## Sites (`sites`)

CDN-accelerated sites. Creating one needs at least a domain and an origin; admins can manage any tenant's sites.

Authentication: User (some parameters admin only) · Docs: https://www-demo.kuxitong.com/en/docs/api/sites

### GET `/api/v2/sites`

List sites · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `page` | integer |  | Page number, starting from 1 Default: 1 |
| `page_size` | integer |  | Items per page Default: 20 |
| `sort` | string |  | Sort fields, comma-separated; prefix `-` for descending, e.g. `-created_at,id` |
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |
| `ids` | string |  | Only list these IDs: comma-separated positive integers, at most 200 after deduplication (same as the page_size limit; more returns 400); an empty value is the same as omitting it. Combined with other filters as an intersection; IDs you cannot see are silently left out. Pagination is unchanged: set page_size to at least the number of IDs to get them in one page |
| `domain` | string |  | Filter by domain substring (case-insensitive); a.example.com also matches www.a.example.com. Use domains for exact matching. |
| `domains` | string |  | Comma-separated domains; matches sites having any domain exactly equal to one of them (case-insensitive, no substring match). |
| `group_id` | integer |  | Only list sites in this group. |
| `group_ids` | string |  | Comma-separated group IDs (positive integers, at most 200 after deduplication); a site in any of them matches. May be combined with group_id (both must hold). |
| `app` | string |  | Filter by the application identified by the checkup (exact match, e.g. wordpress); sites never checked do not match. |
| `enabled` | boolean |  | Filter by enabled state. |
| `id` | integer |  | Filter by exact site id (panel search box "Site ID"). |
| `name` | string |  | Filter by name substring. |
| `origin` | string |  | Filter by origin host substring (panel search box "Origin IP"). |
| `stop_code` | integer |  | Filter by stop code; 0 = normal (panel search box "Site status"). |
| `upid` | integer |  | Filter by user package. |
| `http_port` | integer |  | Only list sites whose HTTP listen ports (config.http_ports) include this port; exact match (80 does not match 8080). |
| `https_port` | integer |  | Only list sites whose HTTPS listen ports (config.https.ports) include this port; sites without HTTPS never match. |
| `https_enabled` | boolean |  | true lists only sites with HTTPS enabled (config.https has listen ports); false lists only sites without HTTPS. |
| `package_id` | integer |  | Filter by base package (the owning user package was bought from it). |
| `region_id` | integer |  | Filter by region (the CNAME's primary line group belongs to it); owners without their own CNAME use their user package's shared one. |
| `node_group_id` | integer |  | Filter by line group (the CNAME's primary or backup line group). |
| `cname_domain_id` | integer |  | Filter by CNAME root domain. |
| `cname_hostname` | string |  | Filter by CNAME host label, exact match (case-insensitive, without the root domain). |
| `sync_state` | string |  | Filter by config sync state: behind = some online node has not yet installed the config version containing its latest change; Values: ["behind","synced"] |

```sh
curl "https://panel.example.com/api/v2/sites" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites`

Create site · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `tenant_id` | integer |  | Owning tenant when an admin creates on behalf of a tenant (required); ignored for tenant callers, whose own account is always the owner. |

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `cname` | CnameBinding |  | Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name. |
| `config` | object |  | Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets). |
| `domains` | string[] | Yes | Domains served by the site. |
| `enabled` | boolean |  | Whether enabled |
| `group_ids` | integer[] |  | Ids of the site groups the site belongs to. |
| `name` | string |  | Name |
| `origins` | SiteOrigin[] | Yes | Origin servers. |
| `stop_code` | integer |  | 0 = normal; non-zero = every request is answered with this status code (set by admin or billing). |
| `upid` | integer |  | User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty). |

```sh
curl -X POST "https://panel.example.com/api/v2/sites" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domains":["www.example.com"],"name":"demo","origins":[{"host":"203.0.113.10"}]}'
```

### POST `/api/v2/sites/batch`

Batch update sites · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `tenant_id` | integer |  | Owning tenant when an admin creates on behalf of a tenant (required); ignored for tenant callers, whose own account is always the owner. |

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `action` | string | Yes | Batch action: set_enabled, delete, set_groups, update_config or create. Values: ["set_enabled","delete","set_groups","update_config","create"] |
| `config` | object |  | Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets). |
| `enabled` | boolean |  | Whether enabled |
| `group_ids` | integer[] |  | Ids of the site groups the site belongs to. |
| `ids` | integer[] |  | Ids of the sites to operate on (up to 100; required by every action except create). |
| `items` | SiteWrite[] |  | Used by create: the sites to create (up to 100), each shaped like the POST /sites request body. |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/batch" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"set_enabled","enabled":false,"ids":[1]}'
```

