Get CDN zone details

GET /api/v2/cdn/zones/{id}

Return one CDN zone by public cdn_... ID. The response starts with the same summary fields as GET /api/v2/cdn/zones, then adds security, performance, cache, WAF, geo restriction, action gates, and optional DNS records.

CDN & Edge Other

Authentication

Required API scopes: read:cdnread:domains

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Path Parameters

id string required Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3

Public CDN zone ID. Get it from GET /api/v2/cdn/zones data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Query Parameters

includeRecords boolean · default: false · Example: true

When true, include the zone's A, AAAA, and CNAME records in records, each with its own proxied state; otherwise records is null.

Headers

Authorization Bearer <token>
Accept application/json

Responses

200 CDN zone detail.
id string · nullable · Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3

Public CDN zone ID. null when no CDN zone exists yet.

domain string · Example: example.com
domainId string · nullable · Example: dom_01hxa3b4c5d6e7f8g9h0j1k2m3

Public domain ID for registrar-owned domains; null for DNS-only zones.

status string · enum · Example: active
active
pending
misconfigured
missing
disabled
reason string · nullable · Example: null

proxied boolean · Example: true
securityLevel string · enum · Example: medium
off
low
medium
high
ssl object
ssl.status string · enum required · Example: active
active
pending
error
ssl.expiresAt string · nullable required · Example: 2026-08-01T00:00:00.000Z

Nullable: may be null when not applicable.

ruleCount integer · Example: 2
security object
security.level string · enum required · Example: medium

Overall CDN security level.

off
low
medium
high
security.sslMode string · enum required · Example: full

TLS mode used between visitors, CDN, and origin.

off
flexible
full
strict
security.alwaysUseHttps boolean required · Example: true
security.minTlsVersion string · enum required · Example: 1.2
1.0
1.1
1.2
1.3
security.botProtection boolean required · Example: true
security.blockBadCrawlers boolean required · Example: true
security.blockBadBots boolean required · Example: true
security.wpLoginProtection boolean required · Example: true

Protect WordPress login endpoints.

security.wpAdminChallenge boolean required · Example: true

Challenge requests to WordPress administration paths.

performance object
performance.earlyHints boolean required · Example: true
performance.alwaysOnline boolean required · Example: true
cache object
cache.purgeCache boolean required · Example: false

Current persisted cache-purge toggle returned by the CDN settings surface.

waf object
waf.skipEnabled boolean required · Example: false

Whether custom WAF skip rules are enabled.

waf.challengeGeoEnabled boolean required · Example: true

Whether visitor-profile country challenge logic is enabled.

waf.visitorProfileMode string · enum required · Example: challenge

challenge asks visitors outside the configured country profile to complete a challenge; block blocks them; off disables this profile action.

off
challenge
block
waf.ipAllowlist array<string> required · Example: ["203.0.113.10"]

IP addresses or CIDR ranges allowed through custom WAF checks.

waf.uaAllowlist array<string> required · Example: ["HostUp-Monitor"]

User-agent substrings allowed through custom WAF checks.

waf.pathAllowlist array<string> required · Example: ["/health"]

Path prefixes allowed through custom WAF checks.

geoRestriction object
geoRestriction.enabled boolean required · Example: true
geoRestriction.whitelistCountries array<string> required · Example: ["SE"]

Effective uppercase country-code allowlist kept for compatibility. Prefer combinedCountries for new integrations.

geoRestriction.mode string · enum required · Example: whitelist

off disables the allowlist; whitelist allows only combinedCountries.

off
whitelist
geoRestriction.standardCountries array<string> required · Example: []

System-required countries that callers cannot remove.

geoRestriction.additionalCountries array<string> required · Example: ["SE"]

Caller-managed country codes layered on top of standardCountries.

geoRestriction.combinedCountries array<string> required · Example: ["SE"]

Effective allowlist: standardCountries plus additionalCountries.

activity object
activity.lastChangeDetectedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

activity.lastCheckedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

activity.settingsUpdatedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

actions object
actions.canEnableProxy object required
actions.canEnableProxy.allowed boolean required · Example: true
actions.canEnableProxy.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canEnableProxy.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canIssueCertificate object required
actions.canIssueCertificate.allowed boolean required · Example: true
actions.canIssueCertificate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canIssueCertificate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canChangeMode object required
actions.canChangeMode.allowed boolean required · Example: true
actions.canChangeMode.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canChangeMode.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canActivate object required
actions.canActivate.allowed boolean required · Example: true
actions.canActivate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canActivate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canDeactivate object required
actions.canDeactivate.allowed boolean required · Example: true
actions.canDeactivate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canDeactivate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

records array<any> · nullable

null unless includeRecords=true.

400 Invalid request. The response body is an RFC 7807 Problem Details document.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
GET https://cloud.hostup.se/api/v2/cdn/zones/{id}
For AI assistants
View as Markdown
cURL 
curl -X GET "https://cloud.hostup.se/api/v2/cdn/zones/cdn_01hxa3b4c5d6e7f8g9h0j1k2m3" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"
Response 
{
  "id": "cdn_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "domain": "example.com",
  "domainId": "dom_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "status": "active",
  "reason": null,
  "proxied": true,
  "securityLevel": "medium",
  "ssl": {
    "status": "active",
    "expiresAt": "2026-08-01T00:00:00.000Z"
  },
  "ruleCount": 2,
  "security": {
    "level": "medium",
    "sslMode": "full",
    "alwaysUseHttps": true,
    "minTlsVersion": "1.2",
    "botProtection": true,
    "blockBadCrawlers": true,
    "blockBadBots": true,
    "wpLoginProtection": true,
    "wpAdminChallenge": true
  },
  "performance": {
    "earlyHints": true,
    "alwaysOnline": true
  },
  "cache": {
    "purgeCache": false
  },
  "waf": {
    "skipEnabled": false,
    "challengeGeoEnabled": true,
    "visitorProfileMode": "challenge",
    "ipAllowlist": [
      "203.0.113.10"
    ],
    "uaAllowlist": [
      "HostUp-Monitor"
    ],
    "pathAllowlist": [
      "/health"
    ]
  },
  "geoRestriction": {
    "enabled": true,
    "whitelistCountries": [
      "SE"
    ],
    "mode": "whitelist",
    "standardCountries": [],
    "additionalCountries": [
      "SE"
    ],
    "combinedCountries": [
      "SE"
    ]
  },
  "activity": {
    "lastChangeDetectedAt": "2026-04-27T12:00:00.000Z",
    "lastCheckedAt": "2026-04-27T12:00:00.000Z",
    "settingsUpdatedAt": "2026-04-27T12:00:00.000Z"
  },
  "actions": {
    "canEnableProxy": {
      "allowed": true,
      "reason": null
    },
    "canIssueCertificate": {
      "allowed": true,
      "reason": null
    },
    "canChangeMode": {
      "allowed": true,
      "reason": null
    },
    "canActivate": {
      "allowed": false,
      "reason": "CDN is already active for this domain."
    },
    "canDeactivate": {
      "allowed": true,
      "reason": null
    }
  },
  "records": null
}