The action of a zone version says what kind of change created it. The same value is the action of its audit log entry.
Changes you make
| Action | Dashboard label | Created by |
|---|---|---|
zone.create | Domain created | Adding the zone. Always version 1. |
zone.edge.update | Edge settings | Any change to the edge settings: WAF, origin, TLS to the origin, HSTS, cache, Early Hints, redirects, rate limiting rules, real user monitoring, AI agents, and the settings of individual names. |
zone.rule.create | Rule added | Adding an edge rule (IP, country, WAF exception or rate limit). |
zone.rule.delete | Rule deleted | Removing an edge rule. |
record.create | Record added | Adding a DNS record, or a batch or import whose first operation adds one. |
record.update | Record changed | Changing a DNS record, or a batch whose first operation changes one. Turning the proxy on or off for one record also updates the other records of the same name. |
record.delete | Record deleted | Deleting a DNS record, or a batch whose first operation deletes one. |
zone.client | Client changed | Assigning the zone to an end client or removing the assignment. |
zone.revert | Revert | Reverting to an earlier version; restored_from names it. |
zone.merge | zone.merge | Merging another zone into this one: its names, records and settings move here. |
zone.merged | zone.merged | The last version of a zone merged into another; the zone stays read-only. |
zone.unmerge | zone.unmerge | Undoing a merge: both zones go back to their versions from before it. |
zone.delete | Domain deleted | Deleting the zone. The last version, with no configuration. |
A batch of record operations, an import or a BIND file creates one version whose action is that of its first operation; the audit log has one entry per record.
Changes made by OpenWAF
| Action | Dashboard label | Actor | Created by |
|---|---|---|---|
acme.issued | acme.issued | system:acme | A certificate was issued for a site of the zone. |
acme.renewed | acme.renewed | system:acme | A certificate was renewed. |
zone.delete | Domain deleted | system:pending-expiry | A zone that stayed pending and was never delegated was deleted. |
zone.delete | Domain deleted | system:merge-purge | A zone merged into another was deleted 14 days after the merge. |
zone.delegate | zone.delegate | OpenWAF staff | An external zone moved to delegated DNS. |
record.move | Site moved | OpenWAF staff | A site moved between two of your zones: both get a version. |
zone.cert.upload | Certificate uploaded | OpenWAF staff | A manual certificate was installed. |
zone.cert.import | Certificate imported | OpenWAF staff | A certificate was imported. |
zone.cert.delete | Certificate deleted | OpenWAF staff | A certificate was removed. |
cert.source_changed | Certificate source | OpenWAF staff | A certificate switched between automatic renewal and manual. |
edge.pool.assign | Pool assigned | OpenWAF staff | Another group of edge nodes started serving the zone. |
edge.pool.unassign | Pool removed | OpenWAF staff | A group of edge nodes stopped serving the zone. |
org.suspend | org.suspend | OpenWAF staff | The organisation was suspended: every zone gets a version and stops being served. |
org.unsuspend | org.unsuspend | OpenWAF staff | The organisation was reactivated. |
backfill | Initial version | system:backfill | First version of a zone that existed before version history did. |
Where the dashboard has no label of its own, it shows the action as is.
Audit-only actions
These appear in the audit log but never in a zone's history, because they do not change zone configuration. Some common ones:
| Action | What happened |
|---|---|
zone.cache.purge | A cache purge. |
zone.origin_cert.issue, zone.origin_cert.revoke | An origin certificate was issued or revoked. |
zone.status, zone.verified, zone.disabled | The zone's status changed after a delegation or ownership check. |
client.create, client.update, client.delete | End clients of an agency. |
brand.update, brand.logo | The organisation's brand. |
whitelabel.domain.set, whitelabel.domain.delete, whitelabel.ns.set, whitelabel.ns.delete | White-label dashboard domain and name servers. |
member.add, member.role, member.remove, invitation.create, invitation.accept, invitation.delete | Members and invitations. |
token.create, token.revoke | API tokens. |
oauth.authorize | An MCP client was granted access through OAuth. |
cert.expiry_warning, acme.failed | Certificate expiry warnings and failed issuance. |