### POST `/api/v2/sites/checkup-fix-batch`

Batch one-click fix for a checkup problem · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `batch` | string |  | rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch. |
| `ids` | integer[] | Yes | Ids of the sites to operate on (up to 100; required by every action except create). |
| `key` | string | Yes | Key of the checkup problem to fix, same meaning as the single-site fix. Values: ["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"] |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/checkup-fix-batch" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/checkup-fix-batches`

List recent checkup fix batches · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |

```sh
curl "https://panel.example.com/api/v2/sites/checkup-fix-batches" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/origin-alerts`

Origin inconsistency alerts · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `site_id` | integer |  | Only this site. |

```sh
curl "https://panel.example.com/api/v2/sites/origin-alerts" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/protect-recommend/apply`

Batch apply the recommended protection settings · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `ids` | integer[] | Yes | Ids of the sites to operate on (up to 100; required by every action except create). |
| `observe_days` | integer |  | Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value. |
| `skip` | string[] |  | Recommended items the user unticked and that must not be applied this time. |
| `type` | string | Yes | Site type - corporate, shop, content, api, admin or download. Values: ["corporate","shop","content","api","admin","download"] |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/apply" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/protect-recommend/preview`

Preview the impact of the recommended protection settings · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `ids` | integer[] | Yes | Ids of the sites to operate on (up to 100; required by every action except create). |
| `observe_days` | integer |  | Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value. |
| `skip` | string[] |  | Recommended items the user unticked and that must not be applied this time. |
| `type` | string |  | Site type - corporate, shop, content, api, admin or download. Values: ["corporate","shop","content","api","admin","download"] |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/preview" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/protect-recommend/undo`

Undo a batch of recommended protection settings · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `batch` | string | Yes | rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch. |
| `ids` | integer[] | Yes | Ids of the sites to operate on (up to 100; required by every action except create). |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/protect-recommend/undo" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/region-check`

Pre-save check of a region limit · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `region_limit` | object | Yes | The region limit to check (same as Site.config.region_limit). |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/region-check" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"region_limit":{"country":["JP"],"mode":"block"}}'
```

### POST `/api/v2/sites/select-ids`

Get all site IDs matching a filter · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `tenant_id` | integer |  | Admin only: filter by tenant. Ignored for tenant credentials, which only see their own tenant's data |

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `app` | string |  | Filter by the application identified by the checkup (exact match). |
| `domain` | string |  | Filter by domain substring (case-insensitive). |
| `domains` | string[] |  | Domains served by the site. |
| `enabled` | boolean |  | Whether enabled |
| `group_id` | integer |  | Only sites in this group. |
| `group_ids` | integer[] |  | Ids of the site groups the site belongs to. |
| `name` | string |  | Name |
| `origin` | string |  | Filter by origin host substring. |
| `stop_code` | integer |  | 0 = normal; non-zero = every request is answered with this status code (set by admin or billing). |
| `upid` | integer |  | User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty). |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/select-ids" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}`

Get site · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PUT `/api/v2/sites/{id}`

Update site · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `cname` | CnameBinding |  | Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name. |
| `config` | object |  | Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets). |
| `domains` | string[] |  | Domains served by the site. |
| `enabled` | boolean |  | Whether enabled |
| `expected_updated_at` | string |  | Optimistic lock (used on update) - the updated_at of the resource as the caller read it. If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check. |
| `group_ids` | integer[] |  | Ids of the site groups the site belongs to. |
| `name` | string |  | Name |
| `origins` | SiteOrigin[] |  | Origin servers. |
| `stop_code` | integer |  | 0 = normal; non-zero = every request is answered with this status code (set by admin or billing). |
| `upid` | integer |  | User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty). |

```sh
curl -X PUT "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":false}'
```

### DELETE `/api/v2/sites/{id}`

Delete site · Authentication: User (some parameters admin only)

