Update CDN zone settings

PATCH /api/v2/cdn/zones/{id}

Partially update grouped CDN settings by public cdn_... zone ID.

Send only the groups you want to change; a body with no supported setting fields returns invalid_request, while unrecognized fields alongside at least one supported setting are ignored.

For “challenge visitors outside Sweden”, set waf.visitorProfileMode to challenge and keep geoRestriction.additionalCountries to SE.

To clear the country profile, send geoRestriction.mode: "off".

The response is the full updated zone detail, including the performance and cache groups.

CDN & Edge Other

Authentication

Required API scopes: write:cdnwrite:domains

Authenticate with an API key in the Authorization: Bearer <token> header.

Context

Path Parameters

id string required Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3

Public CDN zone ID. Get it from GET /api/v2/cdn/zones data[].id. Do not invent this value; use the exact ID returned by the referenced API response.

Query Parameters

includeRecords boolean · default: false · Example: false

When true, the updated response includes the zone's A, AAAA, and CNAME records in records, each with its own proxied state; otherwise records is null.

Headers

Authorization Bearer <token>
Accept application/json
Content-Type application/json

Body

required
application/json
proxied boolean · Example: true

Turn CDN proxying on or off for this zone.

security object
security.level string · enum · Example: high
off
low
medium
high
security.sslMode string · enum · Example: full
off
flexible
full
strict
security.alwaysUseHttps boolean · Example: true
security.minTlsVersion string · enum · Example: 1.2
1.0
1.1
1.2
1.3
security.botProtection boolean · Example: true
security.blockBadCrawlers boolean · Example: true
security.blockBadBots boolean · Example: true
security.wpLoginProtection boolean · Example: true
security.wpAdminChallenge boolean · Example: true
performance object
performance.earlyHints boolean · Example: true
performance.alwaysOnline boolean · Example: true
cache object
cache.purgeCache boolean · Example: true
waf object
waf.skipEnabled boolean · Example: false
waf.challengeGeoEnabled boolean · Example: true
waf.visitorProfileMode string · enum · Example: challenge
off
challenge
block
waf.ipAllowlist array<string> · Example: ["203.0.113.10"]
waf.uaAllowlist array<string> · Example: ["HostUp-Monitor"]
waf.pathAllowlist array<string> · Example: ["/health"]
geoRestriction object
geoRestriction.mode string · enum · Example: whitelist
off
whitelist
geoRestriction.additionalCountries array<string> · Example: ["SE"]

Uppercase ISO country codes to allow in addition to any system-required countries.

Responses

200 Updated CDN zone detail.
id string · nullable · Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3

Public CDN zone ID. null when no CDN zone exists yet.

domain string · Example: example.com
domainId string · nullable · Example: dom_01hxa3b4c5d6e7f8g9h0j1k2m3

Public domain ID for registrar-owned domains; null for DNS-only zones.

status string · enum · Example: active
active
pending
misconfigured
missing
disabled
reason string · nullable · Example: null

proxied boolean · Example: true
securityLevel string · enum · Example: medium
off
low
medium
high
ssl object
ssl.status string · enum required · Example: active
active
pending
error
ssl.expiresAt string · nullable required · Example: 2026-08-01T00:00:00.000Z

Nullable: may be null when not applicable.

ruleCount integer · Example: 2
security object
security.level string · enum required · Example: medium

Overall CDN security level.

off
low
medium
high
security.sslMode string · enum required · Example: full

TLS mode used between visitors, CDN, and origin.

off
flexible
full
strict
security.alwaysUseHttps boolean required · Example: true
security.minTlsVersion string · enum required · Example: 1.2
1.0
1.1
1.2
1.3
security.botProtection boolean required · Example: true
security.blockBadCrawlers boolean required · Example: true
security.blockBadBots boolean required · Example: true
security.wpLoginProtection boolean required · Example: true

Protect WordPress login endpoints.

security.wpAdminChallenge boolean required · Example: true

Challenge requests to WordPress administration paths.

performance object
performance.earlyHints boolean required · Example: true
performance.alwaysOnline boolean required · Example: true
cache object
cache.purgeCache boolean required · Example: false

Current persisted cache-purge toggle returned by the CDN settings surface.

waf object
waf.skipEnabled boolean required · Example: false

Whether custom WAF skip rules are enabled.

waf.challengeGeoEnabled boolean required · Example: true

Whether visitor-profile country challenge logic is enabled.

waf.visitorProfileMode string · enum required · Example: challenge

challenge asks visitors outside the configured country profile to complete a challenge; block blocks them; off disables this profile action.

off
challenge
block
waf.ipAllowlist array<string> required · Example: ["203.0.113.10"]

IP addresses or CIDR ranges allowed through custom WAF checks.

waf.uaAllowlist array<string> required · Example: ["HostUp-Monitor"]

User-agent substrings allowed through custom WAF checks.

waf.pathAllowlist array<string> required · Example: ["/health"]

Path prefixes allowed through custom WAF checks.

geoRestriction object
geoRestriction.enabled boolean required · Example: true
geoRestriction.whitelistCountries array<string> required · Example: ["SE"]

Effective uppercase country-code allowlist kept for compatibility. Prefer combinedCountries for new integrations.

geoRestriction.mode string · enum required · Example: whitelist

off disables the allowlist; whitelist allows only combinedCountries.

