# gocdn

> A private-deployment CDN solution: caching and acceleration, HTTPS, CC and WAF protection, and real-time monitoring on your own servers.

私有化部署的 CDN 解决方案：基于自有服务器提供缓存加速、HTTPS、CC 与 WAF 防护和实时监测。

## Pricing

- [Pricing (English)](https://www-demo.kuxitong.com/en/pricing): Starter $15/mo, Professional $45/mo, Enterprise $129/mo
- [价格(中文)](https://www-demo.kuxitong.com/zh/pricing): 入门版 ¥99/月、专业版 ¥299/月、企业版 ¥899/月
- [plans.json](https://www-demo.kuxitong.com/data/plans.json): machine-readable plans and prices

## FAQ

- [FAQ (English)](https://www-demo.kuxitong.com/en/faq)
- [常见问题](https://www-demo.kuxitong.com/zh/faq)

## Features

- [Features overview (English)](https://www-demo.kuxitong.com/en/features): Caching and acceleration, HTTPS certificates, CC and WAF protection, live monitoring and multi-node operations: everything gocdn offers.
- [功能总览(中文)](https://www-demo.kuxitong.com/zh/features): 缓存加速、HTTPS 证书、CC 与 WAF 防护、实时监测与多节点运维：gocdn 的全部功能一览。
- [Tiered caching](https://www-demo.kuxitong.com/en/features/tiered-cache): gocdn tiered caching: edge misses ask a regional L2 node first, cutting origin requests by about half in our tests.