```sh
curl -X DELETE "https://panel.example.com/api/v2/sites/{id}" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/{id}/checkup-fix`

One-click fix for a checkup problem · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `key` | string | Yes | Key of the checkup problem to fix, same meaning as the single-site fix. Values: ["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"] |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/{id}/checkup-fix" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"key":"no_https"}'
```

### GET `/api/v2/sites/{id}/health`

Site origin health status · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/sites/{id}/health" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}/l2`

Get site tiered origin · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/sites/{id}/l2" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PATCH `/api/v2/sites/{id}/l2`

Update site tiered origin · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `enabled` | boolean |  | Whether enabled |
| `l2_group_id` | integer |  | L2 group used; null for region default. |
| `l2_pick` | string |  | How L2 is picked for this site; null to follow the defaults. Values: ["region","near"] |
| `origin_l2_only` | boolean |  | Origin allows only L2: dynamic requests also go via L2, borrowing other regions when needed. |
| `origin_max_conns` | integer |  | Max origin concurrency per node; 0 for unlimited. Excess requests queue instead of failing with 503. |

```sh
curl -X PATCH "https://panel.example.com/api/v2/sites/{id}/l2" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}/l2-egress-ips`

Origin allowlist · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `fmt` | string |  | Format of text: ip one per line, nginx allow lines, or iptables rules; defaults to ip. Values: ["ip","nginx","iptables"] Default: "ip" |

```sh
curl "https://panel.example.com/api/v2/sites/{id}/l2-egress-ips" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}/l2-stats`

Site tiered origin statistics · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `start` | string | Yes | Start time (inclusive), RFC 3339 |
| `end` | string | Yes | End time (exclusive), RFC 3339 |

```sh
curl "https://panel.example.com/api/v2/sites/{id}/l2-stats" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### PUT `/api/v2/sites/{id}/site-type`

Set the site type · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `type` | string | Yes | Site type - corporate, shop, content, api, admin or download. Values: ["corporate","shop","content","api","admin","download"] |

```sh
curl -X PUT "https://panel.example.com/api/v2/sites/{id}/site-type" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type":"shop"}'
```

### GET `/api/v2/sites/{id}/speed`

Site acceleration statistics · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `range` | string |  | Statistics window, default 24h. Values: ["1h","24h","7d"] Default: "24h" |

```sh
curl "https://panel.example.com/api/v2/sites/{id}/speed" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}/upload-scan/exceptions`

List a site's upload scan exceptions · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/sites/{id}/upload-scan/exceptions" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/{id}/upload-scan/false-positive`

Mark a site's upload scan hit as a false positive · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `path` | string |  | Path prefix (starting with /); defaults to /. |
| `sha256` | string |  | sha256 of the hit file (lowercase hex); a tenant's value must appear in the site's upload hit events; if given, intelligence sharing is on and sig is not empty, a false-positive intelligence item is queued in the same transaction. |
| `sig` | string |  | Signature name of the false positive (the rule name in the event); empty = the whole path is not scanned (path is then required). |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/{id}/upload-scan/false-positive" \
  -H "X-API-Key: $GOCDN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"path":"/upload/avatar/","sig":"ext:php"}'
```

### DELETE `/api/v2/sites/{id}/upload-scan/false-positive`

Revoke a site's upload scan false-positive mark · Authentication: User (some parameters admin only)

Query parameters:

| Field | Type | Required | Description |
|---|---|---|---|
| `path` | string | Yes | Path prefix of the exception. |
| `sig` | string |  | Signature name of the exception; omitted or empty = a whole-path exception. |

```sh
curl -X DELETE "https://panel.example.com/api/v2/sites/{id}/upload-scan/false-positive" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### GET `/api/v2/sites/{id}/url-guard/active`

List a site's URL protections in effect · Authentication: User (some parameters admin only)

```sh
curl "https://panel.example.com/api/v2/sites/{id}/url-guard/active" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

### POST `/api/v2/sites/{id}/url-guard/revoke`

Manually revoke a site's URL protections in effect · Authentication: User (some parameters admin only)

Request body:

| Field | Type | Required | Description |
|---|---|---|---|
| `path` | string |  | Path prefix (starting with /); defaults to /. |

```sh
curl -X POST "https://panel.example.com/api/v2/sites/{id}/url-guard/revoke" \
  -H "X-API-Key: $GOCDN_API_KEY"
```

