# Add a website

`POST /v1/service/@id/waf/zones` · scope `waf:write`

Adds a website, all or nothing: body `apex` (main domain), `hostnames` (subdomains, optional), `origins` (origin servers). Returns the website, its domain names, the DNS records to set, the origin and warnings.

## HTTP request

| Item | Value |
| --- | --- |
| URL | `https://api.tino.vn/v1/service/@id/waf/zones` |
| Method | `POST` |
| Scope | `waf:write` |
| Header | `Authorization: Bearer <token>` |
| Content-Type | `application/json` |
| Tokens that can call it | app tokens (`tinoat_`), personal API tokens (`tinopat_`) |

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | int | yes | Service ID |
| `apex` | body | string | yes | Main domain of the website, e.g. `example.com`. |
| `hostnames` | body | array | no | Subdomains to protect as well, e.g. `["www.example.com"]`. |
| `origins` | body | array | yes | Origin servers: `[{address, port, tls_mode}]`, `address` an IP or host name; `tls_mode` is `verify` (HTTPS, certificate checked), `no_verify` (HTTPS, self-signed certificate) or `plain` (HTTP), among `tls_modes` of the origin route. |

## Example request

```bash
curl -X POST "https://api.tino.vn/v1/service/100001/waf/zones" \
  -H "Authorization: Bearer $TINO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "apex": "example.com",
  "hostnames": [
    "www.example.com"
  ],
  "origins": [
    {
      "address": "203.0.113.10",
      "port": 443,
      "tls_mode": "verify"
    }
  ]
}'
```

`$TINO_TOKEN` is a token with the scope `waf:write`. Path parameters in the example are sample values.

SDK ([SDK & examples](/en/docs/sdk)): no dedicated function yet, use `client.request("POST", "/service/@id/waf/zones")`.

## Example response

No live sample: the route changes real data or the test account has no data for it. The answer is a JSON object; errors follow the common shape in [Calling the Tino API](/en/docs/api#errors).