Version 2.1.1792967583 · latest Download OpenAPI Markdown

Sites

CDN-accelerated sites. Creating one needs at least a domain and an origin; admins can manage any tenant's sites.

sitesSitesAuthentication: User (some parameters admin only)27 endpoints

List sites

GET/api/v2/sites

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
page	integer	—	Page number, starting from 1 Default `1`
page_size	integer	—	Items per page Default `20`
sort	string	—	Sort fields, comma-separated; prefix `-` for descending, e.g. `-created_at,id`
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data
ids	string	—	Only list these IDs: comma-separated positive integers, at most 200 after deduplication (same as the page_size limit; more returns 400); an empty value is the same as omitting it. Combined with other filters as an intersection; IDs you cannot see are silently left out. Pagination is unchanged: set page_size to at least the number of IDs to get them in one page
domain	string	—	Filter by domain substring (case-insensitive); a.example.com also matches www.a.example.com. Use domains for exact matching.
domains	string	—	Comma-separated domains; matches sites having any domain exactly equal to one of them (case-insensitive, no substring match).
group_id	integer	—	Only list sites in this group.
group_ids	string	—	Comma-separated group IDs (positive integers, at most 200 after deduplication); a site in any of them matches. May be combined with group_id (both must hold).
app	string	—	Filter by the application identified by the checkup (exact match, e.g. wordpress); sites never checked do not match.
enabled	boolean	—	Filter by enabled state.
id	integer	—	Filter by exact site id (panel search box "Site ID").
name	string	—	Filter by name substring.
origin	string	—	Filter by origin host substring (panel search box "Origin IP").
stop_code	integer	—	Filter by stop code; 0 = normal (panel search box "Site status").
upid	integer	—	Filter by user package.
http_port	integer	—	Only list sites whose HTTP listen ports (config.http_ports) include this port; exact match (80 does not match 8080).
https_port	integer	—	Only list sites whose HTTPS listen ports (config.https.ports) include this port; sites without HTTPS never match.
https_enabled	boolean	—	true lists only sites with HTTPS enabled (config.https has listen ports); false lists only sites without HTTPS.
package_id	integer	—	Filter by base package (the owning user package was bought from it).
region_id	integer	—	Filter by region (the CNAME's primary line group belongs to it); owners without their own CNAME use their user package's shared one.
node_group_id	integer	—	Filter by line group (the CNAME's primary or backup line group).
cname_domain_id	integer	—	Filter by CNAME root domain.
cname_hostname	string	—	Filter by CNAME host label, exact match (case-insensitive, without the root domain).
sync_state	string	—	Filter by config sync state: behind = some online node has not yet installed the config version containing its latest change; Values `["behind","synced"]`

Create site

POST/api/v2/sites

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Owning tenant when an admin creates on behalf of a tenant (required); ignored for tenant callers, whose own account is always the owner.

Request body application/json

Field	Type	Required	Description
cname	CnameBinding	—	Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name.
config	object	—	Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets).
domains	string[]	Required	Domains served by the site.
enabled	boolean	—	Whether enabled
group_ids	integer[]	—	Ids of the site groups the site belongs to.
name	string	—	Name
origins	SiteOrigin[]	Required	Origin servers.
stop_code	integer	—	0 = normal; non-zero = every request is answered with this status code (set by admin or billing).
upid	integer	—	User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty).

Batch update sites

POST/api/v2/sites/batch

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Owning tenant when an admin creates on behalf of a tenant (required); ignored for tenant callers, whose own account is always the owner.

Request body application/json

Field	Type	Required	Description
action	string	Required	Batch action: set_enabled, delete, set_groups, update_config or create. Values `["set_enabled","delete","set_groups","update_config","create"]`
config	object	—	Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets).
enabled	boolean	—	Whether enabled
group_ids	integer[]	—	Ids of the site groups the site belongs to.
ids	integer[]	—	Ids of the sites to operate on (up to 100; required by every action except create).
items	SiteWrite[]	—	Used by create: the sites to create (up to 100), each shaped like the POST /sites request body.

