { "organizations": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "zones": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "domains": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "certificates": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "hostnames": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "loadBalancers": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "configurationRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "rewriteRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } }, "accessRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem-search.read" } } } }, "search.jsonld-search.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "organizations": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "zones": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "domains": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "certificates": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "hostnames": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "origins": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "loadBalancers": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "configurationRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "rewriteRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } }, "accessRules": { "type": "array", "items": { "$ref": "#/components/schemas/SearchResultItem.jsonld-search.read" } } } } ] }, "security-scenario-security_scenario.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the scenario (UUIDv4). Read-only.", "example": "0193b3e2-6c1a-7f2a-9a1b-2d3e4f5a6b7c", "type": "string", "format": "uuid" }, "name": { "readOnly": true, "description": "The scenario name, derived from the YAML `name:` key. It is unique per scope (per zone, or across all globals). Read-only: change it by editing the `definition`.", "default": "", "example": "block-sql-injection", "type": "string" }, "enabled": { "readOnly": true, "description": "Whether the scenario is active, derived from the YAML `enabled:` key (defaults to true). Disabled globals are filtered out of the per-zone global-scenarios projection entirely.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "description": "How this global scenario applies to zones by default when a zone has no explicit preference. `opt_out` = active for every zone unless that zone disabled it; `opt_in` = inactive for every zone unless that zone enabled it. Set directly (not part of the YAML). Ignored for zone-owned scenarios. Defaults to `opt_out`.", "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "example": "opt_out" }, "testing": { "readOnly": true, "description": "Whether the scenario runs in testing mode, derived from the YAML `testing:` key (defaults to false). Testing globals are not exposed to zones through the per-zone global-scenarios projection.", "default": false, "example": false, "type": "boolean" }, "evaluationScope": { "readOnly": true, "description": "Runtime counter-keying scope, derived from the YAML `scope:` key. Used for keying counters at evaluation time; it is not an ownership boundary. Null when the YAML omits `scope:`.", "example": "ip", "type": [ "string", "null" ] }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" }, "createdAt": { "readOnly": true, "description": "When the scenario was created (ISO 8601). Set automatically on create. Read-only.", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "When the scenario was last updated (ISO 8601). Set automatically on each save. Read-only.", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" } } }, "security-scenario-security_scenario.write": { "type": "object", "properties": { "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" } } }, "security-scenario-security_scenario.write.jsonMergePatch": { "type": "object", "properties": { "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" } } }, "security-scenario-security_scenario.write_admin_scenario.write": { "type": "object", "properties": { "participationMode": { "description": "How this global scenario applies to zones by default when a zone has no explicit preference. `opt_out` = active for every zone unless that zone disabled it; `opt_in` = inactive for every zone unless that zone enabled it. Set directly (not part of the YAML). Ignored for zone-owned scenarios. Defaults to `opt_out`.", "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "example": "opt_out" }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" } } }, "security-scenario-security_scenario.write_admin_scenario.write.jsonMergePatch": { "type": "object", "properties": { "participationMode": { "description": "How this global scenario applies to zones by default when a zone has no explicit preference. `opt_out` = active for every zone unless that zone disabled it; `opt_in` = inactive for every zone unless that zone enabled it. Set directly (not part of the YAML). Ignored for zone-owned scenarios. Defaults to `opt_out`.", "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "example": "opt_out" }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" } } }, "security-scenario.jsonld-security_scenario.