/api/v2/cdn/zones/{id} Keep authoritative DNS with the current provider while routing selected hostnames through the CDN. Start with GET /api/v2/cdn/zones and use the returned public cdn_... ID. prepare_partial prepares the selected zone and returns its ownership-verification TXT record, preserved origin records and per-hostname routing instructions; it does not change external authoritative DNS or the domain's nameservers. Optional hostnames is accepted only for preparation: 1–50 absolute hostname entries equal to or below the zone, with apex and www as the default. Wildcards, URL schemes and paths are rejected; IDNs, case and a trailing dot are normalized, and duplicate names are collapsed. Preparation also verifies current authoritative delegation and cannot convert a currently delegated full setup. The server resolves origins and ownership; arbitrary origins, account identifiers and unknown body fields are rejected.
Publish only the exact setup.verification and setup.routing[].record values returned for this zone at the current DNS provider, respecting each row's status and reason. Apex routing requires that DNS provider's ALIAS/flattening support; an unsupported apex must not be marked complete. Then send check_partial with no other fields. This refreshes retained setup state and returns the same complete zone detail. Both actions require write permissions. HTTP 200 means the action completed, not that the setup is active: pending_verification, pending_routing and pending_certificate identify work still outstanding. Only setup.status: active confirms the setup is ready. An unavailable check does not prove an invalid DNS record.
The alternative is managed nameservers: use setup.nameserverManagementUrl when present, or set setup.expectedNameservers through the external registrar. Do not perform that nameserver change as part of partial setup. Regular proxy/security changes continue to use PATCH on this same resource; setup is response-only.
write:cdnwrite:domains
Authenticate with an API key in the Authorization: Bearer <token> header.
id string required
Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3 Public CDN zone ID. Get it from GET /api/v2/cdn/zones data[].id. Do not invent this value; use the exact ID returned by the referenced API response.
Authorization Bearer <token> Accept application/json Content-Type application/json action string · enum required Prepare external-DNS setup for the selected zone.
prepare_partial hostnames array<string>
· Example: ["example.com","www.example.com"] Absolute hostnames equal to the selected zone or below it. Omit for apex and www. Supply 1–50 entries; duplicates are collapsed after normalization. Wildcards, URL schemes and paths are rejected. Case, IDNs and a trailing dot are normalized by the server. The current origins are read from owned DNS records.
setup object Canonical CDN setup state for both managed nameservers and external DNS. Read status and reason directly; a prepared partial setup is not active until verification, hostname routing and HTTPS certificate readiness are confirmed. DNS names and targets are returned values to copy, not patterns to reconstruct.
setup.mode string · enum required full is nameserver-based configuration; partial keeps external authoritative DNS and routes selected hostnames through the CDN. Read currentNameservers for the currently observed delegation.
full partial unknown setup.status string · enum required Overall readiness. Pending states identify the next setup step. unavailable means the state could not be established; it is not proof that DNS or the certificate is incorrect.
not_configured pending_verification pending_routing pending_certificate active unavailable setup.reason string · nullable required Explanation of the current setup state, or null when no explanation is needed.
setup.verification object · nullable required Ownership-verification TXT record to publish at the authoritative DNS provider; null when no record is available or needed. Copy the returned name and value exactly.
setup.routing array<object> required Selected hostnames with the origin values preserved during preparation and the required external-DNS routing changes. Publish the returned routing record without mixing conflicting record types at that name. An unsupported row cannot be treated as configured.
setup.routing[].hostname string required
· Example: www.example.com setup.routing[].currentOrigin array<object> required setup.routing[].currentOrigin[].type string · enum required A AAAA CNAME setup.routing[].currentOrigin[].value string required
· Example: 203.0.113.10 setup.routing[].record object · nullable required Exact routing record to publish at the external DNS provider, or null when unavailable. ALIAS is for an apex-capable flattened alias; only use it when that provider supports it. Do not replace an apex with an ordinary CNAME when that would conflict with its other records.
setup.routing[].status string · enum required pending verified unsupported unknown setup.routing[].reason string · nullable required Nullable: may be null when not applicable.
setup.certificate object required setup.certificate.status string · enum required active pending error unknown setup.certificate.hosts array<string> required Hostnames reported for the CDN HTTPS certificate.
setup.checkedAt string · nullable required UTC time of the last setup check, or null when no check time is known.
