# Revert a zone

> Restore the configuration of an earlier version as a new version, and what happens to certificates, clients and node groups.

Reverting restores the configuration saved in an earlier version: the zone's records (with their original ids), edge settings and rules. It never deletes history. It creates a **new** version, the current one plus one, with action `zone.revert` and `restored_from` set to the version you restored. To undo a revert, revert again.

You need the **Tech** role or higher on the zone.

## Revert

**Dashboard**

1. Open the domain and go to **Changes → History**.
2. Find the version you want to go back to and select **Revert**.
3. The dialog explains what will happen and proposes the reason `Revert to version N`; edit it if you like and confirm.
4. If some site would be left without a valid certificate, the dashboard lists them and asks you to confirm again.
**CLI**

```sh
openwaf-cloud ctl zones revert example.com 41 --reason "Undo the WAF level change" --dry-run
openwaf-cloud ctl zones revert example.com 41 --reason "Undo the WAF level change" --wait
```
The CLI simulates the revert, shows the diff from the current version to the restored one and asks for confirmation. `--wait` then waits until every edge node has the new version.
**API**

```sh
curl -sS -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/revert" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "X-Change-Reason: Undo the WAF level change" \
  -H 'If-Match: "44"' \
  -H "Content-Type: application/json" \
  -d '{"to_version": 41, "allow_missing_certs": false}'
```
`If-Match` with the zone's current version is **required** here (`428 if_match_required` without it). Add `?dry_run=1` to get the plan first. The answer has `version` (the new one), `restored_from`, `diff` and `warnings`.
**MCP**

Ask your assistant to revert the zone to a version. It calls `revert_zone` with `to_version`, shows you the plan and applies it only after you confirm.


## Certificates

Certificates are versioned by reference only, so a revert does not restore them: the zone keeps the certificates it has now. In the diff they appear apart, as information.

If a site that exists in the version you restore would be left without a valid certificate, the revert is refused with `409 missing_certs` and the list of hostnames, and nothing is applied. To revert anyway:

- CLI: add `--allow-missing-certs`.
- API and MCP: send `"allow_missing_certs": true`.
- Dashboard: confirm the second prompt.

Those sites fail over HTTPS until a certificate is issued for them.

## What a revert does not restore

- **Certificates**, as above.
- **The DNS mode.** A zone that was moved from external to delegated DNS stays delegated.
- **The zone's status** (pending, active, disabled): it is not configuration.
- **Purged cache content.** A revert never brings back what a purge removed.

Two parts of the configuration need more than the Tech role. If the version you restore was served by other groups of edge nodes, only an OpenWAF operator can restore those assignments; and if the zone belonged to another client, only an organisation-wide credential can move it back. In both cases the API answers `403 forbidden` and nothing is applied.

## Validation

The restored configuration goes through the same validation as any other write, and the configuration of every edge node that serves the zone is built and checked before the change is committed. If the result would not be valid, the revert fails and nothing changes.