# Change control

> Every configuration change in OpenWAF is simulated, confirmed against a version, recorded with its reason and author, and can be undone.

OpenWAF treats your zone configuration like code under version control. Whatever you change, from the dashboard, the API, the CLI, the SDKs or an AI assistant over MCP, goes through the same path:

1. **Simulate.** The change is validated and built exactly as it would be applied, then rolled back. You get the diff and the version it would create.
2. **Confirm.** You apply it with the version you saw. If someone changed the zone in between, nothing is applied.
3. **Record.** The change creates a new numbered version of the zone with its author, its reason and a full snapshot, plus an entry in the organisation's audit log.
4. **Propagate.** Every edge node that serves the zone applies the new version; you can watch which ones already have.
5. **Undo.** Reverting to an earlier version creates a new version with that configuration. History is never rewritten.

- [Make and undo a change](https://developers.openwaf.dev/change-control/get-started/): change a setting, read its diff, apply it and revert it in five minutes.
- [Configuration versions](https://developers.openwaf.dev/change-control/versions/): what a version contains, who creates it and what is not versioned.
- [Simulate, then confirm](https://developers.openwaf.dev/change-control/simulate-and-confirm/): dry runs, expected versions and version conflicts.
- [Propagation to the edge](https://developers.openwaf.dev/change-control/propagation/): desired version against the version each edge node applied.
- [Audit log](https://developers.openwaf.dev/change-control/audit-log/): who changed what and when, across the whole organisation.
- [Revert a zone](https://developers.openwaf.dev/change-control/revert-a-zone/): restore an earlier version, and what happens to certificates.
- [Version actions](https://developers.openwaf.dev/change-control/version-actions/): every action that can appear in a zone's history.
- [Errors](https://developers.openwaf.dev/change-control/errors/): the error codes of versioned writes and what to do about them.


## What is versioned

Each zone has its own version counter. A version captures the zone's DNS records, edge settings (WAF, origin, TLS, cache, redirects, rate limiting, AI agents…), edge rules, the groups of edge nodes that serve it and a reference to each of its certificates. Private keys and secrets are never part of a version. See [Configuration versions](https://developers.openwaf.dev/change-control/versions/) for the details.

## Where to find it

| Interface | History and diffs | Propagation | Audit log |
|---|---|---|---|
| Dashboard | Domain → **Changes → History** | Domain → **Changes → Propagation** | **Audit log** in the sidebar |
| CLI | `zones history`, `zones diff`, `zones revert` | `zones propagation`, `--wait` | `audit` |
| API | `GET …/zones/{zone}/versions`, `…/diff`, `POST …/revert` | `GET …/zones/{zone}/propagation` | `GET /v1/orgs/{org}/audit` |
| MCP | `zone_history`, `zone_diff`, `revert_zone` | `zone_propagation` | `audit_log` |

The [CLI](https://developers.openwaf.dev/cli/), the [SDKs](https://developers.openwaf.dev/sdk/), the [API](https://developers.openwaf.dev/api/) and the [MCP server](https://developers.openwaf.dev/mcp/) all call the same API with the same validation, so a change looks the same in the history whichever way it was made.