Sites object:

| Field | Type | Required | Description |
|---|---|---|---|
| `action` | string | Yes | Batch action: set_enabled, delete, set_groups, update_config or create. Values: ["set_enabled","delete","set_groups","update_config","create"] |
| `added_at` | string |  | When the entry was added; early manual entries have none. |
| `affected` | integer |  | Number of affected records |
| `app` | string |  | Filter by the application identified by the checkup (exact match). |
| `batch` | string |  | rec_type only - pass the batch returned by the first segment so all segments share one undo batch; omit to start a new batch. |
| `capacity_warnings` | SiteCapacityWarning[] |  | Only in the responses of creating a site (POST /sites) and moving it to another line group (PUT /sites/{id}), when a node of the target line group has reached its memory capacity limit; a warning only, never blocks. Omitted when no node is over the limit. (read-only) |
| `checked_at` | string |  | Time the details were requested from the nodes. |
| `cname` | CnameBinding |  | Access name (CNAME). Users point their domain to fqdn with a CNAME record; the platform generates its DNS records from the node group. null when there is no access name. |
| `config` | object |  | Node config fields (top-level fields of schema/site.json, without id, uid, upid, domains, origins, enabled, stop_code and rulesets). |
| `country` | string |  | Country/region code, omitted if unknown. |
| `created_at` | string |  | Created at (read-only) |
| `default_pick` | string |  | The current default method (applies when l2_pick is null). Values: ["region","near"] |
| `domain` | string |  | Filter by domain substring (case-insensitive). |
| `domains` | string[] |  | Domains served by the site. |
| `edge_origin_requests` | integer |  | Edge origin requests (hit rate denominator). |
| `enabled` | boolean |  | Whether enabled |
| `end` | string |  | Window end (exclusive, rounded to 5 minutes). |
| `expected_updated_at` | string |  | Optimistic lock (used on update) - the updated_at of the resource as the caller read it. If it differs from the stored one, 409 stale_version is returned and nothing is saved; omit to skip the check. |
| `found` | boolean |  | The IP was found in the database (otherwise judged as an unidentified visitor). |
| `gate_reasons` | SiteGateReasonIds |  | The sites in ids whose WAF Enhanced is not in effect, grouped by reason (only sites with a reason are listed; the whole field is omitted when all are in effect). The picker uses package to mark sites as not covered by the plan and disable them. (read-only) |
| `group_id` | integer |  | Only sites in this group. |
| `group_ids` | integer[] |  | Ids of the site groups the site belongs to. |
| `group_options` | L2SiteRefGroup[] |  | Custom L2 groups available. |
| `hit_rate` | number |  | Hit rate 0-1; 0 when there were no origin requests. |
| `id` | integer |  | Record ID (read-only) |
| `ids` | integer[] |  | Ids of the sites to operate on (up to 100; required by every action except create). |
| `ip` | string |  | The caller's IP. |
| `isp` | string |  | ISP code, omitted if unknown. |
| `items` | SiteWrite[] |  | Used by create: the sites to create (up to 100), each shaped like the POST /sites request body. |
| `key` | string | Yes | Key of the checkup problem to fix, same meaning as the single-site fix. Values: ["no_https","tls_old","sec_headers","waf_block","cc_mid","rec_type"] |
| `l2_group_id` | integer |  | L2 group used; null for region default. |
| `l2_hit_requests` | integer |  | Origin requests served by L2 (hit rate numerator). |
| `l2_pick` | string |  | How L2 is picked for this site; null to follow the defaults. Values: ["region","near"] |
| `log` | SiteSpeedLog |  | Protocol split, origin time percentiles, sampled cache-miss URLs and edge response times from the raw access log (weighted by sample weight), same window as totals. |
| `log_keep_days` | integer |  | Raw access log retention in days (reports.access_log_days); when the window is longer, log only covers what is still kept. |
| `missing` | string[] |  | Selected fields the current database has no data for (those selections never match). |
| `name` | string |  | Name |
| `node_issues` | NodeIssue[] |  | Ports or reasons for which the site is not fully in effect on online nodes (in the list and the detail); omitted when everything is in effect. (read-only) |
| `nodes` | SiteHealthNode[] |  | Details from each active node, ordered by node id. |
