Propagation compares the zone's desired version with the version each edge node that serves it has applied. The statuses are explained in Propagation to the edge.
See where each node stands
Open the domain and go to Changes → Propagation. The page shows the desired version, how many nodes have converged, the slowest node and a table with each node's status, applied and desired versions, lag and last poll. It refreshes every 5 seconds while it is open; What do the statuses mean? explains each status.
openwaf-cloud ctl zones propagation example.comPrints Versión deseada: N and one row per node with its status, applied version, pending time, lag and last poll. --json prints the API answer.
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/propagation" \
-H "Authorization: Bearer $OPENWAF_TOKEN"{
"zone_id": "…",
"desired_version": 44,
"nodes": [
{"node_id": "…", "status": "converged", "applied_version": 44, "pending_since": null,
"lag_seconds": 41, "last_seen_at": "2026-10-27T10:15:02Z"}
]
}The ETag of the answer is the desired version.
Ask whether the last change has reached every node; the assistant calls zone_propagation.
Wait for a change
With the CLI, add --wait to the change itself. After applying, it polls propagation until every node has confirmed the new version, printing each node as it does:
openwaf-cloud ctl zones set example.com waf_level=high --reason "Raise WAF level" --yes --wait=180s--wait alone waits up to 120 seconds; --wait=90s or --wait=90 sets another limit. Since a node confirms on its next poll, the measured time is about twice the polling interval. If some node has not converged when the time is up, the CLI lists the pending nodes and exits with code 4; the change itself stays applied.
In a script that does not use the CLI, poll the propagation route until every node that is not revoked or retiring reports converged.
When a node stays behind
pendingfor up to a minute right after a change is normal.laggingthat persists, oroffline, is on OpenWAF's side: the other nodes keep serving the new version. If it lasts, write to [email protected] with the zone and the version.retiringnodes are leaving the zone and disappear once they apply a configuration without it.