White label

White label lets an agency show the dashboard and its emails with its own brand, serve the dashboard on its own domain (a CNAME to custom.openwaf.dev) and publish its zones with its own name servers. These routes have no SDK methods yet; the examples use curl.

#Get brand

GET /v1/orgs/{org}/brand

Returns the brand of the organization (name, accent colour, logo and support email). Without a brand of its own, the answer is the OpenWAF brand (org_id null).

Required role: readonly or higher.

#Parameters

#Response

• 200: Returns Brand.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/brand" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
  "name": "example.com",
  "logo_url": "/v1/brand/logo?v=3f9a1c2b7d4e",
  "accent": "#0f766e",
  "support_email": "[email protected]",
  "oauth": false
}

#Set brand

PUT /v1/orgs/{org}/brand

Sets the name, accent colour and support email that the dashboard and its emails show for the organization.

Required role: admin or higher. Organization-wide.

#Parameters

#Request body

Content type application/json. Schema: BrandInput.

#Response

• 200: Returns Brand.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X PUT "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/brand" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "name": "Acme Digital",
    "accent": "#0f766e",
    "support_email": "[email protected]"
  }'

{
  "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
  "name": "example.com",
  "logo_url": "/v1/brand/logo?v=3f9a1c2b7d4e",
  "accent": "#0f766e",
  "support_email": "[email protected]",
  "oauth": false
}

#Get brand logo

GET /v1/orgs/{org}/brand/logo

Returns the logo of the brand as image/svg+xml or image/png.

Required role: readonly or higher.

#Parameters

#Response

• 200: The logo. Body of type image/png.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/brand/logo" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

#Upload brand logo

PUT /v1/orgs/{org}/brand/logo

Uploads the logo as the raw request body, image/svg+xml or image/png, up to 256 KB (PNG up to 4096×4096 pixels). Set the brand with Set brand first.

Required role: admin or higher. Organization-wide.

#Parameters

#Request body

Content type image/png.

At most 262144 characters.

#Response

• 200: Returns Brand.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X PUT "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/brand/logo" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: image/png" \
  --data-binary @logo.png

{
  "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
  "name": "example.com",
  "logo_url": "/v1/brand/logo?v=3f9a1c2b7d4e",
  "accent": "#0f766e",
  "support_email": "[email protected]",
  "oauth": false
}

#Delete brand logo

DELETE /v1/orgs/{org}/brand/logo

Removes the logo of the brand.

Required role: admin or higher. Organization-wide.

#Parameters

#Response

• 200: Returns Brand.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X DELETE "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/brand/logo" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
  "name": "example.com",
  "logo_url": "/v1/brand/logo?v=3f9a1c2b7d4e",
  "accent": "#0f766e",
  "support_email": "[email protected]",
  "oauth": false
}

#Get dashboard domain

GET /v1/orgs/{org}/whitelabel/domain

Returns the organization's own dashboard domain and its status.

Required role: readonly or higher. Organization-wide.

#Parameters

#Response

• 200: Returns WhiteLabelDomain.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/domain" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "host": "www.example.com",
  "status": "pending",
  "detail": "",
  "cname_target": "custom.openwaf.dev",
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}

#Set dashboard domain

PUT /v1/orgs/{org}/whitelabel/domain

Sets the domain on which the dashboard is served with the organization's brand. It starts pending. Create a CNAME record from that name to cname_target (custom.openwaf.dev, DNS only, not proxied) and then call Verify dashboard domain. Changing the domain stops serving the previous one.

Required role: admin or higher. Organization-wide.

#Parameters

#Request body

Content type application/json.

#Response

• 200: Returns WhiteLabelDomain.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X PUT "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/domain" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "host": "panel.acme.example"
  }'

{
  "host": "www.example.com",
  "status": "pending",
  "detail": "",
  "cname_target": "custom.openwaf.dev",
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}

#Delete dashboard domain

DELETE /v1/orgs/{org}/whitelabel/domain

Removes the organization's own dashboard domain; the dashboard stops being served on it.