## API reference (v2.1.1792967583)

- [API reference](https://www-demo.kuxitong.com/en/docs/api)
- [Full API reference as Markdown](https://www-demo.kuxitong.com/en/docs/api.md)
- [接口文档 Markdown](https://www-demo.kuxitong.com/zh/docs/api.md)
- [OpenAPI 3 (JSON)](https://www-demo.kuxitong.com/openapi.json)
- [Authentication](https://www-demo.kuxitong.com/en/docs/api/auth.md): Login, token refresh, logout, password change, TOTP, password reset, captcha and admin SSO. Login endpoints need no authentication.
- [Users](https://www-demo.kuxitong.com/en/docs/api/users.md): Admins manage platform accounts: create, view, update, enable/disable, reset passwords, turn off TOTP. An account must be disabled before it can be deleted.
- [Current user](https://www-demo.kuxitong.com/en/docs/api/me.md): The signed-in user views or edits their own profile, real-name verification and UI preferences.
- [API keys](https://www-demo.kuxitong.com/en/docs/api/api-keys.md): API keys of the current user. The plaintext key is returned only once at creation, and scopes can be limited per domain.
- [Registration info](https://www-demo.kuxitong.com/en/docs/api/registration-info.md): No authentication needed. Returns whether registration is open, which fields are required or need verification, and the user agreement.
- [Registrations](https://www-demo.kuxitong.com/en/docs/api/registrations.md): No authentication needed. Submits registration details to create a tenant account; the agreement must be accepted and verified email or phone needs a code.
- [Verification codes](https://www-demo.kuxitong.com/en/docs/api/verify-codes.md): No authentication needed. Sends email or SMS codes for binding at registration, password reset and second-factor login; SMS needs a captcha.
- [Login policy](https://www-demo.kuxitong.com/en/docs/api/login-policy.md): No authentication needed. Tells whether an account needs an email or SMS code to log in, with the masked destination.
- [Identity verification channels](https://www-demo.kuxitong.com/en/docs/api/certify-channels.md): Admin only: merchant credentials of Alipay identity verification and Tencent Cloud FaceID (WeChat face verification); the channel in use is chosen by certify_provider in account settings.
- [Account](https://www-demo.kuxitong.com/en/docs/api/account.md): The current users own balance and freeze status; admins manage other users accounts through the user account endpoints.
- [Orders](https://www-demo.kuxitong.com/en/docs/api/orders.md): Orders created by recharges, deductions, online payments and package purchases; tenants see only their own, admins can see all tenants, and only the remark can be edited.
- [Ledger entries](https://www-demo.kuxitong.com/en/docs/api/ledger-entries.md): Every change to an account balance, each with a balance snapshot taken after posting.
- [Online payments](https://www-demo.kuxitong.com/en/docs/api/payments.md): Start an online recharge: creates an unpaid order, pre-orders it at the payment gateway and returns the payment URL.
- [Recharge methods](https://www-demo.kuxitong.com/en/docs/api/payment-methods.md): The currently enabled online payment methods, the default method and transfer instructions, used to render the recharge page.
- [Payment channels](https://www-demo.kuxitong.com/en/docs/api/payment-channels.md): Admin settings for which gateway each payment method uses and each gateways merchant parameters; secrets are write-only.
- [Payment notifications](https://www-demo.kuxitong.com/en/docs/api/payment-notifications.md): Result notification endpoint called by payment gateways; no authentication, signature verified per gateway rules, and repeated notifications are credited only once.
- [DNS providers](https://www-demo.kuxitong.com/en/docs/api/dns-providers.md): Admin only. Stores DNS provider accounts (such as Alibaba Cloud or Cloudflare); credentials are verified online before saving and only the last 4 characters are ever returned.
- [CNAME access domains](https://www-demo.kuxitong.com/en/docs/api/cname-domains.md): Admin only. Root domains used to build CNAME access names, each owned by a DNS provider account; supports migrating everything to a new root domain and checking whether customers have switched their records.
- [DNS sync](https://www-demo.kuxitong.com/en/docs/api/dns-sync.md): Admin only. Makes the scheduler reconcile all DNS records against the desired state right away (the Record repair button in the panel).
- [Regions](https://www-demo.kuxitong.com/en/docs/api/regions.md): Geographic regions used to categorize nodes and node groups.
- [Nodes](https://www-demo.kuxitong.com/en/docs/api/nodes.md): Approved edge nodes and sub-IPs; primary nodes self-enroll with an enrollment token, while sub-IPs are added manually by an admin.
- [Pending nodes](https://www-demo.kuxitong.com/en/docs/api/pending-nodes.md): Nodes that have enrolled with a token and await admin approval; once approved they become regular nodes.
- [Node enrollment tokens](https://www-demo.kuxitong.com/en/docs/api/node-enroll-tokens.md): Generates a one-time enrollment token and a one-line node install command; the token is returned only once, when generated.
- [Node groups](https://www-demo.kuxitong.com/en/docs/api/node-groups.md): Groups lines under one access name; a backup threshold can switch to the backup group automatically when usable lines run low.
- [Lines](https://www-demo.kuxitong.com/en/docs/api/lines.md): A resolution record in a node group, showing which DNS line and weight a node appears with; a line must be disabled before it can be deleted.
- [Alert rules](https://www-demo.kuxitong.com/en/docs/api/alert-rules.md): Built-in alert rules of the control plane with their current settings and status; thresholds are changed via system settings.
- [Alerts](https://www-demo.kuxitong.com/en/docs/api/alerts.md): Recent alert and recovery events, kept for 30 days.
