OpenWAF treats your zone configuration like code under version control. Whatever you change, from the dashboard, the API, the CLI, the SDKs or an AI assistant over MCP, goes through the same path:
- Simulate. The change is validated and built exactly as it would be applied, then rolled back. You get the diff and the version it would create.
- Confirm. You apply it with the version you saw. If someone changed the zone in between, nothing is applied.
- Record. The change creates a new numbered version of the zone with its author, its reason and a full snapshot, plus an entry in the organisation's audit log.
- Propagate. Every edge node that serves the zone applies the new version; you can watch which ones already have.
- Undo. Reverting to an earlier version creates a new version with that configuration. History is never rewritten.
Make and undo a changechange a setting, read its diff, apply it and revert it in five minutes.Configuration versionswhat a version contains, who creates it and what is not versioned.Simulate, then confirmdry runs, expected versions and version conflicts.Propagation to the edgedesired version against the version each edge node applied.Audit logwho changed what and when, across the whole organisation.Revert a zonerestore an earlier version, and what happens to certificates.Version actionsevery action that can appear in a zone's history.Errorsthe error codes of versioned writes and what to do about them.
What is versioned
Each zone has its own version counter. A version captures the zone's DNS records, edge settings (WAF, origin, TLS, cache, redirects, rate limiting, AI agents…), edge rules, the groups of edge nodes that serve it and a reference to each of its certificates. Private keys and secrets are never part of a version. See Configuration versions for the details.
Where to find it
| Interface | History and diffs | Propagation | Audit log |
|---|---|---|---|
| Dashboard | Domain → Changes → History | Domain → Changes → Propagation | Audit log in the sidebar |
| CLI | zones history, zones diff, zones revert | zones propagation, --wait | audit |
| API | GET …/zones/{zone}/versions, …/diff, POST …/revert | GET …/zones/{zone}/propagation | GET /v1/orgs/{org}/audit |
| MCP | zone_history, zone_diff, revert_zone | zone_propagation | audit_log |
The CLI, the SDKs, the API and the MCP server all call the same API with the same validation, so a change looks the same in the history whichever way it was made.