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the scenario (UUIDv4). Read-only.", "example": "0193b3e2-6c1a-7f2a-9a1b-2d3e4f5a6b7c", "type": "string", "format": "uuid" }, "name": { "readOnly": true, "description": "The scenario name, derived from the YAML `name:` key. It is unique per scope (per zone, or across all globals). Read-only: change it by editing the `definition`.", "default": "", "example": "block-sql-injection", "type": "string" }, "enabled": { "readOnly": true, "description": "Whether the scenario is active, derived from the YAML `enabled:` key (defaults to true). Disabled globals are filtered out of the per-zone global-scenarios projection entirely.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "description": "How this global scenario applies to zones by default when a zone has no explicit preference. `opt_out` = active for every zone unless that zone disabled it; `opt_in` = inactive for every zone unless that zone enabled it. Set directly (not part of the YAML). Ignored for zone-owned scenarios. Defaults to `opt_out`.", "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "example": "opt_out" }, "testing": { "readOnly": true, "description": "Whether the scenario runs in testing mode, derived from the YAML `testing:` key (defaults to false). Testing globals are not exposed to zones through the per-zone global-scenarios projection.", "default": false, "example": false, "type": "boolean" }, "evaluationScope": { "readOnly": true, "description": "Runtime counter-keying scope, derived from the YAML `scope:` key. Used for keying counters at evaluation time; it is not an ownership boundary. Null when the YAML omits `scope:`.", "example": "ip", "type": [ "string", "null" ] }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" }, "createdAt": { "readOnly": true, "description": "When the scenario was created (ISO 8601). Set automatically on create. Read-only.", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "When the scenario was last updated (ISO 8601). Set automatically on each save. Read-only.", "example": "2026-07-01T09:30:00+00:00", "type": "string", "format": "date-time" } } } ] }, "sentinel-log": { "type": "object", "properties": { "event_time": { "type": "string" }, "ts": { "type": "string" }, "env": { "type": "string" }, "fingerprint": { "type": "string" }, "detector": { "type": "string" }, "kind": { "type": "string" }, "zone_id": { "type": "string" }, "host": { "type": "string" }, "severity": { "type": "string" }, "window_start": { "type": "string" }, "window_end": { "type": "string" }, "summary": { "type": "string" }, "evidence": { "type": "string" }, "deltas": { "type": "string" }, "baseline": { "type": "string" }, "triage": { "type": "string" } } }, "sentinel-log.jsonld": { "type": "object", "properties": { "event_time": { "type": "string" }, "ts": { "type": "string" }, "env": { "type": "string" }, "fingerprint": { "type": "string" }, "detector": { "type": "string" }, "kind": { "type": "string" }, "zone_id": { "type": "string" }, "host": { "type": "string" }, "severity": { "type": "string" }, "window_start": { "type": "string" }, "window_end": { "type": "string" }, "summary": { "type": "string" }, "evidence": { "type": "string" }, "deltas": { "type": "string" }, "baseline": { "type": "string" }, "triage": { "type": "string" } } }, "traffic-log": { "type": "object", "properties": { "event_time": { "type": "string" }, "zone_id": { "type": "string" }, "request_id": { "type": "string" }, "host": { "type": "string" }, "sni": { "type": "string" }, "method": { "type": "string" }, "protocol": { "type": "string" }, "uri": { "type": "string" }, "request_uri": { "type": "string" }, "referer": { "type": "string" }, "user_agent": { "type": "string" }, "remote_user": { "type": "string" }, "origin_status": { "type": "string" }, "tls_version": { "type": "string" }, "tls_cipher": { "type": "string" }, "cache_status": { "type": "string" }, "cache_variant": { "type": "string" }, "content_type": { "type": "string" }, "content_encoding": { "type": "string" }, "origin_addr": { "type": "string" }, "iprep_action": { "type": "string" }, "waf_action": { "type": "string" }, "waf_score": { "type": "string" }, "waf_rule": { "type": "string" }, "waf_rule_action": { "type": "string" }, "waf_rule_score": { "type": "string" }, "allowlist": { "type": "string" }, "error_reason": { "type": "string" }, "location": { "type": "string" }, "device_type": { "type": "string" }, "client_ip": { "type": "string" }, "box": { "type": "string" }, "env": { "type": "string" }, "served_by": { "type": "string" }, "core_side": { "type": "string" }, "geo_country": { "type": "string" }, "geo_subdivisions": { "type": "string" }, "geo_city": { "type": "string" }, "geo_asn": { "type": "string" }, "geo_asorg": { "type": "string" }, "geo_iseu": { "type": "string" }, "request_length_n": { "type": "integer" }, "status_code": { "type": "integer" }, "bytes_sent_n": { "type": "integer" }, "bytes_saved_n": { "type": "integer" }, "cache_ttl_n": { "type": "integer" }, "age_n": { "type": "integer" }, "iprep_score_n": { "type": "integer" }, "request_time_s": { "type": "number" }, "core_connect_time_s": { "type": "number" }, "core_time_s": { "type": "number" }, "origin_connect_time_s": { "type": "number" }, "origin_time_s": { "type": "number" }, "geo_lat": { "type": "number" }, "geo_lon": { "type": "number" } } }, "traffic-log.jsonld": { "type": "object", "properties": { "event_time": { "type": "string" }, "zone_id": { "type": "string" }, "request_id": { "type": "string" }, "host": { "type": "string" }, "sni": { "type": "string" }, "method": { "type": "string" }, "protocol": { "type": "string" }, "uri": { "type": "string" }, "request_uri": { "type": "string" }, "referer": { "type": "string" }, "user_agent": { "type": "string" }, "remote_user": { "type": "string" }, "origin_status": { "type": "string" }, "tls_version": { "type": "string" }, "tls_cipher": { "type": "string" }, "cache_status": { "type": "string" }, "cache_variant": { "type": "string" }, "content_type": { "type": "string" }, "content_encoding": { "type": "string" }, "origin_addr": { "type": "string" }, "iprep_action": { "type": "string" }, "waf_action": { "type": "string" }, "waf_score": { "type": "string" }, "waf_rule": { "type": "string" }, "waf_rule_action": { "type": "string" }, "waf_rule_score": { "type": "string" }, "allowlist": { "type": "string" }, "error_reason": { "type": "string" }, "location": { "type": "string" }, "device_type": { "type": "string" }, "client_ip": { "type": "string" }, "box": { "type": "string" }, "env": { "type": "string" }, "served_by": { "type": "string" }, "core_side": { "type": "string" }, "geo_country": { "type": "string" }, "geo_subdivisions": { "type": "string" }, "geo_city": { "type": "string" }, "geo_asn": { "type": "string" }, "geo_asorg": { "type": "string" }, "geo_iseu": { "type": "string" }, "request_length_n": { "type": "integer" }, "status_code": { "type": "integer" }, "bytes_sent_n": { "type": "integer" }, "bytes_saved_n": { "type": "integer" }, "cache_ttl_n": { "type": "integer" }, "age_n": { "type": "integer" }, "iprep_score_n": { "type": "integer" }, "request_time_s": { "type": "number" }, "core_connect_time_s": { "type": "number" }, "core_time_s": { "type": "number" }, "origin_connect_time_s": { "type": "number" }, "origin_time_s": { "type": "number" }, "geo_lat": { "type": "number" }, "geo_lon": { "type": "number" } } }, "update-profile-user.read_user.read.me": { "type": "object" }, "update-profile-user.update.jsonMergePatch": { "type": "object", "properties": { "firstName": { "maxLength": 100, "type": [ "string", "null" ] }, "lastName": { "maxLength": 100, "type": [ "string", "null" ] } } }, "update-profile.jsonld-user.read_user.read.me": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object" } ] }, "waf-rule-waf_rule.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the WAF rule (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } } }, "waf-rule-waf_rule.write": { "type": "object", "properties": { "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "waf-rule-waf_rule.write.jsonMergePatch": { "type": "object", "properties": { "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "waf-rule-waf_rule.write_admin_waf_rule.write": { "type": "object", "properties": { "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "waf-rule-waf_rule.write_admin_waf_rule.write.jsonMergePatch": { "type": "object", "properties": { "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" } } }, "waf-rule.jsonld-waf_rule.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the WAF rule (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" } } } ] }, "zone-allow-allow.read": { "type": "object", "properties": { "origin": { "description": "Entry origin: `manual` entries are admin-managed; `remote` entries are synced from machine-fetched CDN/proxy lists and are read-only (no item GET/DELETE).", "default": "manual", "type": "string", "enum": [ "manual", "remote" ], "example": "manual" }, "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] }, "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier for the entry: base64url of the source string (so dots and CIDR slashes are safe in a path segment).", "example": "MjAzLjAuMTEzLjU", "type": "string" } }, "required": [ "source" ] }, "zone-allow-allow.write": { "type": "object", "required": [ "source", "type" ], "properties": { "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" } } }, "zone-allow.jsonld-allow.