- [Node monitor logs](https://www-demo.kuxitong.com/en/docs/api/monitor-logs.md): Results of each probe round the control plane runs against monitored node IPs.
- [IP pools](https://www-demo.kuxitong.com/en/docs/api/ip-pools.md): IP pools and the IPs inside them, maintained by admins. A pool belongs to a region and its name is unique platform-wide.
- [IP sites](https://www-demo.kuxitong.com/en/docs/api/ip-sites.md): Sites served on IPs with custom ports; the IPs must first be selected in the user package.
- [Certificates](https://www-demo.kuxitong.com/en/docs/api/certs.md): Uploaded or automatically issued HTTPS certificates. They can be bound to sites; a certificate in use by a site cannot be deleted or disabled.
- [ACME accounts](https://www-demo.kuxitong.com/en/docs/api/acme-accounts.md): CA accounts used for automatic issuance (Let's Encrypt, ZeroSSL). Registered with the CA on first issuance.
- [DNS API (cert validation)](https://www-demo.kuxitong.com/en/docs/api/dns-apis.md): DNS provider API credentials used for DNS-01 validation and wildcard certificates. Credentials are write-only; responses return only masks.
- [Certificate settings](https://www-demo.kuxitong.com/en/docs/api/cert-settings.md): The current user's default certificate type for new certificates; leave empty to follow the platform.
- [Panel certificate](https://www-demo.kuxitong.com/en/docs/api/panel-cert.md): Admin only. Status of the panel's own HTTPS certificate; one click issues a Let's Encrypt certificate for the panel domain, renewed with certificate management.
- [File validation](https://www-demo.kuxitong.com/en/docs/api/pki-validations.md): Admin only. Provides content for the CA file validation, answered by nodes via the controller; no longer served after expiry.
- [Access control lists](https://www-demo.kuxitong.com/en/docs/api/acls.md): Rule sets that allow or block requests by IP/CIDR and other conditions; the platform provides built-in rules and tenants can create their own.
- [CC matchers](https://www-demo.kuxitong.com/en/docs/api/cc-matches.md): Conditions that identify requests in CC protection; reusable across rule groups.
- [CC filters](https://www-demo.kuxitong.com/en/docs/api/cc-filters.md): How matched requests are handled: rate limiting or a challenge (JS, slider, captcha and so on).
- [CC rules](https://www-demo.kuxitong.com/en/docs/api/cc-rules.md): Ordered combinations of matchers and filters; a site can pick one rule group.
- [Bans](https://www-demo.kuxitong.com/en/docs/api/bans.md): Records of blocked IPs: bans created by hand, unban by IP or for a whole site with an unban history, and automatic bans reported by nodes.
- [Site IP lists](https://www-demo.kuxitong.com/en/docs/api/site-ip-lists.md): Permanent IP blacklist and whitelist of one site; blacklisted IPs are dropped and whitelisted IPs skip CC and other protections. The site's temporary whitelist on nodes can also be cleared.
- [Global IP lists](https://www-demo.kuxitong.com/en/docs/api/global-ip-lists.md): Platform-wide IP blacklist and whitelist with optional expiry, reason and source per entry, plus bulk import and export; admin only.
- [CC settings](https://www-demo.kuxitong.com/en/docs/api/cc-settings.md): Platform-level default CC rule group and automatic switching settings; admin only.
- [Bot settings](https://www-demo.kuxitong.com/en/docs/api/bot-settings.md): Platform-wide bot management: the action per class (search engine / monitor and tool / automation tool / headless browser / malicious bot) and for fake crawlers, the challenge kind, behaviour score bands, protected endpoints and exceptions; admin only. Headless browser, malicious bot and fake crawler actions plus behaviour scoring belong to the paid feature WAF enhanced. Each site may override per class in the site config field bot.
- [Bot stats](https://www-demo.kuxitong.com/en/docs/api/bot-stats.md): Stats at the top of the bot management page and the per-class "requests today" column: today's requests, requests and action breakdown per bot class, number of sites with replay protection on, and node upgrade progress; tenants see their own sites only.
- [WAF settings](https://www-demo.kuxitong.com/en/docs/api/waf-settings.md): Platform-wide WAF master switch, default blocking threshold and request body inspection limit; admin only. Per-site observe/block mode and exceptions live in the site config field waf.
- [Upload scan settings](https://www-demo.kuxitong.com/en/docs/api/upload-scan-settings.md): Platform-wide upload scanning (files in multipart form uploads only): master switch, dangerous extensions, double extensions, disguised files, webshell signatures, antivirus, per-file limit, scan timeout, action and exceptions; admin only. Webshell signatures, antivirus and the sha256 blocklist belong to the paid feature WAF enhanced.
- [Upload scan stats](https://www-demo.kuxitong.com/en/docs/api/upload-scan-stats.md): Stats at the top of the upload scan page: today's scanned, blocked and over-limit unscanned counts, plus the list of sites that cannot be scanned; admin only.
- [High-risk IP library](https://www-demo.kuxitong.com/en/docs/api/intel.md): The platform-provided high-risk IP library (paid item rules update, synced hourly): status, platform-wide handling policy, entry lookup, whitelisting a single entry and today's visits that hit it; read-only for tenants.
- [Value-added protection schemes](https://www-demo.kuxitong.com/en/docs/api/protect-schemes.md): One scheme each for replay, data leak and web tamper protection (one per tenant; admins edit the platform scheme); saving also updates sites that follow the scheme, sites with their own settings are left alone; part of WAF Enhanced.
- [Replay protection](https://www-demo.kuxitong.com/en/docs/api/site-replay-guards.md): Replay protection of one site: protected APIs need a one-time token or the app signature headers, otherwise the request is blocked or challenged; can be set for the site alone or restored to the scheme; part of WAF Enhanced.