| `observe_days` | integer |  | Overrides the observe-first days of waf_mode in the table (0 blocks immediately); defaults to the table value. |
| `origin` | string |  | Filter by origin host substring. |
| `origin_l2_only` | boolean |  | Origin allows only L2: dynamic requests also go via L2, borrowing other regions when needed. |
| `origin_max_conns` | integer |  | Max origin concurrency per node; 0 for unlimited. Excess requests queue instead of failing with 503. |
| `origin_requests` | integer |  | Requests that reached the origin. |
| `origin_requests_est` | integer |  | Estimate without tiering (= edge origin requests). |
| `origins` | SiteOrigin[] |  | Origin servers. |
| `path` | string |  | Path prefix (starting with /); defaults to /. |
| `points` | SiteSpeedPoint[] |  | Per-bucket details (only buckets with traffic are listed). |
| `prov` | string |  | Province code, omitted if unknown. |
| `publish_seq` | integer |  | Only in the responses of creating and updating a site: the sequence number of this write (same as the Publish-Seq response header); pass it to GET /config-publish/applied?seq= to check whether it has reached the nodes. (read-only) |
| `range` | string |  | Statistics window (1h, 24h or 7d). |
| `rec_ver` | integer |  | Version of the recommendation table used. |
| `region_limit` | object | Yes | The region limit to check (same as Site.config.region_limit). |
| `region_names` | string[] |  | Names of the regions with a serving L2, ordered by region ID; as many as regions. |
| `regions` | integer |  | Regions with a serving L2. |
| `revoked` | string[] |  | Revoked paths. |
| `saved_bytes` | integer |  | Origin traffic saved (bytes served from L2 cache). |
| `sha256` | string |  | sha256 of the hit file (lowercase hex); a tenant's value must appear in the site's upload hit events; if given, intelligence sharing is on and sig is not empty, a false-positive intelligence item is queued in the same transaction. |
| `sig` | string |  | Signature name of the false positive (the rule name in the event); empty = the whole path is not scanned (path is then required). |
| `site_id` | integer |  | Site id; 0 = all sites. |
| `skip` | string[] |  | Recommended items the user unticked and that must not be applied this time. |
| `source` | string |  | user chosen manually; auto detected from traffic. Values: ["user","auto"] |
| `start` | string |  | Window start. |
| `state` | string |  | Effective state: on, off, not_open, paused, no_l2, or revoking. Values: ["on","off","not_open","paused","no_l2","revoking"] |
| `status` | string |  | disabled = active health checks are off; unknown = no node returned details; healthy = all origins up on the nodes that answered; unhealthy = some origin is removed. |
| `stop_code` | integer |  | 0 = normal; non-zero = every request is answered with this status code (set by admin or billing). |
| `tenant_id` | integer |  | Owner tenant (user) ID (read-only) |
| `text` | string |  | Text in the requested format, ready to paste on the origin. |
| `total` | integer |  | Actual number of matches (may exceed the length of ids). |
| `totals` | SiteSpeedTotals |  | Totals over the whole window. |
| `truncated` | boolean |  | True when more than 100000 sites matched and ids holds only the first 100000. |
| `type` | string | Yes | Site type - corporate, shop, content, api, admin or download. Values: ["corporate","shop","content","api","admin","download"] |
| `updated_at` | string |  | Updated at (read-only) |
| `upid` | integer |  | User package id (may be empty before the package domain goes live; falls back to tenant_id in the snapshot when empty). |
| `verdict` | string |  | Result for the caller visiting the home page: pass, block (blocked) or log (logged only). Values: ["pass","block","log"] |
| `waf_gate` | SiteWafGate |  | Only in the site detail (GET /sites/{id}): the WAF Enhanced status of the site's owner and why it is not in effect. owner, packages and expired_at are in administrator responses only; tenants get gate and reason only. List rows carry waf_gate_reason alone. (read-only) |
| `waf_gate_reason` | WafGateReason |  | Why WAF Enhanced (waf_enhanced) is not in effect; absent when gate is full or readonly. package = the platform is licensed but the owner has no unexpired package that includes WAF Enhanced; license = the platform has not enabled it (never licensed, revoked by the provider, or the license was disabled); expired = the platform license has expired and its read-only buffer period (License.readonly_days, default 7 days) has passed, so it fell back to basic. Values: ["package","license","expired"] (read-only) |