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "origin": { "description": "Entry origin: `manual` entries are admin-managed; `remote` entries are synced from machine-fetched CDN/proxy lists and are read-only (no item GET/DELETE).", "default": "manual", "type": "string", "enum": [ "manual", "remote" ], "example": "manual" }, "geo": { "description": "Transient - geo of the source IP, populated by the providers on read for\n`type=ip` entries only.", "type": [ "object", "null" ], "additionalProperties": { "anyOf": [ { "type": "number" }, { "type": "integer" }, { "type": "string" }, { "type": "null" } ] } }, "source": { "description": "The trusted source to allow: an IPv4/IPv6 address, a CIDR range, or an ASN (`AS` followed by a 1–4294967295 number, e.g. `AS15169`). The global allowlist accepts all three; per-zone allowlists accept only IP and CIDR (ASN is rejected). Required and validated for format.", "example": "203.0.113.5", "type": "string" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch is rejected. `asn` is only valid on the global allowlist; per-zone allowlists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier for the entry: base64url of the source string (so dots and CIDR slashes are safe in a path segment).", "example": "MjAzLjAuMTEzLjU", "type": "string" } }, "required": [ "source" ] } ], "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] } } }, "zone-block-block.read": { "type": "object", "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] }, "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier: base64url (no padding) of the source string, so dots and CIDR slashes are safe in a single path segment.", "example": "MjAzLjAuMTEzLjEw", "type": "string" } }, "required": [ "source" ] }, "zone-block-block.update.jsonMergePatch": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" } } }, "zone-block-block.write": { "type": "object", "required": [ "source", "type" ], "properties": { "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" } } }, "zone-block.jsonld-block.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "geo": { "description": "Transient - geo of the source IP (same shape as the lookup endpoint's\n`geo`), populated by the providers on read for `type=ip` entries only.", "type": [ "object", "null" ], "additionalProperties": { "anyOf": [ { "type": "number" }, { "type": "integer" }, { "type": "string" }, { "type": "null" } ] } }, "source": { "description": "The block source: a valid IPv4/IPv6 address, a CIDR block, or an ASN (`AS` followed by an autonomous-system number 1–4294967295, e.g. `AS15169`). Immutable after creation.", "example": "203.0.113.10", "type": "string" }, "action": { "type": "string", "enum": [ "block", "challenge" ], "description": "What to do with traffic from this source: `block` denies the request outright; `challenge` makes the browser automatically solve a computational challenge before the request is allowed, with no CAPTCHA. Defaults to `block`.", "example": "block" }, "type": { "description": "The source type: `ip`, `cidr`, or `asn`. Required on create, and validated to match the `source` (`AS` => `asn`, a value containing `/` => `cidr`, otherwise => `ip`); a mismatch (e.g. `asn` with an IP source) is rejected. `asn` is only valid on the global blocklist; per-zone blocklists accept only `ip` and `cidr`.", "type": "string", "enum": [ "ip", "cidr", "asn" ], "example": "ip" }, "id": { "readOnly": true, "description": "Opaque, URL-safe identifier: base64url (no padding) of the source string, so dots and CIDR slashes are safe in a single path segment.", "example": "MjAzLjAuMTEzLjEw", "type": "string" } }, "required": [ "source" ] } ], "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] } } }, "zone-global-scenario-global_scenario.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the scenario (UUIDv4). Read-only.", "example": "0193b3e2-6c1a-7f2a-9a1b-2d3e4f5a6b7c", "type": "string", "format": "uuid" }, "name": { "readOnly": true, "description": "The scenario name, derived from the YAML `name:` key. It is unique per scope (per zone, or across all globals). Read-only: change it by editing the `definition`.", "default": "", "example": "block-sql-injection", "type": "string" }, "testing": { "readOnly": true, "description": "Whether the scenario runs in testing mode, derived from the YAML `testing:` key (defaults to false). Testing globals are not exposed to zones through the per-zone global-scenarios projection.", "default": false, "example": false, "type": "boolean" }, "evaluationScope": { "readOnly": true, "description": "Runtime counter-keying scope, derived from the YAML `scope:` key. Used for keying counters at evaluation time; it is not an ownership boundary. Null when the YAML omits `scope:`.", "example": "ip", "type": [ "string", "null" ] }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" }, "enabledForZone": { "description": "The effective on/off state of this global scenario for the zone in the URL. On read it reflects the zone's explicit preference, or the scenario's participation-mode