hosting
PATCH /v1/sites/{siteId}/cdn/canonical-host
Choose www or non-www, and whether to force HTTPS.
Authentication
Send an API key as a bearer token. The key must carry the hosting.cdn.manage permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X PATCH https://api.zinndigital.com/v1/sites/{siteId}/cdn/canonical-host \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
A merge: only the fields present in the body change. An absent field is left alone rather than reset, so a client written before one of these existed cannot switch it off on every save. force_https defaults to true on every new site. The insecure choice has to be made explicitly; it is never reached by omitting a field. A site whose primary domain is a deeper subdomain (shop.blog.example.com) has no www counterpart, and the request is a 422 rather than a stored preference whose plan can never be built. Refusing at write time is deliberate: the alternative saves cleanly and then fails later inside provisioning, where the customer sees a stuck deploy instead of the bad input. An empty body is a 422, not a no-op success. Requires hosting.cdn.manage.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
canonical_host | string<apex, www> | No | — |
force_https | boolean | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
canonical_host | string<apex, www> | Yes | — |
force_https | boolean | Yes | Redirect http to https at the edge. Defaults to true on every new site. |
serves_on | string | Yes | The hostname that actually serves. |
redirects_from | string | Yes | The hostname that permanently redirects to serves_on. |
redirect_status | integer | Yes | Always 301. A 302 tells search engines to keep indexing the alias, which leaves the duplicate-content problem unsolved while looking correct in a browser. |
certificate_hosts | string[] | Yes | Both hostnames, always. TLS is negotiated on the name being redirected from, so a certificate covering only serves_on puts a security interstitial in front of the alias and… |
apex_delivery | string<native, alias, a_records, unsupported> | Yes | How the zone apex is made to resolve. A bare apex cannot be a CNAME, so on a pull-zone CDN it resolves only through CNAME-flattening/ALIAS at the DNS provider, or through A/AAAA… |
apex_deliverable | boolean | Yes | false when neither mechanism is available for this CDN/DNS pairing. The combination is refused rather than accepted, because the alternative provisions cleanly, reports healthy,… |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429