setup.currentNameservers array<string> required setup.expectedNameservers array<string> required
· Example: ["primary.ns.hostup.se","secondary.ns.hostup.se"] Nameservers for the managed-nameserver alternative. Partial setup does not require switching to these nameservers.
setup.registrarRelation string · enum required Where the domain's registrar management is available; independent of the selected CDN setup mode.
hostup external unknown setup.nameserverManagementUrl string · nullable required Customer-facing nameserver-management URL when the domain can be managed here. Otherwise null: publish expectedNameservers through the external registrar if choosing managed nameservers.
id string · nullable
· Example: cdn_01hxa3b4c5d6e7f8g9h0j1k2m3 Public CDN zone ID, also returned before setup is provisioned. Null only when no manageable resource identity can be returned.
domain string
· Example: example.com domainId string · nullable
· Example: dom_01hxa3b4c5d6e7f8g9h0j1k2m3 Public domain ID for registrar-owned domains; null for DNS-only zones.
status string · enum
· Example: active active pending misconfigured missing disabled reason string · nullable
· Example: null proxied boolean
· Example: true securityLevel string · enum
· Example: medium off low medium high ssl object ssl.status string · enum required
· Example: active active pending error ssl.expiresAt string · nullable required
· Example: 2026-08-01T00:00:00.000Z Nullable: may be null when not applicable.
ruleCount integer
· Example: 2 security object security.level string · enum required
· Example: medium Overall CDN security level.
off low medium high security.sslMode string · enum required
· Example: full TLS mode used between visitors, CDN, and origin.
off flexible full strict security.alwaysUseHttps boolean required
· Example: true security.minTlsVersion string · enum required
· Example: 1.2 1.0 1.1 1.2 1.3 security.botProtection boolean required
· Example: true security.blockBadCrawlers boolean required
· Example: true security.blockBadBots boolean required
· Example: true security.wpLoginProtection boolean required
· Example: true Protect WordPress login endpoints.
security.wpAdminChallenge boolean required
· Example: true Challenge requests to WordPress administration paths.
performance object performance.earlyHints boolean required
· Example: true performance.alwaysOnline boolean required
· Example: true cache object cache.purgeCache boolean required
· Example: false Current persisted cache-purge toggle returned by the CDN settings surface.
waf object waf.skipEnabled boolean required
· Example: false Whether custom WAF skip rules are enabled.
waf.challengeGeoEnabled boolean required
· Example: true Whether visitor-profile country challenge logic is enabled.
waf.visitorProfileMode string · enum required
· Example: challenge challenge asks visitors outside the configured country profile to complete a challenge; block blocks them; off disables this profile action.
off challenge block waf.ipAllowlist array<string> required
· Example: ["203.0.113.10"] IP addresses or CIDR ranges allowed through custom WAF checks.
waf.uaAllowlist array<string> required
· Example: ["HostUp-Monitor"] User-agent substrings allowed through custom WAF checks.
waf.pathAllowlist array<string> required
· Example: ["/health"] Path prefixes allowed through custom WAF checks.
geoRestriction object geoRestriction.enabled boolean required
· Example: true geoRestriction.whitelistCountries array<string> required
· Example: ["SE"] Effective uppercase country-code allowlist kept for compatibility. Prefer combinedCountries for new integrations.
geoRestriction.mode string · enum required
· Example: whitelist off disables the allowlist; whitelist allows only combinedCountries.
off whitelist geoRestriction.standardCountries array<string> required
· Example: [] System-required countries that callers cannot remove.
geoRestriction.additionalCountries array<string> required
· Example: ["SE"] Caller-managed country codes layered on top of standardCountries.
geoRestriction.combinedCountries array<string> required
· Example: ["SE"] Effective allowlist: standardCountries plus additionalCountries.
activity object activity.lastChangeDetectedAt string · nullable required
· Example: 2026-04-27T12:00:00.000Z Nullable: may be null when not applicable.
activity.lastCheckedAt string · nullable required
· Example: 2026-04-27T12:00:00.000Z Nullable: may be null when not applicable.
activity.settingsUpdatedAt string · nullable required
· Example: 2026-04-27T12:00:00.000Z Nullable: may be null when not applicable.