Batch one-click fix for a checkup problem

POST/api/v2/sites/checkup-fix-batch

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
batch	string	—	rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch.
ids	integer[]	Required	Ids of the sites to operate on (up to 100; required by every action except create).
key	string	Required	Key of the checkup problem to fix, same meaning as the single-site fix. Values `["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"]`

List recent checkup fix batches

GET/api/v2/sites/checkup-fix-batches

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Origin inconsistency alerts

GET/api/v2/sites/origin-alerts

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
site_id	integer	—	Only this site.

Batch apply the recommended protection settings

POST/api/v2/sites/protect-recommend/apply

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
ids	integer[]	Required	Ids of the sites to operate on (up to 100; required by every action except create).
observe_days	integer	—	Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value.
skip	string[]	—	Recommended items the user unticked and that must not be applied this time.
type	string	Required	Site type - corporate, shop, content, api, admin or download. Values `["corporate","shop","content","api","admin","download"]`

Preview the impact of the recommended protection settings

POST/api/v2/sites/protect-recommend/preview

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
ids	integer[]	Required	Ids of the sites to operate on (up to 100; required by every action except create).
observe_days	integer	—	Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value.
skip	string[]	—	Recommended items the user unticked and that must not be applied this time.
type	string	—	Site type - corporate, shop, content, api, admin or download. Values `["corporate","shop","content","api","admin","download"]`

Undo a batch of recommended protection settings

POST/api/v2/sites/protect-recommend/undo

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
batch	string	Required	rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch.
ids	integer[]	Required	Ids of the sites to operate on (up to 100; required by every action except create).

Pre-save check of a region limit

POST/api/v2/sites/region-check

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
region_limit	object	Required	The region limit to check (same as Site.config.region_limit).

Get all site IDs matching a filter

POST/api/v2/sites/select-ids

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
tenant_id	integer	—	Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data

Request body application/json

Field	Type	Required	Description
app	string	—	Filter by the application identified by the checkup (exact match).
domain	string	—	Filter by domain substring (case-insensitive).
domains	string[]	—	Domains served by the site.
enabled	boolean	—	Whether enabled
group_id	integer	—	Only sites in this group.
group_ids	integer[]	—	Ids of the site groups the site belongs to.
name	string	—	Name
origin	string	—	Filter by origin host substring.
stop_code	integer	—	0 = normal; non-zero = every request is answered with this status code (set by admin or billing).
upid	integer	—	User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty).

Get site

GET/api/v2/sites/{id}

Authentication: User (some parameters admin only)

Update site

PUT/api/v2/sites/{id}

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
cname	CnameBinding	—	Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name.
config	object	—	Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets).
domains	string[]	—	Domains served by the site.
enabled	boolean	—	Whether enabled
expected_updated_at	string	—	Optimistic lock (used on update) - the updated_at of the resource as the caller read it. If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
group_ids	integer[]	—	Ids of the site groups the site belongs to.
name	string	—	Name
origins	SiteOrigin[]	—	Origin servers.
stop_code	integer	—	0 = normal; non-zero = every request is answered with this status code (set by admin or billing).
upid	integer	—	User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty).

Delete site

DELETE/api/v2/sites/{id}

Authentication: User (some parameters admin only)

One-click fix for a checkup problem

POST/api/v2/sites/{id}/checkup-fix

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
key	string	Required	Key of the checkup problem to fix, same meaning as the single-site fix. Values `["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"]`

Site origin health status

GET/api/v2/sites/{id}/health

Authentication: User (some parameters admin only)

Get site tiered origin

GET/api/v2/sites/{id}/l2

Authentication: User (some parameters admin only)

Update site tiered origin

PATCH/api/v2/sites/{id}/l2

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
enabled	boolean	—	Whether enabled
l2_group_id	integer	—	L2 group used; null for region default.
l2_pick	string	—	How L2 is picked for this site; null to follow the defaults. Values `["region","near"]`
origin_l2_only	boolean	—	Origin allows only L2: dynamic requests also go via L2, borrowing other regions when needed.
origin_max_conns	integer	—	Max origin concurrency per node; 0 for unlimited. Excess requests queue instead of failing with 503.

