connections
POST /v1/waap/domains/{domainId}/mode
Switch a protected domain between monitor, block and off.
Authentication
Send an API key as a bearer token. The key must carry the connections.manage permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/waap/domains/{domainId}/mode \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "mode": <string<monitor, block, off>> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
The one call here that changes whether traffic is refused. Requires connections.manage: it writes to the customer's connected account, so the read key the list call takes is not enough. ⛔ The response reports the mode the provider says is now in force, which is not necessarily the one that was requested: providers apply some transitions asynchronously and refuse others outright. Echoing the request back would leave every screen showing a protection state that was never applied. ⛔ locked is rejected with 422: it is a state the provider assigns, never one that can be requested, and accepting it would build a control that always fails.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
domainId (path) | string | Yes | The provider's id for the protected domain. |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
mode | string<monitor, block, off> | Yes | ⛔ locked is absent on purpose: it is a state the provider assigns, never one that can be requested, and the API answers 422 for it. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | string | Yes | — |
domain | string | Yes | — |
mode | string<monitor, block, off, locked> | Yes | ⛔⛔ monitor logs every match and delivers the traffic anyway. It produces analytics and blocks nothing, and on a dashboard it is indistinguishable from block unless this… |
created_at | string | No | — |
total_requests | integer | No | ⛔ null when the provider does not report it — never 0. |
blocked_requests | integer | No | ⛔ null when unknown. "Nothing was blocked" and "we cannot see what was blocked" are opposite answers and must not render alike. |
Errors this endpoint can return
401 · 403 · 422 · 429