actions object actions.canEnableProxy object required actions.canEnableProxy.allowed boolean required
· Example: true actions.canEnableProxy.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canEnableProxy.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canIssueCertificate object required actions.canIssueCertificate.allowed boolean required
· Example: true actions.canIssueCertificate.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canIssueCertificate.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canChangeMode object required actions.canChangeMode.allowed boolean required
· Example: true actions.canChangeMode.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canChangeMode.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canActivate object required actions.canActivate.allowed boolean required
· Example: true actions.canActivate.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canActivate.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canDeactivate object required actions.canDeactivate.allowed boolean required
· Example: true actions.canDeactivate.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canDeactivate.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canPreparePartial object required Whether external-DNS preparation may be requested. The request also verifies current authoritative delegation; a currently delegated full setup cannot be converted through this action.
actions.canPreparePartial.allowed boolean required
· Example: true actions.canPreparePartial.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canPreparePartial.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
actions.canCheckPartial object required Whether an existing partial setup can be checked now.
actions.canCheckPartial.allowed boolean required
· Example: true actions.canCheckPartial.reason string · nullable required
· Example: null Nullable: may be null when not applicable.
actions.canCheckPartial.code string · nullable
· Example: pending_order Machine-readable reason code when an action is blocked.
records array<any> · nullable null unless includeRecords=true.
type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object Retry-After seconds plus X-RateLimit-* headers. 10 fields type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object type string
· Example: https://developer.hostup.se/errors/invalid_request title string
· Example: Validation failed status integer
· Example: 400 detail string
· Example: The request body failed validation. code string
· Example: invalid_request Stable machine-readable code. Branch on this field, not on detail.
instance string
· Example: /api/v2/orders requestId string
· Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3 timestamp string
· Example: 2026-04-27T12:34:56.000Z errors array<object> Field-level validation errors when code is invalid_request.
errors[].pointer string required
· Example: /items/0/eppCode errors[].detail string required
· Example: `eppCode` is required for this transfer. errors[].code string required
· Example: missing_required extensions object https://cloud.hostup.se/api/v2/cdn/zones/{id} curl -X POST "https://cloud.hostup.se/api/v2/cdn/zones/cdn_01hxa3b4c5d6e7f8g9h0j1k2m3" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
-d '{
"action": "prepare_partial"
}'// The selected www hostname is prepared; publish the returned TXT and routing record before checking again. Values below are illustrative.
{
"id": "cdn_01hxa3b4c5d6e7f8g9h0j1k2m3",
"domain": "example.com",
"domainId": "dom_01hxa3b4c5d6e7f8g9h0j1k2m3",
"status": "pending",
"reason": "Add the verification TXT record at your DNS provider.",
"proxied": false,
"securityLevel": "medium",
"ssl": {
"status": "pending",
"expiresAt": null
},
"ruleCount": 2,
"security": {
"level": "medium",
"sslMode": "full",
"alwaysUseHttps": true,
"minTlsVersion": "1.2",
"botProtection": true,
"blockBadCrawlers": true,
"blockBadBots": true,
"wpLoginProtection": true,
"wpAdminChallenge": true
},
"performance": {
"earlyHints": true,
"alwaysOnline": true
},
"cache": {
"purgeCache": false
},
"waf": {
"skipEnabled": false,
"challengeGeoEnabled": true,
"visitorProfileMode": "challenge",
"ipAllowlist": [
"203.0.113.10"
],
"uaAllowlist": [
"HostUp-Monitor"
],
"pathAllowlist": [
"/health"
]
},
"geoRestriction": {
"enabled": true,
"whitelistCountries": [
"SE"
],
"mode": "whitelist",
"standardCountries": [],
"additionalCountries": [
"SE"
],
"combinedCountries": [
"SE"
]
},
"activity": {
"lastChangeDetectedAt": "2026-04-27T12:00:00.000Z",
"lastCheckedAt": "2026-04-27T12:00:00.000Z",
"settingsUpdatedAt": "2026-04-27T12:00:00.000Z"
},
"actions": {
"canEnableProxy": {
"allowed": false,
"reason": "Add the verification TXT record at your DNS provider."
},
"canIssueCertificate": {
"allowed": true,
"reason": null
},
"canChangeMode": {
"allowed": true,
"reason": null
},
"canActivate": {
"allowed": false,
"reason": "Add the verification TXT record at your DNS provider."
},
"canDeactivate": {
"allowed": false,
"reason": "CDN is not active for this domain."
},
"canPreparePartial": {
"allowed": false,
"reason": "External DNS setup is already prepared. Check its current status."