Origin allowlist

GET/api/v2/sites/{id}/l2-egress-ips

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
fmt	string	—	Format of text: ip one per line, nginx allow lines, or iptables rules; defaults to ip. Values `["ip","nginx","iptables"]`Default `"ip"`

Site tiered origin statistics

GET/api/v2/sites/{id}/l2-stats

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
start	string	Required	Start time (inclusive), RFC 3339
end	string	Required	End time (exclusive), RFC 3339

Set the site type

PUT/api/v2/sites/{id}/site-type

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
type	string	Required	Site type - corporate, shop, content, api, admin or download. Values `["corporate","shop","content","api","admin","download"]`

Site acceleration statistics

GET/api/v2/sites/{id}/speed

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
range	string	—	Statistics window, default 24h. Values `["1h","24h","7d"]`Default `"24h"`

List a site's upload scan exceptions

GET/api/v2/sites/{id}/upload-scan/exceptions

Authentication: User (some parameters admin only)

Mark a site's upload scan hit as a false positive

POST/api/v2/sites/{id}/upload-scan/false-positive

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
path	string	—	Path prefix (starting with /); defaults to /.
sha256	string	—	sha256 of the hit file (lowercase hex); a tenant's value must appear in the site's upload hit events; if given, intelligence sharing is on and sig is not empty, a false-positive intelligence item is queued in the same transaction.
sig	string	—	Signature name of the false positive (the rule name in the event); empty = the whole path is not scanned (path is then required).

Revoke a site's upload scan false-positive mark

DELETE/api/v2/sites/{id}/upload-scan/false-positive

Authentication: User (some parameters admin only)

Query parameters

Field	Type	Required	Description
path	string	Required	Path prefix of the exception.
sig	string	—	Signature name of the exception; omitted or empty = a whole-path exception.

List a site's URL protections in effect

GET/api/v2/sites/{id}/url-guard/active

Authentication: User (some parameters admin only)

Manually revoke a site's URL protections in effect

POST/api/v2/sites/{id}/url-guard/revoke

Authentication: User (some parameters admin only)

Request body application/json

Field	Type	Required	Description
path	string	—	Path prefix (starting with /); defaults to /.