Required role: admin or higher. Organization-wide.

#Parameters

#Response

• 204: Deleted. No body.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X DELETE "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/domain" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

#Verify dashboard domain

POST /v1/orgs/{org}/whitelabel/domain/verify

Checks the CNAME record of the dashboard domain. When it points to cname_target the domain becomes active and the dashboard is served on it with a certificate; otherwise the status is error and detail says what to fix.

Required role: admin or higher. Organization-wide.

#Parameters

#Response

• 200: Returns WhiteLabelDomain.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X POST "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/domain/verify" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "host": "www.example.com",
  "status": "pending",
  "detail": "",
  "cname_target": "custom.openwaf.dev",
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}

#Get own name servers

GET /v1/orgs/{org}/whitelabel/nameservers

Returns the organization's own name servers, their status, the addresses they must resolve to and the ownership TXT records.

Required role: readonly or higher. Organization-wide.

#Parameters

#Response

• 200: Returns WhiteLabelNameservers.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/nameservers" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "ns": [
    "ns1.example-dns.net",
    "ns2.example-dns.net"
  ],
  "status": "pending",
  "detail": "",
  "required_ips": {
    "v4": [
      "example"
    ],
    "v6": [
      "example"
    ]
  },
  "ownership_txt": [
    {
      "name": "example.com",
      "value": "4f1c2e9a7b3d"
    }
  ],
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}

#Set own name servers

PUT /v1/orgs/{org}/whitelabel/nameservers

Sets two name servers of your own (for example ns1.example.com and ns2.example.com) to publish the organization's delegated zones instead of the assigned pair. They start pending. Before verifying them:

1. Create the TXT records listed in ownership_txt.
2. Make both names resolve exactly to the addresses in required_ips (A and AAAA; add glue records at the registrar when the names are inside your own domain).

Replacing active name servers makes the zones publish the assigned pair again until the new ones are verified.

Required role: admin or higher. Organization-wide.

#Parameters

#Request body

Content type application/json.

#Response

• 200: Returns WhiteLabelNameservers.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X PUT "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/nameservers" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{
    "ns": [
      "ns1.acme.example",
      "ns2.acme.example"
    ]
  }'

{
  "ns": [
    "ns1.example-dns.net",
    "ns2.example-dns.net"
  ],
  "status": "pending",
  "detail": "",
  "required_ips": {
    "v4": [
      "example"
    ],
    "v6": [
      "example"
    ]
  },
  "ownership_txt": [
    {
      "name": "example.com",
      "value": "4f1c2e9a7b3d"
    }
  ],
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}

#Delete own name servers

DELETE /v1/orgs/{org}/whitelabel/nameservers

Removes the organization's own name servers; its delegated zones publish the assigned pair again.

Required role: admin or higher. Organization-wide.

#Parameters

#Response

• 204: Deleted. No body.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X DELETE "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/nameservers" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

#Verify own name servers

POST /v1/orgs/{org}/whitelabel/nameservers/verify

Checks the ownership TXT records and that both names resolve exactly to required_ips. When they do, the name servers become active and every delegated zone of the organization publishes them; otherwise the status is error and detail says what to fix.

Required role: admin or higher. Organization-wide.

#Parameters

#Response

• 200: Returns WhiteLabelNameservers.

#Errors

#Example

No SDK method yet: use the HTTP request.

curl -X POST "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/whitelabel/nameservers/verify" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"

{
  "ns": [
    "ns1.example-dns.net",
    "ns2.example-dns.net"
  ],
  "status": "pending",
  "detail": "",
  "required_ips": {
    "v4": [
      "example"
    ],
    "v6": [
      "example"
    ]
  },
  "ownership_txt": [
    {
      "name": "example.com",
      "value": "4f1c2e9a7b3d"
    }
  ],
  "checked_at": "2026-10-27T09:30:00Z",
  "activated_at": "2026-10-27T09:30:00Z"
}