connections
POST /v1/waap/domains/{domainId}/mode
Switch a protected domain between monitor, block and off.
Authentication
Send an API key as a bearer token. This endpoint does not state a specific permission in the specification, so give your key the least it needs and check the response rather than assuming.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/waap/domains/{domainId}/mode \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "mode": <string<monitor, block, off>> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
The one call here that changes whether traffic is refused. ⛔ The response reports the mode the provider says is **now in force**, which is not necessarily the one that was requested: providers apply some transitions asynchronously and refuse others outright. Echoing the request back would leave every screen showing a protection state that was never applied. ⛔ `locked` is rejected with `422`: it is a state the provider assigns, never one that can be requested, and accepting it would build a control that always fails.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
domainId (path) | string | Yes | The provider's id for the protected domain. |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
mode | string<monitor, block, off> | Yes | ⛔ `locked` is absent on purpose: it is a state the provider assigns, never one that can be requested, and the API answers `422` for it. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | string | Yes | — |
domain | string | Yes | — |
mode | string<monitor, block, off, locked> | Yes | ⛔⛔ `monitor` logs every match and **delivers the traffic anyway**. It produces analytics and blocks nothing, and on a dashboard it is indistinguishable from `block` unless this… |
created_at | string | No | — |
total_requests | integer | No | ⛔ `null` when the provider does not report it — never `0`. |
blocked_requests | integer | No | ⛔ `null` when unknown. "Nothing was blocked" and "we cannot see what was blocked" are opposite answers and must not render alike. |
Errors this endpoint can return
401 · 422 · 429