},
"canCheckPartial": {
"allowed": true,
"reason": null
}
},
"records": null,
"setup": {
"mode": "partial",
"status": "pending_verification",
"reason": "Add the verification TXT record at your DNS provider.",
"verification": {
"type": "TXT",
"name": "cdn-verification.example.com",
"value": "example-verification-value",
"status": "pending"
},
"routing": [
{
"hostname": "www.example.com",
"currentOrigin": [
{
"type": "A",
"value": "203.0.113.10"
}
],
"record": {
"type": "CNAME",
"name": "www.example.com",
"value": "www.example.com.cdn.example.net"
},
"status": "pending",
"reason": null
}
],
"certificate": {
"status": "pending",
"hosts": []
},
"checkedAt": "2026-04-27T12:00:00.000Z",
"currentNameservers": [
"ns1.example.net",
"ns2.example.net"
],
"expectedNameservers": [
"primary.ns.hostup.se",
"secondary.ns.hostup.se"
],
"registrarRelation": "hostup",
"nameserverManagementUrl": "/domains/example.com?tab=nameservers"
}
}
// Previously prepared www hostname is verified and active; record values are illustrative, always use those returned for the selected zone.
{
"id": "cdn_01hxa3b4c5d6e7f8g9h0j1k2m3",
"domain": "example.com",
"domainId": "dom_01hxa3b4c5d6e7f8g9h0j1k2m3",
"status": "active",
"reason": null,
"proxied": true,
"securityLevel": "medium",
"ssl": {
"status": "active",
"expiresAt": "2026-08-01T00:00:00.000Z"
},
"ruleCount": 2,
"security": {
"level": "medium",
"sslMode": "full",
"alwaysUseHttps": true,
"minTlsVersion": "1.2",
"botProtection": true,
"blockBadCrawlers": true,
"blockBadBots": true,
"wpLoginProtection": true,
"wpAdminChallenge": true
},
"performance": {
"earlyHints": true,
"alwaysOnline": true
},
"cache": {
"purgeCache": false
},
"waf": {
"skipEnabled": false,
"challengeGeoEnabled": true,
"visitorProfileMode": "challenge",
"ipAllowlist": [
"203.0.113.10"
],
"uaAllowlist": [
"HostUp-Monitor"
],
"pathAllowlist": [
"/health"
]
},
"geoRestriction": {
"enabled": true,
"whitelistCountries": [
"SE"
],
"mode": "whitelist",
"standardCountries": [],
"additionalCountries": [
"SE"
],
"combinedCountries": [
"SE"
]
},
"activity": {
"lastChangeDetectedAt": "2026-04-27T12:00:00.000Z",
"lastCheckedAt": "2026-04-27T12:00:00.000Z",
"settingsUpdatedAt": "2026-04-27T12:00:00.000Z"
},
"actions": {
"canEnableProxy": {
"allowed": true,
"reason": null
},
"canIssueCertificate": {
"allowed": true,
"reason": null
},
"canChangeMode": {
"allowed": true,
"reason": null
},
"canActivate": {
"allowed": false,
"reason": "CDN is already active for this domain."
},
"canDeactivate": {
"allowed": true,
"reason": null
},
"canPreparePartial": {
"allowed": false,
"reason": "External DNS setup is already prepared. Check its current status."
},
"canCheckPartial": {
"allowed": true,
"reason": null
}
},
"records": null,
"setup": {
"mode": "partial",
"status": "active",
"reason": null,
"verification": {
"type": "TXT",
"name": "cdn-verification.example.com",
"value": "example-verification-value",
"status": "verified"
},
"routing": [
{
"hostname": "www.example.com",
"currentOrigin": [
{
"type": "A",
"value": "203.0.113.10"
}
],
"record": {
"type": "CNAME",
"name": "www.example.com",
"value": "www.example.com.cdn.example.net"
},
"status": "verified",
"reason": null
}
],
"certificate": {
"status": "active",
"hosts": [
"www.example.com"
]
},
"checkedAt": "2026-04-27T12:00:00.000Z",
"currentNameservers": [
"ns1.example.net",
"ns2.example.net"
],
"expectedNameservers": [
"primary.ns.hostup.se",
"secondary.ns.hostup.se"
],
"registrarRelation": "hostup",
"nameserverManagementUrl": "/domains/example.com?tab=nameservers"
}
}{
"action": "prepare_partial"
}