Sites object

Field	Type	Required	Description
action	string	Required	Batch action: set_enabled, delete, set_groups, update_config or create. Values `["set_enabled","delete","set_groups","update_config","create"]`
added_at	string	—	When the entry was added; early manual entries have none.
affected	integer	—	Number of affected records
app	string	—	Filter by the application identified by the checkup (exact match).
batch	string	—	rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch.
capacity_warnings	SiteCapacityWarning[]	—	Only in the responses of creating a site (POST /sites) and moving it to another line group (PUT /sites/{id}), when a node of the target line group has reached its memory capacity limit; a warning only, never blocks. Omitted when no node is over the limit. read-only
checked_at	string	—	Time the details were requested from the nodes.
cname	CnameBinding	—	Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name.
config	object	—	Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets).
country	string	—	Country/region code, omitted if unknown.
created_at	string	—	Created at read-only
default_pick	string	—	The current default method (applies when l2_pick is null). Values `["region","near"]`
domain	string	—	Filter by domain substring (case-insensitive).
domains	string[]	—	Domains served by the site.
edge_origin_requests	integer	—	Edge origin requests (hit rate denominator).
enabled	boolean	—	Whether enabled
end	string	—	Window end (exclusive, rounded to 5 minutes).
expected_updated_at	string	—	Optimistic lock (used on update) - the updated_at of the resource as the caller read it. If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check.
found	boolean	—	The IP was found in the database (otherwise judged as an unidentified visitor).
gate_reasons	SiteGateReasonIds	—	The sites in ids whose WAF Enhanced is not in effect, grouped by reason (only sites with a reason are listed; the whole field is omitted when all are in effect). The picker uses package to mark sites as not covered by the plan and disable them. read-only
group_id	integer	—	Only sites in this group.
group_ids	integer[]	—	Ids of the site groups the site belongs to.
group_options	L2SiteRefGroup[]	—	Custom L2 groups available.
hit_rate	number	—	Hit rate 0-1; 0 when there were no origin requests.
id	integer	—	Record ID read-only
ids	integer[]	—	Ids of the sites to operate on (up to 100; required by every action except create).
ip	string	—	The caller's IP.
isp	string	—	ISP code, omitted if unknown.
items	SiteWrite[]	—	Used by create: the sites to create (up to 100), each shaped like the POST /sites request body.
key	string	Required	Key of the checkup problem to fix, same meaning as the single-site fix. Values `["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"]`
l2_group_id	integer	—	L2 group used; null for region default.
l2_hit_requests	integer	—	Origin requests served by L2 (hit rate numerator).
l2_pick	string	—	How L2 is picked for this site; null to follow the defaults. Values `["region","near"]`
log	SiteSpeedLog	—	Protocol split, origin time percentiles, sampled cache-miss URLs and edge response times from the raw access log (weighted by sample weight), same window as totals.
log_keep_days	integer	—	Raw access log retention in days (reports.access_log_days); when the window is longer, log only covers what is still kept.
missing	string[]	—	Selected fields the current database has no data for (those selections never match).
name	string	—	Name
node_issues	NodeIssue[]	—	Ports or reasons for which the site is not fully in effect on online nodes (in the list and the detail); omitted when everything is in effect. read-only
nodes	SiteHealthNode[]	—	Details from each active node, ordered by node id.
observe_days	integer	—	Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value.
origin	string	—	Filter by origin host substring.
origin_l2_only	boolean	—	Origin allows only L2: dynamic requests also go via L2, borrowing other regions when needed.
origin_max_conns	integer	—	Max origin concurrency per node; 0 for unlimited. Excess requests queue instead of failing with 503.
origin_requests	integer	—	Requests that reached the origin.
origin_requests_est	integer	—	Estimate without tiering (= edge origin requests).
origins	SiteOrigin[]	—	Origin servers.
path	string	—	Path prefix (starting with /); defaults to /.
points	SiteSpeedPoint[]	—	Per-bucket details (only buckets with traffic are listed).
prov	string	—	Province code, omitted if unknown.
publish_seq	integer	—	Only in the responses of creating and updating a site: the sequence number of this write (same as the Publish-Seq response header); pass it to GET /config-publish/applied?seq= to check whether it has reached the nodes. read-only
range	string	—	Statistics window (1h, 24h or 7d).
rec_ver	integer	—	Version of the recommendation table used.
region_limit	object	Required	The region limit to check (same as Site.config.region_limit).
region_names	string[]	—	Names of the regions with a serving L2, ordered by region ID; as many as regions.
regions	integer	—	Regions with a serving L2.
revoked	string[]	—	Revoked paths.
saved_bytes	integer	—	Origin traffic saved (bytes served from L2 cache).
sha256	string	—	sha256 of the hit file (lowercase hex); a tenant's value must appear in the site's upload hit events; if given, intelligence sharing is on and sig is not empty, a false-positive intelligence item is queued in the same transaction.
sig	string	—	Signature name of the false positive (the rule name in the event); empty = the whole path is not scanned (path is then required).
site_id	integer	—	Site id; 0 = all sites.
skip	string[]	—	Recommended items the user unticked and that must not be applied this time.
source	string	—	user chosen manually; auto detected from traffic. Values `["user","auto"]`
start	string	—	Window start.
state	string	—	Effective state: on, off, not_open, paused, no_l2, or revoking. Values `["on","off","not_open","paused","no_l2","revoking"]`
status	string	—	disabled = active health checks are off; unknown = no node returned details; healthy = all origins up on the nodes that answered; unhealthy = some origin is removed.
stop_code	integer	—	0 = normal; non-zero = every request is answered with this status code (set by admin or billing).
tenant_id	integer	—	Owner tenant (user) ID read-only
text	string	—	Text in the requested format, ready to paste on the origin.
total	integer	—	Actual number of matches (may exceed the length of ids).
totals	SiteSpeedTotals	—	Totals over the whole window.
truncated	boolean	—	True when more than 100000 sites matched and ids holds only the first 100000.
type	string	Required	Site type - corporate, shop, content, api, admin or download. Values `["corporate","shop","content","api","admin","download"]`
updated_at	string	—	Updated at read-only
upid	integer	—	User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty).
verdict	string	—	Result for the caller visiting the home page: pass, block (blocked) or log (logged only). Values `["pass","block","log"]`
waf_gate	SiteWafGate	—	Only in the site detail (GET /sites/{id}): the WAF Enhanced status of the site's owner and why it is not in effect. owner, packages and expired_at are in administrator responses only; tenants get gate and reason only. List rows carry waf_gate_reason alone. read-only
waf_gate_reason	WafGateReason	—	Why WAF Enhanced (waf_enhanced) is not in effect; absent when gate is full or readonly. package = the platform is licensed but the owner has no unexpired package that includes WAF Enhanced; license = the platform has not enabled it (never licensed, revoked by the provider, or the license was disabled); expired = the platform license has expired and its read-only buffer period (License.readonly_days, default 7 days) has passed, so it fell back to basic. read-onlyValues `["package","license","expired"]`

