Reverting restores the configuration saved in an earlier version: the zone's records (with their original ids), edge settings and rules. It never deletes history. It creates a new version, the current one plus one, with action zone.revert and restored_from set to the version you restored. To undo a revert, revert again.
You need the Tech role or higher on the zone.
Revert
- Open the domain and go to Changes → History.
- Find the version you want to go back to and select Revert.
- The dialog explains what will happen and proposes the reason
Revert to version N; edit it if you like and confirm. - If some site would be left without a valid certificate, the dashboard lists them and asks you to confirm again.
openwaf-cloud ctl zones revert example.com 41 --reason "Undo the WAF level change" --dry-run
openwaf-cloud ctl zones revert example.com 41 --reason "Undo the WAF level change" --waitThe CLI simulates the revert, shows the diff from the current version to the restored one and asks for confirmation. --wait then waits until every edge node has the new version.
curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/revert" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: Undo the WAF level change" \
-H 'If-Match: "44"' \
-H "Content-Type: application/json" \
-d '{"to_version": 41, "allow_missing_certs": false}'If-Match with the zone's current version is required here (428 if_match_required without it). Add ?dry_run=1 to get the plan first. The answer has version (the new one), restored_from, diff and warnings.
Ask your assistant to revert the zone to a version. It calls revert_zone with to_version, shows you the plan and applies it only after you confirm.
Certificates
Certificates are versioned by reference only, so a revert does not restore them: the zone keeps the certificates it has now. In the diff they appear apart, as information.
If a site that exists in the version you restore would be left without a valid certificate, the revert is refused with 409 missing_certs and the list of hostnames, and nothing is applied. To revert anyway:
- CLI: add
--allow-missing-certs. - API and MCP: send
"allow_missing_certs": true. - Dashboard: confirm the second prompt.
Those sites fail over HTTPS until a certificate is issued for them.
What a revert does not restore
- Certificates, as above.
- The DNS mode. A zone that was moved from external to delegated DNS stays delegated.
- The zone's status (pending, active, disabled): it is not configuration.
- Purged cache content. A revert never brings back what a purge removed.
Two parts of the configuration need more than the Tech role. If the version you restore was served by other groups of edge nodes, only an OpenWAF operator can restore those assignments; and if the zone belonged to another client, only an organisation-wide credential can move it back. In both cases the API answers 403 forbidden and nothing is applied.
Validation
The restored configuration goes through the same validation as any other write, and the configuration of every edge node that serves the zone is built and checked before the change is committed. If the result would not be valid, the revert fails and nothing changes.