# Version actions

> Every action that can appear in a zone's version history, who causes it and what it changes.

The `action` of a zone version says what kind of change created it. The same value is the `action` of its audit log entry.

## Changes you make

| Action | Dashboard label | Created by |
|---|---|---|
| `zone.create` | Domain created | Adding the zone. Always version 1. |
| `zone.edge.update` | Edge settings | Any change to the edge settings: WAF, origin, TLS to the origin, HSTS, cache, Early Hints, redirects, rate limiting rules, real user monitoring, AI agents, and the settings of individual names. |
| `zone.rule.create` | Rule added | Adding an edge rule (IP, country, WAF exception or rate limit). |
| `zone.rule.delete` | Rule deleted | Removing an edge rule. |
| `record.create` | Record added | Adding a DNS record, or a batch or import whose first operation adds one. |
| `record.update` | Record changed | Changing a DNS record, or a batch whose first operation changes one. Turning the proxy on or off for one record also updates the other records of the same name. |
| `record.delete` | Record deleted | Deleting a DNS record, or a batch whose first operation deletes one. |
| `zone.client` | Client changed | Assigning the zone to an end client or removing the assignment. |
| `zone.revert` | Revert | Reverting to an earlier version; `restored_from` names it. |
| `zone.merge` | `zone.merge` | Merging another zone into this one: its names, records and settings move here. |
| `zone.merged` | `zone.merged` | The last version of a zone merged into another; the zone stays read-only. |
| `zone.unmerge` | `zone.unmerge` | Undoing a merge: both zones go back to their versions from before it. |
| `zone.delete` | Domain deleted | Deleting the zone. The last version, with no configuration. |

A batch of record operations, an import or a BIND file creates **one** version whose action is that of its first operation; the audit log has one entry per record.

## Changes made by OpenWAF

| Action | Dashboard label | Actor | Created by |
|---|---|---|---|
| `acme.issued` | `acme.issued` | `system:acme` | A certificate was issued for a site of the zone. |
| `acme.renewed` | `acme.renewed` | `system:acme` | A certificate was renewed. |
| `zone.delete` | Domain deleted | `system:pending-expiry` | A zone that stayed pending and was never delegated was deleted. |
| `zone.delete` | Domain deleted | `system:merge-purge` | A zone merged into another was deleted 14 days after the merge. |
| `zone.delegate` | `zone.delegate` | OpenWAF staff | An external zone moved to delegated DNS. |
| `record.move` | Site moved | OpenWAF staff | A site moved between two of your zones: both get a version. |
| `zone.cert.upload` | Certificate uploaded | OpenWAF staff | A manual certificate was installed. |
| `zone.cert.import` | Certificate imported | OpenWAF staff | A certificate was imported. |
| `zone.cert.delete` | Certificate deleted | OpenWAF staff | A certificate was removed. |
| `cert.source_changed` | Certificate source | OpenWAF staff | A certificate switched between automatic renewal and manual. |
| `edge.pool.assign` | Pool assigned | OpenWAF staff | Another group of edge nodes started serving the zone. |
| `edge.pool.unassign` | Pool removed | OpenWAF staff | A group of edge nodes stopped serving the zone. |
| `org.suspend` | `org.suspend` | OpenWAF staff | The organisation was suspended: every zone gets a version and stops being served. |
| `org.unsuspend` | `org.unsuspend` | OpenWAF staff | The organisation was reactivated. |
| `backfill` | Initial version | `system:backfill` | First version of a zone that existed before version history did. |

Where the dashboard has no label of its own, it shows the action as is.

## Audit-only actions

These appear in the [audit log](https://developers.openwaf.dev/change-control/audit-log/) but never in a zone's history, because they do not change zone configuration. Some common ones:

| Action | What happened |
|---|---|
| `zone.cache.purge` | A cache purge. |
| `zone.origin_cert.issue`, `zone.origin_cert.revoke` | An origin certificate was issued or revoked. |
| `zone.status`, `zone.verified`, `zone.disabled` | The zone's status changed after a delegation or ownership check. |
| `client.create`, `client.update`, `client.delete` | End clients of an agency. |
| `brand.update`, `brand.logo` | The organisation's brand. |
| `whitelabel.domain.set`, `whitelabel.domain.delete`, `whitelabel.ns.set`, `whitelabel.ns.delete` | White-label dashboard domain and name servers. |
| `member.add`, `member.role`, `member.remove`, `invitation.create`, `invitation.accept`, `invitation.delete` | Members and invitations. |
| `token.create`, `token.revoke` | API tokens. |
| `oauth.authorize` | An MCP client was granted access through OAuth. |
| `cert.expiry_warning`, `acme.failed` | Certificate expiry warnings and failed issuance. |