hosting
PATCH /v1/sites/{siteId}/cdn/canonical-host
Choose www or non-www, and whether to force HTTPS.
Authentication
Send an API key as a bearer token. The key must carry the hosting.cdn.manage permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X PATCH https://api.zinndigital.com/v1/sites/{siteId}/cdn/canonical-host \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
A **merge**: only the fields present in the body change. An absent field is left alone rather than reset, so a client written before one of these existed cannot switch it off on every save. `force_https` defaults to `true` on every new site. The insecure choice has to be made explicitly; it is never reached by omitting a field. A site whose primary domain is a **deeper subdomain** (`shop.blog.example.com`) has no `www` counterpart, and the request is a `422` rather than a stored preference whose plan can never be built. Refusing at write time is deliberate: the alternative saves cleanly and then fails later inside provisioning, where the customer sees a stuck deploy instead of the bad input. An empty body is a `422`, not a no-op success. Requires `hosting.cdn.manage`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
canonical_host | string<apex, www> | No | — |
force_https | boolean | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
canonical_host | string<apex, www> | Yes | — |
force_https | boolean | Yes | Redirect http to https at the edge. Defaults to true on every new site. |
serves_on | string | Yes | The hostname that actually serves. |
redirects_from | string | Yes | The hostname that permanently redirects to `serves_on`. |
redirect_status | integer | Yes | Always 301. A 302 tells search engines to keep indexing the alias, which leaves the duplicate-content problem unsolved while looking correct in a browser. |
certificate_hosts | string[] | Yes | **Both** hostnames, always. TLS is negotiated on the name being redirected from, so a certificate covering only `serves_on` puts a security interstitial in front of the alias an… |
apex_delivery | string<native, alias, a_records, unsupported> | Yes | How the zone apex is made to resolve. A bare apex cannot be a `CNAME`, so on a pull-zone CDN it resolves only through CNAME-flattening/ALIAS at the DNS provider, or through A/AA… |
apex_deliverable | boolean | Yes | `false` when neither mechanism is available for this CDN/DNS pairing. The combination is refused rather than accepted, because the alternative provisions cleanly, reports health… |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429