default when none is set. PATCH it on the per-zone global-scenarios endpoint to toggle the scenario for the zone. Only present on the /zones/{zoneId}/security/global-scenarios projection.", "example": true, "type": [ "boolean", "null" ] } } }, "zone-global-scenario-global_scenario.write.jsonMergePatch": { "type": "object", "properties": { "enabledForZone": { "description": "The effective on/off state of this global scenario for the zone in the URL. On read it reflects the zone's explicit preference, or the scenario's participation-mode default when none is set. PATCH it on the per-zone global-scenarios endpoint to toggle the scenario for the zone. Only present on the /zones/{zoneId}/security/global-scenarios projection.", "example": true, "type": [ "boolean", "null" ] } } }, "zone-global-scenario.jsonld-global_scenario.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the scenario (UUIDv4). Read-only.", "example": "0193b3e2-6c1a-7f2a-9a1b-2d3e4f5a6b7c", "type": "string", "format": "uuid" }, "name": { "readOnly": true, "description": "The scenario name, derived from the YAML `name:` key. It is unique per scope (per zone, or across all globals). Read-only: change it by editing the `definition`.", "default": "", "example": "block-sql-injection", "type": "string" }, "testing": { "readOnly": true, "description": "Whether the scenario runs in testing mode, derived from the YAML `testing:` key (defaults to false). Testing globals are not exposed to zones through the per-zone global-scenarios projection.", "default": false, "example": false, "type": "boolean" }, "evaluationScope": { "readOnly": true, "description": "Runtime counter-keying scope, derived from the YAML `scope:` key. Used for keying counters at evaluation time; it is not an ownership boundary. Null when the YAML omits `scope:`.", "example": "ip", "type": [ "string", "null" ] }, "definition": { "description": "The scenario definition as raw YAML, stored verbatim. This is the only writable field: the `name`, `enabled`, `testing` and `evaluationScope` fields are derived from it on save. Must be a valid YAML mapping with a non-empty `name:` key, otherwise the request is rejected with 422.", "default": "", "example": "name: block-sql-injection\nenabled: true\ntesting: false\nscope: ip\n", "type": "string" }, "enabledForZone": { "description": "The effective on/off state of this global scenario for the zone in the URL. On read it reflects the zone's explicit preference, or the scenario's participation-mode default when none is set. PATCH it on the per-zone global-scenarios endpoint to toggle the scenario for the zone. Only present on the /zones/{zoneId}/security/global-scenarios projection.", "example": true, "type": [ "boolean", "null" ] } } } ] }, "zone-global-waf-rule-global_waf_rule.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the WAF rule (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "enabledForZone": { "description": "The effective on/off state of this global WAF rule for the zone in the URL. On read it reflects the zone's explicit preference, or the rule's participation-mode default when none is set (opt-out rules are on, opt-in rules are off). PATCH it to toggle the rule for the zone; a rule that is off for the zone is not enforced but still contributes to the shadow anomaly score.", "example": true, "type": [ "boolean", "null" ] } } }, "zone-global-waf-rule-global_waf_rule.write.jsonMergePatch": { "type": "object", "properties": { "enabledForZone": { "description": "The effective on/off state of this global WAF rule for the zone in the URL. On read it reflects the zone's explicit preference, or the rule's participation-mode default when none is set (opt-out rules are on, opt-in rules are off). PATCH it to toggle the rule for the zone; a rule that is off for the zone is not enforced but still contributes to the shadow anomaly score.", "example": true, "type": [ "boolean", "null" ] } } }, "zone-global-waf-rule.jsonld-global_waf_rule.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the WAF rule (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "description": { "description": "Optional human-readable label describing what the rule does. Up to 255 characters.", "example": "Block SQL injection attempts on the login endpoint", "type": [ "string", "null" ] }, "enabled": { "description": "Whether the rule is active. Disabled rules are kept but not evaluated. Defaults to true.", "default": true, "example": true, "type": "boolean" }, "participationMode": { "default": "opt_out", "type": "string", "enum": [ "opt_out", "opt_in" ], "description": "How this global rule applies to zones by default: `opt_out` = enforced for every zone unless that zone disabled it; `opt_in` = not enforced for any zone unless that zone enabled it (it still contributes to the shadow anomaly score everywhere). A zone's explicit choice always wins over the mode default. Writable on the