# Check propagation

> See whether every edge node serving a zone has applied its current version, and wait for a change to propagate.

Propagation compares the zone's desired version with the version each edge node that serves it has applied. The statuses are explained in [Propagation to the edge](https://developers.openwaf.dev/change-control/propagation/#statuses).

## See where each node stands

**Dashboard**

Open the domain and go to **Changes → Propagation**. The page shows the desired version, how many nodes have converged, the slowest node and a table with each node's status, applied and desired versions, lag and last poll. It refreshes every 5 seconds while it is open; **What do the statuses mean?** explains each status.
**CLI**

```sh
openwaf-cloud ctl zones propagation example.com
```
Prints `Versión deseada: N` and one row per node with its status, applied version, pending time, lag and last poll. `--json` prints the API answer.
**API**

```sh
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/propagation" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```
```json
{
  "zone_id": "…",
  "desired_version": 44,
  "nodes": [
    {"node_id": "…", "status": "converged", "applied_version": 44, "pending_since": null,
     "lag_seconds": 41, "last_seen_at": "2026-10-27T10:15:02Z"}
  ]
}
```
The `ETag` of the answer is the desired version.
**MCP**

Ask whether the last change has reached every node; the assistant calls `zone_propagation`.


## Wait for a change

With the CLI, add `--wait` to the change itself. After applying, it polls propagation until every node has confirmed the new version, printing each node as it does:

```sh
openwaf-cloud ctl zones set example.com waf_level=high --reason "Raise WAF level" --yes --wait=180s
```

`--wait` alone waits up to 120 seconds; `--wait=90s` or `--wait=90` sets another limit. Since a node confirms on its next poll, the measured time is about twice the polling interval. If some node has not converged when the time is up, the CLI lists the pending nodes and exits with code 4; the change itself stays applied.

In a script that does not use the CLI, poll the propagation route until every node that is not `revoked` or `retiring` reports `converged`.

## When a node stays behind

- `pending` for up to a minute right after a change is normal.
- `lagging` that persists, or `offline`, is on OpenWAF's side: the other nodes keep serving the new version. If it lasts, write to support@openwaf.dev with the zone and the version.
- `retiring` nodes are leaving the zone and disappear once they apply a configuration without it.