/v1/service/@id/waf/zonesAdd a website
Adds a website, all or nothing: body apex (main domain), hostnames (subdomains, optional), origins (origin servers). Returns the website, its domain names, the DNS records to set, the origin and warnings.
Call it through the gateway https://api.tino.vn/v1 with a token that has the waf:write scope; see Calling the Tino API.
Authentication
Send the token in the header Authorization:
Authorization: Bearer <token>
Tokens that can call it: app tokens (tinoat_, Sign in with Tino) or personal API tokens (tinopat_).
Scopes
waf:write
Parameters
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
id | int | Required | Service ID |
Body (JSON)
| Name | Type | Required | Description |
|---|---|---|---|
apex | string | Required | Main domain of the website, e.g. `example.com`. |
hostnames | array | Optional | Subdomains to protect as well, e.g. `["www.example.com"]`. |
origins | array | Required | Origin servers: `[{address, port, tls_mode}]`, `address` an IP or host name; `tls_mode` is `verify` (HTTPS, certificate checked), `no_verify` (HTTPS, self-signed certificate) or `plain` (HTTP), among `tls_modes` of the origin route. |
Response
No live sample: the route changes real data or the test account has no data for it. The answer is a JSON object; errors follow the common shape in Calling the Tino API.
Error codes
| Error code | Description |
|---|---|
401 · invalid_token | The token is wrong, expired or revoked. |
403 · insufficient_scope | The token lacks the waf:write scope. |
403 · ip_not_allowed | A personal API token called from an IP outside its allow-list. |
Business errors of a route usually come as HTTP 200 with {"error": ["<code>"]}; see common error codes.