admin endpoints only; ignored for zone-owned rules. Defaults to `opt_out`.", "example": "opt_out" }, "phase": { "default": "request", "type": "string", "enum": [ "request", "response" ], "description": "Evaluation phase the rule runs in: \"request\" (before the request is proxied upstream) or \"response\" (after the upstream responds). Defaults to \"request\".", "example": "request" }, "order": { "description": "Execution order within the zone. Rules are evaluated in ascending order. Defaults to 0.", "default": 0, "example": 10, "type": "integer" }, "match": { "default": "all", "type": "string", "enum": [ "all", "any" ], "description": "How the rule's conditions combine: \"all\" (every condition must match, logical AND) or \"any\" (at least one condition must match, logical OR). Defaults to \"all\".", "example": "all" }, "conditions": { "$ref": "#/components/schemas/WafConditionList" }, "expression": { "description": "Optional raw rule expression, used as an alternative to the structured \"conditions\" list. A rule must define at least one condition or an expression.", "type": [ "string", "null" ] }, "action": { "type": "string", "enum": [ "block", "challenge", "throttle", "skip", "log", "score" ], "description": "What happens when the rule matches:\n- `block` - Reject the request with the HTTP `status` code (a valid `status` is required for this action).\n- `challenge` - Issue a challenge to the client.\n- `throttle` - Rate-limit the request; requires `rateBps` and/or `delayMs` to be set.\n- `skip` - Skip evaluation of the remaining rules.\n- `log` - Only record the match; take no blocking action.\n- `score` - Add `score` to the request's anomaly score.", "example": "block" }, "status": { "minimum": 100, "maximum": 599, "description": "HTTP status code returned when a \"block\" action fires. Must be between 100 and 599. Required when \"action\" is \"block\".", "example": 403, "type": [ "integer", "null" ] }, "score": { "minimum": 0, "description": "Anomaly score added to the request when the rule matches, applied by the \"score\" action. Must be zero or positive. Defaults to 0.", "default": 0, "example": 5, "type": "integer" }, "rateBps": { "minimum": 0, "description": "Rate limit (rate_bps) applied by the \"throttle\" action. Must be zero or positive; 0 disables this limit. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 1024, "type": "integer" }, "delayMs": { "minimum": 0, "maximum": 5000, "description": "Artificial delay in milliseconds injected by the \"throttle\" action. Must be between 0 and 5000; 0 means no delay. A \"throttle\" rule requires \"rateBps\" and/or \"delayMs\" to be non-zero. Defaults to 0.", "default": 0, "example": 250, "type": "integer" }, "log": { "description": "When true, matches of this rule are logged in addition to performing the configured action. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "stop": { "description": "When true, stops evaluation of any further WAF rules once this rule matches. Defaults to false.", "default": false, "example": false, "type": "boolean" }, "createdAt": { "readOnly": true, "description": "Timestamp when the rule was created. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "updatedAt": { "readOnly": true, "description": "Timestamp when the rule was last updated. Read-only.", "example": "2026-07-01T12:00:00+00:00", "type": "string", "format": "date-time" }, "enabledForZone": { "description": "The effective on/off state of this global WAF rule for the zone in the URL. On read it reflects the zone's explicit preference, or the rule's participation-mode default when none is set (opt-out rules are on, opt-in rules are off). PATCH it to toggle the rule for the zone; a rule that is off for the zone is not enforced but still contributes to the shadow anomaly score.", "example": true, "type": [ "boolean", "null" ] } } } ] }, "zone-ip-lookup": { "type": "object", "properties": { "ip": { "type": "string" }, "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] }, "global": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "array", "items": { "anyOf": [ { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } }, { "type": "string" } ] } }, { "type": "string" }, { "type": "null" } ] } }, "zone": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "array", "items": { "anyOf": [ { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } }, { "type": "string" } ] } }, { "type": "string" }, { "type": "null" } ] } } } }, "zone-ip-lookup.