hosting
PUT /v1/sites/{siteId}/cdn/settings
Change a site's CDN zone settings.
Authentication
Send an API key as a bearer token. The key must carry the hosting.cdn.manage permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X PUT https://api.zinndigital.com/v1/sites/{siteId}/cdn/settings \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
A merge: only the fields present in the body are changed and an absent field is left alone — never reset to a default. A client written before a setting existed must not switch it off on every save. The body carries settings and nothing else. additionalProperties: false is load-bearing rather than tidy: these are pooled CDN accounts holding other customers' zones and a Cloudflare zone resolves by name alone, so a body key named domain or zone_id must be refused rather than silently discarded. The hostname is always read off the site row. ssl_mode deliberately does not accept Cloudflare's flexible, which leaves the edge-to-origin leg in plaintext. An empty body is a 422, not a no-op success. A provider without these controls is a 422 with code UNSUPPORTED_BY_PROVIDER — a save that reported success having changed nothing would be worse than a refusal. Requires hosting.cdn.manage.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
cache_level | CdnCacheLevel | No | How aggressively the edge treats query strings as distinct cached objects, least to most. Cloudflare's bypass is deliberately not offered: it is an emergency operator state, and… |
development_mode | boolean | No | — |
always_online | boolean | No | — |
ssl_mode | CdnSslMode | No | The TLS leg between the edge and the origin. Cloudflare's flexible is deliberately absent — it leaves that leg in plaintext, and the platform's Cloudflare adapter refuses to be… |
brotli | boolean | No | — |
email_obfuscation | boolean | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
site_id | Uuid | Yes | UUIDv7 identifier — sortable by creation time (docs/02 §8). |
supported | boolean | Yes | Whether the CDN serving this site can express these settings at all. false for a pull-zone provider with no equivalent vocabulary; the other fields then carry defaults and a… |
supported_values | object | Yes | For an enumerated supported field, which values this provider can be set to. A field absent from this map takes every value in its own vocabulary — the common case, so the… |
supported_fields | string[] | No | Which of the six settings this site's CDN can actually express. ⛔ Sent always and empty rather than omitted when there are none — a client reading absence as "all of them"… |
cache_level | CdnCacheLevelReported | Yes | What a provider may REPORT for cache_level — the writable vocabulary plus the read-only states. by_parameters means the edge caches by a named list of query parameters… |
development_mode | boolean | Yes | Bypass the cache entirely so edits are visible immediately. The provider expires this automatically — see development_mode_seconds_remaining. |
development_mode_seconds_remaining | integer | Yes | Seconds until the provider switches development mode off again, as reported by the provider rather than derived from when we set it. 0 when it is off. It is a countdown and not… |
always_online | boolean | Yes | Serve an archived copy of the page when the origin is unreachable. |
ssl_mode | CdnSslMode | Yes | The TLS leg between the edge and the origin. Cloudflare's flexible is deliberately absent — it leaves that leg in plaintext, and the platform's Cloudflare adapter refuses to be… |
brotli | boolean | Yes | Serve Brotli-compressed responses to clients that accept them. |
email_obfuscation | boolean | Yes | Hide e-mail addresses on the site's pages from scrapers (the CDN rewrites them and a small script restores them for visitors). On by default at the provider; turn it off when a… |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429 · 502 · 503