- [Data leak protection](https://www-demo.kuxitong.com/en/docs/api/site-leak-guards.md): Data leak protection of one site: checks pages, JSON and text returned by the origin for phone numbers, ID card numbers, bank card numbers, keys and error messages, and masks, blocks or replaces them with an error page; part of WAF Enhanced.
- [Network-wide URL protection settings](https://www-demo.kuxitong.com/en/docs/api/url-guard-settings.md): Platform-wide default switch and thresholds for network-wide URL protection; admin only. Per-site switch and thresholds live in the site security settings.
- [Network-wide URL protection](https://www-demo.kuxitong.com/en/docs/api/url-guard.md): Temporary challenge/rate-limit/block rules pushed for a URL once its cross-node request volume exceeds the threshold, revoked automatically on expiry; read-only view of the entries in effect.
- [Threat intelligence reports](https://www-demo.kuxitong.com/en/docs/api/intel-reports.md): Batches of threat intelligence this master reports anonymously to the vendor (auto-banned high-risk IPs, upload scan hits and false positives, newly seen file fingerprints), one batch every 5 minutes; nothing is reported while intelligence sharing is off. Admin only.
- [Web tamper protection](https://www-demo.kuxitong.com/en/docs/api/site-tamper-guards.md): Web tamper protection of one site: protected scopes (home page, pages, directories), what counts as tampering (structure only / any change), serving the baseline page or alerting only, and the observation period; baseline update and diff; part of WAF Enhanced.
- [Web tamper protection page overview](https://www-demo.kuxitong.com/en/docs/api/tamper-guard.md): All protected pages across sites (site, path, scope, baseline time, state, last change) without picking a site first; tenants see their own sites only and may filter by site.
- [Packages](https://www-demo.kuxitong.com/en/docs/api/packages.md): Base packages for sale, defining quotas such as traffic, bandwidth and domains, and prices.
- [Package groups](https://www-demo.kuxitong.com/en/docs/api/package-groups.md): Groups that organize packages so customers can browse and choose.
- [Upgrade packs](https://www-demo.kuxitong.com/en/docs/api/package-upgrades.md): Quotas or features bought per unit on top of a base package.
- [Package catalog](https://www-demo.kuxitong.com/en/docs/api/package-catalog.md): The catalog of packages, groups and upgrade packs a customer can buy.
- [Purchased packages](https://www-demo.kuxitong.com/en/docs/api/user-packages.md): Packages a tenant has bought: purchase, renew, change, add upgrade packs and view usage.
- [Package monitor](https://www-demo.kuxitong.com/en/docs/api/package-monitor.md): Admin only: bandwidth and connections of each purchased package over the last minute.
- [Sites](https://www-demo.kuxitong.com/en/docs/api/sites.md): CDN-accelerated sites. Creating one needs at least a domain and an origin; admins can manage any tenant's sites.
- [Site groups](https://www-demo.kuxitong.com/en/docs/api/site-groups.md): Groups for organizing sites; names are unique within a tenant and a group that still contains sites cannot be deleted.
- [Cache groups](https://www-demo.kuxitong.com/en/docs/api/cache-groups.md): A set of cache rules that many sites can reference; either platform groups or tenant-owned groups.
- [Cache policy](https://www-demo.kuxitong.com/en/docs/api/cache-policy.md): Sets the tenant's default cache group and can reset all sites to follow it.
- [Cache presets](https://www-demo.kuxitong.com/en/docs/api/cache-presets.md): Factory default cache rules, usable as a reference when creating a cache group.
- [Site cache mode](https://www-demo.kuxitong.com/en/docs/api/cache-sites.md): View or set the cache group or custom rules used by one site.
- [Purge and prefetch](https://www-demo.kuxitong.com/en/docs/api/cache-jobs.md): Purge cached URLs or directories, and prefetch given URLs.
- [Purge and prefetch quota](https://www-demo.kuxitong.com/en/docs/api/cache-quota.md): Daily purge and prefetch limits and today's usage.
- [TCP/UDP forwarding](https://www-demo.kuxitong.com/en/docs/api/streams.md): TCP/UDP port forwarding rules. Each rule has listen ports and protocols, an origin list and a balancing method; (protocol, port) is unique platform-wide.
- [Forwarding groups](https://www-demo.kuxitong.com/en/docs/api/stream-groups.md): Groups that organize forwarding rules for bulk management. Group names are unique per tenant, and a group that still has rules cannot be deleted.
- [Tiered origin (L2)](https://www-demo.kuxitong.com/en/docs/api/l2.md): Edges fetch through L2 nodes in their region first, so cached content no longer hits the origin. Paid feature l2; inactive when not licensed.
- [Messages](https://www-demo.kuxitong.com/en/docs/api/messages.md): In-app messages and announcements; admins publish announcements and tenants read and mark them as read.
- [Message subscriptions](https://www-demo.kuxitong.com/en/docs/api/message-subscriptions.md): Choose which notification types to receive.
- [Delivery channels](https://www-demo.kuxitong.com/en/docs/api/message-channels.md): Configure and test the email (SMTP) and SMS delivery channels.
- [Alert webhooks](https://www-demo.kuxitong.com/en/docs/api/message-webhooks.md): DingTalk, Feishu, WeCom, Telegram and generic JSON alert outputs; several can be configured, and addresses and secrets show only the last 4 characters.
- [Reports](https://www-demo.kuxitong.com/en/docs/api/reports.md): Real-time curves, rankings and usage for sites and TCP/UDP forwarding, node monitoring curves and rankings, unconfigured-domain Top, temporary whitelist and access logs; tenants see only their own data.

## Optional

- [Full text for LLMs](https://www-demo.kuxitong.com/llms-full.txt)