curl

# List sites
curl "https://panel.example.com/api/v2/sites" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Create site
curl -X POST "https://panel.example.com/api/v2/sites" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domains":["www.example.com"],"name":"demo","origins":[{"host":"203.0.113.10"}]}'

# Batch update sites
curl -X POST "https://panel.example.com/api/v2/sites/batch" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"set_enabled","enabled":false,"ids":[1]}'

# Batch one-click fix for a checkup problem
curl -X POST "https://panel.example.com/api/v2/sites/checkup-fix-batch" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List recent checkup fix batches
curl "https://panel.example.com/api/v2/sites/checkup-fix-batches" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Origin inconsistency alerts
curl "https://panel.example.com/api/v2/sites/origin-alerts" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Batch apply the recommended protection settings
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/apply" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Preview the impact of the recommended protection settings
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/preview" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Undo a batch of recommended protection settings
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/undo" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Pre-save check of a region limit
curl -X POST "https://panel.example.com/api/v2/sites/region-check" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"region_limit":{"country":["JP"],"mode":"block"}}'

# Get all site IDs matching a filter
curl -X POST "https://panel.example.com/api/v2/sites/select-ids" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Get site
curl "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Update site
curl -X PUT "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":false}'

# Delete site
curl -X DELETE "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"

# One-click fix for a checkup problem
curl -X POST "https://panel.example.com/api/v2/sites/{id}/checkup-fix" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key":"no_https"}'

# Site origin health status
curl "https://panel.example.com/api/v2/sites/{id}/health" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Get site tiered origin
curl "https://panel.example.com/api/v2/sites/{id}/l2" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Update site tiered origin
curl -X PATCH "https://panel.example.com/api/v2/sites/{id}/l2" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Origin allowlist
curl "https://panel.example.com/api/v2/sites/{id}/l2-egress-ips" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Site tiered origin statistics
curl "https://panel.example.com/api/v2/sites/{id}/l2-stats" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Set the site type
curl -X PUT "https://panel.example.com/api/v2/sites/{id}/site-type" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"shop"}'

# Site acceleration statistics
curl "https://panel.example.com/api/v2/sites/{id}/speed" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List a site's upload scan exceptions
curl "https://panel.example.com/api/v2/sites/{id}/upload-scan/exceptions" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Mark a site's upload scan hit as a false positive
curl -X POST "https://panel.example.com/api/v2/sites/{id}/upload-scan/false-positive" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"path":"/upload/avatar/","sig":"ext:php"}'

# Revoke a site's upload scan false-positive mark
curl -X DELETE "https://panel.example.com/api/v2/sites/{id}/upload-scan/false-positive" \
  -H "X-API-Key: $GOCDN_API_KEY"

# List a site's URL protections in effect
curl "https://panel.example.com/api/v2/sites/{id}/url-guard/active" \
  -H "X-API-Key: $GOCDN_API_KEY"

# Manually revoke a site's URL protections in effect
curl -X POST "https://panel.example.com/api/v2/sites/{id}/url-guard/revoke" \
  -H "X-API-Key: $GOCDN_API_KEY"