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "ip": { "type": "string" }, "geo": { "type": [ "object", "null" ], "additionalProperties": { "anyOf": [ { "type": "number" }, { "type": "integer" }, { "type": "string" }, { "type": "null" } ] } }, "global": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "array", "items": { "anyOf": [ { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } }, { "type": "string" } ] } }, { "type": "string" }, { "type": "null" } ] } }, "zone": { "type": "object", "additionalProperties": { "anyOf": [ { "type": "integer" }, { "type": "array", "items": { "anyOf": [ { "type": "object", "additionalProperties": { "type": [ "string", "null" ] } }, { "type": "string" } ] } }, { "type": "string" }, { "type": "null" } ] } } } } ], "properties": { "geo": { "description": "MaxMind geo location of the source IP - null for non-IP sources (CIDR/ASN) or when no location is available.", "anyOf": [ { "$ref": "#/components/schemas/GeoLocation" }, { "type": "null" } ] } } }, "zone-kpis": { "type": "object", "properties": { "requests": { "$ref": "#/components/schemas/MetricSummary" }, "imageHits": { "$ref": "#/components/schemas/MetricSummary" }, "htmlHits": { "$ref": "#/components/schemas/MetricSummary" }, "blockedRequests": { "$ref": "#/components/schemas/MetricSummary" }, "totalBytesSentMb": { "$ref": "#/components/schemas/MetricSummary" } } }, "zone-kpis.jsonld": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "requests": { "$ref": "#/components/schemas/MetricSummary.jsonld" }, "imageHits": { "$ref": "#/components/schemas/MetricSummary.jsonld" }, "htmlHits": { "$ref": "#/components/schemas/MetricSummary.jsonld" }, "blockedRequests": { "$ref": "#/components/schemas/MetricSummary.jsonld" }, "totalBytesSentMb": { "$ref": "#/components/schemas/MetricSummary.jsonld" } } } ] }, "zone-managed-ignored-url-param-zone_managed_ignored_url_param.read": { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the managed ignored URL parameter (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "pattern": "^([^=&#\\s]+)$", "description": "Query-string parameter name stripped from the URL before cache-key computation. Unique, up to 255 characters, no whitespace, \"=\", \"&\" or \"#\". Trimmed on save.", "default": "", "example": "utm_source", "type": "string" }, "description": { "maxLength": 255, "description": "Optional human-readable explanation of the parameter shown to zone users.", "example": "Google Ads click identifier", "type": [ "string", "null" ] } }, "required": [ "name" ] }, "zone-managed-ignored-url-param.jsonld-zone_managed_ignored_url_param.read": { "allOf": [ { "$ref": "#/components/schemas/HydraItemBaseSchema" }, { "type": "object", "properties": { "id": { "readOnly": true, "description": "Unique identifier of the managed ignored URL parameter (UUID v4). Read-only.", "example": "550e8400-e29b-41d4-a716-446655440000", "type": "string", "format": "uuid" }, "name": { "maxLength": 255, "pattern": "^([^=&#\\s]+)$", "description": "Query-string parameter name stripped from the URL before cache-key computation. Unique, up to 255 characters, no whitespace, \"=\", \"&\" or \"#\". Trimmed on save.", "default": "", "example": "utm_source", "type": "string" }, "description": { "maxLength": 255, "description": "Optional human-readable explanation of the parameter shown to zone users.", "example": "Google Ads click identifier", "type": [ "string", "null" ] } }, "required": [ "name" ] } ] } }, "responses": {}, "parameters": {}, "examples": {}, "requestBodies": {}, "headers": {}, "securitySchemes": { "JWT": { "type": "http", "description": "JWT access token obtained via POST /api/auth/login. Send as: Authorization: Bearer .", "scheme": "bearer", "bearerFormat": "JWT" }, "ApiToken": { "type": "apiKey", "description": "Long-lived API token created via POST /api/api-tokens (returned once in plaintext). A token created with `readOnly` may only perform safe requests (GET, HEAD, OPTIONS); write requests are rejected on every endpoint.", "name": "X-API-TOKEN", "in": "header" } } }, "security": [ { "ApiToken": [] }, { "JWT": [] } ], "tags": [ { "name": "Authentication", "description": "User registration, login, JWT issuance/refresh, logout, email verification, and password reset endpoints." }, { "name": "organization", "description": "Top-level tenant accounts. Each organization has a subscription plan and owns zones, members, invitations, and billing." }, { "name": "member", "description": "Users belonging to an organization, each with a role that governs their permissions within that organization." }, { "name": "invitation", "description": "Pending invitations for users to join an organization, carrying the offered role and a lifecycle status." }, { "name": "Zone", "description": "A proxied site/property under an organization; the primary configuration container for hostnames, origins, caching, security, and log forwarding." }, { "name": "ip-list", "description": "Reusable named lists of IP addresses / CIDR ranges that security rules across the organization can reference." }, { "name": "zone-allow", "description": "Per-zone allowlist entries; the zone-scoped counterpart to \"allow\"." }, { "name": "zone-block", "description": "Per-zone block/challenge entries; the zone-scoped counterpart to \"block\"." }, { "name": "security-scenario", "description": "Organization-level