Client API: Reverse Proxy

User-managed reverse-proxy routes (TLS, upstreams, WAF settings).

Base URL: https://api.coritan.com/api/v1. Paths below are complete.

To try these requests in the browser, open the interactive Client API reference.

GET /api/v1/proxy/routes

List proxy routes owned by the current user.

The list stays slim: what the Proxies list and the website's WAF tab show for a row, so neither reads a route or a certificate per row. That is the origin and whether it speaks TLS, the redirect, the extra origins, the switches, development mode as the edge reads it and the certificate GET /ssl/certificates/{domain}/status would name. Each row also says whether its origins follow its proxied DNS records (origin_follows_dns), whether the cache, Under attack mode and hotlink protection are on, and the HSTS max age (0 is off). Origin protocol, gRPC, outbound PROXY and the other site settings are on create/update and the detail.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/proxy/routes

Create a proxy route for a domain you own. Ownership is verified via domain registration or DNS zone.

The domain must be a full hostname such as app.example.com. It is stored in lowercase without a trailing dot. A name with * in it answers 422, because the edge looks a route up by its exact hostname.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

POST /api/v1/proxy/routes/connect-domain

Connect a user's domain to their container server. Creates or updates a proxy route pointing the domain at the container's IP/port, and optionally provisions an SSL certificate.

Requirements:

• User must own the domain (via registration or DNS zone)
• User must own the server

The domain must be a full hostname. A name with * in it answers 422.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

GET /api/v1/proxy/routes/{route_id}

Get details of a proxy route you own.

Besides the route's own columns, the answer says whether its origins follow its proxied DNS records (origin_follows_dns: a proxied A or AAAA record made it, and the records' addresses are its origins), and holds the site settings PATCH takes, typed: upstream_tls_verify, cache_bypass_cookie (null when none), hsts_max_age (0 sends no HSTS header), hsts_include_subdomains, hsts_preload, under_attack, hotlink_protection and response_headers ({} when none).

Authentication: an access token, sent as Authorization: Bearer <token>.

PATCH /api/v1/proxy/routes/{route_id}

Update a proxy route you own. Send only what changes.

cache_enabled, cache_max_age and cache_bypass_cookie answer 402 when the plan leaves out cache_controls, and only when they would change something.

The site settings answer 422 with the reason when they do not check out: hsts_preload on needs hsts_max_age of at least 31536000 (one year) and hsts_include_subdomains on, judged on the values after the change; cache_bypass_cookie must be a cookie name; and response_headers takes up to 20 headers, refusing a name our network sets (such as Set-Cookie, Strict-Transport-Security or Content-Length), a name sent twice in different case, and a value with a line break.

A web proxy whose origins follow its proxied DNS records (origin_follows_dns) answers 409 origin_follows_dns to a body that changes upstream_host or upstream_backends: change the A or AAAA records at its name instead. Its port, TLS, certificate check and origin protocol stay yours to change, and a new port or TLS setting applies to every one of its origins.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

DELETE /api/v1/proxy/routes/{route_id}

Delete a proxy route you own.

A web proxy whose origins follow its proxied DNS records answers 409 origin_follows_dns: its records would make it again. Turn their proxy status off on the DNS tab, or PUT each record with proxied: false, and the web proxy goes with the last one.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/proxy/routes/{route_id}/cache/purge

Drop copies of this website's files on every edge node.

With no body, or a body without urls, every file goes and the answer says "cleared": "everything". With urls (1 to 30), only those addresses go: each is a path such as /pricing?plan=pro or a full http or https URL on the website's own hostname, and the answer says "cleared": "urls" and lists each path as the edge stores it. An address on another hostname answers 422 naming that hostname.

Each file comes from your origin again on its next request, and the edge caches it again from there. Needs cache_controls under plans v2 (402 without it). 30 purges per website per hour, whatever they clear; the next one answers 429 with Retry-After.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json

POST /api/v1/proxy/routes/{route_id}/certificate

Serve your own certificate on this website instead of a free one.

The key must belong to the certificate, the certificate must cover the website's name, be valid now and come from a certificate authority, and a chain must start with the certificate's issuer. The certificate field may hold the whole chain, as a full-chain file does. Anything else answers 422 with the reason; a key with a passphrase is refused. The key is stored encrypted and never logged or returned.

