Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X GET https://api.zinndigital.com/v1/sites/{siteId}/cdn/settings \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
The edge behaviour a customer controls for their own zone: cache level, development mode, Always Online, the CDN-to-origin TLS mode, and Brotli compression. Read live from the provider on every call rather than mirrored, so the answer reflects what is actually in force — development mode in particular expires on the provider's own three-hour timer, and only the provider knows how much of it is left. A provider with no equivalent vocabulary (a pull-zone CDN such as Bunny or CDN77) answers `200` with `supported: false` and default values, **not** a `404` — the tier and cache-purge controls on the same screen are real on those providers and a `404` would take them down with it. A site that is not served through our CDN is a `404`, answered before any vendor call. A provider failure is a `503` that says the answer is unknown — never a `404`, which would tell a customer their site is not CDN-fronted because the vendor returned a 500. Requires `sites.view`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
site_id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
supported | boolean | Yes | Whether the CDN serving this site can express these settings at all. `false` for a pull-zone provider with no equivalent vocabulary; the other fields then carry defaults and a c… |
supported_values | object | Yes | For an **enumerated** supported field, which values this provider can be set to. A field absent from this map takes every value in its own vocabulary — the common case, so the p… |
supported_fields | string[] | No | Which of the five settings this site's CDN can actually express. ⛔ Sent always and **empty rather than omitted** when there are none — a client reading absence as "all of them"… |
cache_level | CdnCacheLevelReported | Yes | What a provider may REPORT for `cache_level` — the writable vocabulary plus the read-only states. `by_parameters` means the edge caches by a **named list of query parameters** c… |
development_mode | boolean | Yes | Bypass the cache entirely so edits are visible immediately. The provider expires this automatically — see `development_mode_seconds_remaining`. |
development_mode_seconds_remaining | integer | Yes | Seconds until the provider switches development mode off again, as reported by the provider rather than derived from when we set it. `0` when it is off. It is a countdown and no… |
always_online | boolean | Yes | Serve an archived copy of the page when the origin is unreachable. |
ssl_mode | CdnSslMode | Yes | The TLS leg between the edge and the origin. Cloudflare's `flexible` is deliberately absent — it leaves that leg in plaintext, and the platform's Cloudflare adapter refuses to b… |
brotli | boolean | Yes | Serve Brotli-compressed responses to clients that accept them. |
Errors this endpoint can return
401 · 403 · 404 · 429 · 503