security scenarios with a participation mode. See \"zone-global-scenario\" for the per-zone application." }, { "name": "zone-global-scenario", "description": "Per-zone application of global security scenarios; the zone-scoped counterpart to \"security-scenario\"." }, { "name": "waf-rule", "description": "Organization-level Web Application Firewall rules matching request attributes via a conditions tree, taking an action in a given phase. WAF pattern matching, distinct from \"access-rule\" (access control). See \"zone-global-waf-rule\" for the per-zone application." }, { "name": "zone-global-waf-rule", "description": "Per-zone application of global WAF rules; the zone-scoped counterpart to \"waf-rule\"." }, { "name": "access-rule", "description": "Access-control rules evaluated against a conditions tree, taking an action with optional skip targets. Governs allow/deny/challenge of requests; distinct from \"waf-rule\" (WAF matching) and \"block\" (static source lists)." }, { "name": "configuration-rule", "description": "Conditional configuration overrides: a conditions tree selects matching traffic and settingsOverrides adjusts zone settings (e.g. caching, headers). Shares the condition model with \"access-rule\"." }, { "name": "zone-managed-ignored-url-param", "description": "Read-only per-zone view of the managed ignored URL parameter catalog, applied when the zone has the managed list enabled." }, { "name": "rewrite-rule", "description": "URL/path rewrite rules with an operator that transform incoming request targets before origin selection." }, { "name": "redirect", "description": "HTTP redirect rules with a mode mapping incoming URLs to redirect targets." }, { "name": "origin-server", "description": "Backend origin servers for a zone, addressed over a protocol; requests are proxied to these upstreams." }, { "name": "load-balancer", "description": "Load-balancing configuration distributing traffic across origin servers using a method." }, { "name": "basic-auth-user", "description": "HTTP Basic Authentication credentials (username/password pairs) enforced at the edge to protect a zone." }, { "name": "hostname", "description": "Hostnames served by a zone, including DNS target status and optional reassignment redirect." }, { "name": "domain", "description": "DNS domains/zones managed for a customer, with provisioning status." }, { "name": "dns-record", "description": "DNS records within a managed domain with optional health monitoring." }, { "name": "certificate", "description": "TLS certificates for hostnames, covering issuance and renewal." }, { "name": "certificate-attempt", "description": "Certificate issuance/renewal attempts recording the ACME lifecycle and failures." }, { "name": "certificate-san", "description": "Subject Alternative Name entries on a certificate, tracking DNS validation and SSL provisioning." }, { "name": "api-token", "description": "Long-lived API tokens for programmatic access (sent via the X-API-TOKEN header); the plaintext value is returned once on creation." }, { "name": "legacy-api-token", "description": "Legacy API tokens retained for backward compatibility with the previous hub API." }, { "name": "audit-log", "description": "Read-only audit trail of changes to organization resources (who changed what, and when)." }, { "name": "User", "description": "The authenticated user account (profile and identity); managed via the auth and profile endpoints." }, { "name": "update-profile", "description": "Update the authenticated user's profile (name and related fields)." }, { "name": "change-password", "description": "Change the authenticated user's password." }, { "name": "billing", "description": "Subscription, plan, invoice, and payment-method management." }, { "name": "cache-clear", "description": "Purge cached content at the Smoxy edge for a zone (BAN/PURGE-style invalidation)." }, { "name": "custom-page", "description": "Custom error, security-challenge, and maintenance pages served for a zone." }, { "name": "search", "description": "Cross-resource search across an organization's configuration objects." }, { "name": "traffic-log", "description": "Read-only access/traffic log entries for a zone, queryable by time window and request attributes." }, { "name": "zone-kpis", "description": "Aggregated traffic KPIs / summary metrics for a zone." }, { "name": "zone-ip-lookup", "description": "IP reputation and threat lookup scoped to a zone (per-zone history and blocklist action)." }, { "name": "redirect-map", "description": "CSV export of a zone's redirect map. Kept as its own resource (not another\noperation on RedirectMapEntry) because an item-level Get on the identifier-less\nentry collection would break member IRI generation. The provider returns the\nCSV as a Response directly, so this resource has no serialized body." }, { "name": "cdn-log", "description": "Resource 'cdn-log' operations." } ], "webhooks": {} }