Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/sites/{siteId}/redirects \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "domain": <string>, "path": <string>, "destination": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Adds one rule. ⛔ **The vendor endpoint behind this is a whole-set write**, so the engine reads the existing rules, appends, and sends the set back — last writer wins. Two people adding a redirect at the same moment is the one case where one of the two additions is lost, and there is no vendor primitive that would prevent it. `destination` is checked before anything is written to the customer's `.htaccess`: a protocol-relative `//evil.example/` passes a naive "starts with a slash" test and redirects the site's visitors to somebody else's server, so it is refused `422` here. `type` is a closed set (`301`, `302`) checked in this layer **and** in the driver, because the platform types it as a free string and an unreviewed token would be written straight into the file. `404` for a site with no managed hosting package. Requires `sites.view` and `sites.panel_access`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
domain | string | Yes | The domain or alias on the package the rule applies to. |
path | string | Yes | The path being redirected. ⛔ Named `path` and never `source` — `source` is a reserved attribute on every serializer field one layer down, and a field of that name silently reads… |
destination | string | Yes | Where the visitor is sent. A protocol-relative value is refused: it hands the customer's visitors to another server while looking like a local path. |
type | string<301, 302> | No | The redirect status. `301` is permanent and is cached by browsers and search engines; `302` is temporary. Nothing else is accepted. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | string | Yes | ⛔ **Ours, not the vendor's** — this platform mints no identifier for a redirect, so this encodes the domain/type/path triple that addresses one. Opaque, stable across reads, and… |
domain | string | Yes | The domain or alias the rule applies to. |
path | string | Yes | The path being redirected. ⛔ Named `path` and never `source`, which is a reserved attribute one layer down and would silently read the wrong value. |
destination | string | Yes | Where the visitor is sent. |
type | string<301, 302> | Yes | The redirect status — permanent or temporary. |
Errors this endpoint can return
401 · 403 · 404 · 409 · 422 · 429 · 503