off
whitelist
geoRestriction.standardCountries array<string> required · Example: []

System-required countries that callers cannot remove.

geoRestriction.additionalCountries array<string> required · Example: ["SE"]

Caller-managed country codes layered on top of standardCountries.

geoRestriction.combinedCountries array<string> required · Example: ["SE"]

Effective allowlist: standardCountries plus additionalCountries.

activity object
activity.lastChangeDetectedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

activity.lastCheckedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

activity.settingsUpdatedAt string · nullable required · Example: 2026-04-27T12:00:00.000Z

Nullable: may be null when not applicable.

actions object
actions.canEnableProxy object required
actions.canEnableProxy.allowed boolean required · Example: true
actions.canEnableProxy.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canEnableProxy.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canIssueCertificate object required
actions.canIssueCertificate.allowed boolean required · Example: true
actions.canIssueCertificate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canIssueCertificate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canChangeMode object required
actions.canChangeMode.allowed boolean required · Example: true
actions.canChangeMode.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canChangeMode.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canActivate object required
actions.canActivate.allowed boolean required · Example: true
actions.canActivate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canActivate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

actions.canDeactivate object required
actions.canDeactivate.allowed boolean required · Example: true
actions.canDeactivate.reason string · nullable required · Example: null

Nullable: may be null when not applicable.

actions.canDeactivate.code string · nullable · Example: pending_order

Machine-readable reason code when an action is blocked.

records array<any> · nullable

null unless includeRecords=true.

400 The body is not JSON, contains no supported CDN settings, or contains settings rejected by the CDN provider.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
401 Unauthorized. Authentication is required.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
403 Forbidden. The caller lacks a required scope or does not own the resource.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
404 Not found. The resource does not exist or is not owned by the caller.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
429 Rate limited. Retry after the limit resets. 429 responses include Retry-After seconds plus X-RateLimit-* headers.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
500 Internal error. Retry later or contact support if the issue persists.
type string · Example: https://developer.hostup.se/errors/invalid_request
title string · Example: Validation failed
status integer · Example: 400
detail string · Example: The request body failed validation.
code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on detail.

instance string · Example: /api/v2/orders
requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3
timestamp string · Example: 2026-04-27T12:34:56.000Z
errors array<object>

Field-level validation errors when code is invalid_request.

errors[].pointer string required · Example: /items/0/eppCode
errors[].detail string required · Example: `eppCode` is required for this transfer.
errors[].code string required · Example: missing_required
extensions object
PATCH https://cloud.hostup.se/api/v2/cdn/zones/{id}
For AI assistants
View as Markdown
cURL 
curl -X PATCH "https://cloud.hostup.se/api/v2/cdn/zones/cdn_01hxa3b4c5d6e7f8g9h0j1k2m3" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -d '{
    "proxied": true,
    "waf": {
      "visitorProfileMode": "challenge"
    },
    "geoRestriction": {
      "mode": "whitelist",
      "additionalCountries": [
        "SE"
      ]
    }
  }'
Response 
{
  "id": "cdn_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "domain": "example.com",
  "domainId": "dom_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "status": "active",
  "reason": null,
  "proxied": true,
  "securityLevel": "medium",
  "ssl": {
    "status": "active",
    "expiresAt": "2026-08-01T00:00:00.000Z"
  },
  "ruleCount": 2,
  "security": {
    "level": "medium",
    "sslMode": "full",
    "alwaysUseHttps": true,
    "minTlsVersion": "1.2",
    "botProtection": true,
    "blockBadCrawlers": true,
    "blockBadBots": true,
    "wpLoginProtection": true,
    "wpAdminChallenge": true
  },
  "performance": {
    "earlyHints": true,
    "alwaysOnline": true
  },
  "cache": {
    "purgeCache": false
  },
  "waf": {
    "skipEnabled": false,
    "challengeGeoEnabled": true,
    "visitorProfileMode": "challenge",
    "ipAllowlist": [
      "203.0.113.10"
    ],
    "uaAllowlist": [
      "HostUp-Monitor"
    ],
    "pathAllowlist": [
      "/health"
    ]
  },
  "geoRestriction": {
    "enabled": true,
    "whitelistCountries": [
      "SE"
    ],
    "mode": "whitelist",
    "standardCountries": [],
    "additionalCountries": [
      "SE"
    ],
    "combinedCountries": [
      "SE"
    ]
  },
  "activity": {
    "lastChangeDetectedAt": "2026-04-27T12:00:00.000Z",
    "lastCheckedAt": "2026-04-27T12:00:00.000Z",
    "settingsUpdatedAt": "2026-04-27T12:00:00.000Z"
  },
  "actions": {
    "canEnableProxy": {
      "allowed": true,
      "reason": null
    },
    "canIssueCertificate": {
      "allowed": true,
      "reason": null
    },
    "canChangeMode": {
      "allowed": true,
      "reason": null
    },
    "canActivate": {
      "allowed": false,
      "reason": "CDN is already active for this domain."
    },
    "canDeactivate": {
      "allowed": true,
      "reason": null
    }
  },
  "records": null
}
Request Body Challenge visitors outside Sweden 
{
  "proxied": true,
  "waf": {
    "visitorProfileMode": "challenge"
  },
  "geoRestriction": {
    "mode": "whitelist",
    "additionalCountries": [
      "SE"
    ]
  }
}