About 30 days before the certificate expires, a free certificate replaces it, unless a newer one is uploaded first. Needs custom_certificates under plans v2 (402 without it). 10 uploads per website per hour.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

POST /api/v1/proxy/routes/{route_id}/error-page/preview

Render the page visitors would see, for a block that is not saved yet.

error_page: null shows the inherited page instead, so the console can put "with" and "without" side by side.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

GET /api/v1/proxy/routes/{route_id}/redirect-rules

List redirect rules for a route you own.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/proxy/routes/{route_id}/redirect-rules

Create a redirect rule for a route you own.

Refusals: 400 for a match_type other than exact, prefix or regex, a status_code other than 301, 302, 307 or 308, or a regex source that is not a valid regular expression or uses something our network does not support (the message names it).

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

PATCH /api/v1/proxy/routes/{route_id}/redirect-rules/{rule_id}

Update a redirect rule for a route you own; send only what changes.

Refusals: 400 as when you create a rule. A regex source is checked when source_pattern or match_type changes.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

DELETE /api/v1/proxy/routes/{route_id}/redirect-rules/{rule_id}

Delete a redirect rule for a route you own.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/proxy/routes/{route_id}/ssl

Request SSL certificate issuance for a proxy route you own.

Authentication: an access token, sent as Authorization: Bearer <token>.

GET /api/v1/proxy/routes/{route_id}/waf-rules

Your own WAF rules on a website, oldest first, and what the account uses.

managed_rules counts the enabled rules of the managed set the website was created with. account counts the enabled rules of your own on every website and every deployment (a deployment's rule once, however many addresses carry it), which is what the plan counts; limits is the plan's allowance while plans v2 applies to the account, else null (-1 is no limit). per_website holds the caps every plan shares.

Authentication: an access token, sent as Authorization: Bearer <token>.

POST /api/v1/proxy/routes/{route_id}/waf-rules

Add a WAF rule of your own to a website.

field is one of path, query, method, user_agent, referer, cookie, country or ip; operator is is, is_not, contains, not_contains, starts_with or ends_with (a method, a country or an address takes only is and is_not); values holds 1 to 50 plain words, matched without regard to case. For ip each value is an address or a range, such as 203.0.113.7 or 198.51.100.0/24, and is matches a visitor whose address is in any of them. An ip rule needs no waf_country_rules. A rate limit takes requests (1 to 100,000) and period (10, 60, 600 or 3600 seconds) and answers 429 past them.

Refusals: 422 with the reason for a rule that does not check out, or a website that already holds 200 rules of your own (50 rate limits); 400 for values whose condition our network cannot run (the message says why); 402 under plans v2 for a rule added switched on past waf_custom_rules (a rate limit also past waf_rate_limit_rules) or a country rule without waf_country_rules; 429 past 60 rule changes a minute. A rule added with enabled: false needs room in the plan only when it is switched on.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

PATCH /api/v1/proxy/routes/{route_id}/waf-rules/{rule_id}

Change a WAF rule of your own; send only what changes.

Switching a rule on counts like adding one, and a rule that ends up on a country needs waf_country_rules when its condition changes or it is switched on (402). Switching a rule off or changing its description is always allowed. A rule support has rewritten comes back with editable: false and takes only enabled and description. A new condition is refused with 400 as when you add a rule.

Authentication: an access token, sent as Authorization: Bearer <token>.

application/json (required)

DELETE /api/v1/proxy/routes/{route_id}/waf-rules/{rule_id}

Delete a WAF rule of your own. The managed rules cannot be deleted here.

Authentication: an access token, sent as Authorization: Bearer <token>.

GET /api/v1/proxy/traffic

Requests your web proxies served for a domain, by hour and by hostname.

The counts cover every web proxy of yours whose hostname is domain or ends in .domain, over the last hours hours. The range is made of whole UTC hours and ends with the current one, so series always holds hours entries. A domain with no web proxy of yours answers with zeros and empty lists.

A request appears in the counts within about two minutes, so the current hour fills in as it passes. A visitor who is shown a challenge page is not counted.

More than 24 hours needs site_analytics in the account's plan (Pro and above), and answers 402 entitlement_exceeded without it. While account plans do not apply to the account, every domain shows all 30 days. A route_id that is not yours, or not under domain, answers 404.

Authentication: an access token, sent as Authorization: Bearer <token>.

Fields of a 200 response: