Any member or token that can see a zone can read its history.
List the versions
Open the domain and go to Changes → History. Each row shows the version, date, author, change and reason; the current version is marked Current, and a revert shows Restored from vN. Load older versions pages back 50 at a time.
openwaf-cloud ctl zones history example.com
openwaf-cloud ctl zones history example.com --limit 20 --before 120--before V lists only versions older than V. --json prints the API answer as is.
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/versions?limit=20" \
-H "Authorization: Bearer $OPENWAF_TOKEN"Newest first, 50 by default and at most 500 per page. Pass before=<version> to get older ones. The ETag of the answer is the zone's current version.
Ask your assistant for the history of the zone; it calls zone_history.
Read one version
Select Snapshot on a row to see the configuration saved in that version, with its SHA-256 and a Copy JSON button.
openwaf-cloud ctl zones history example.com 42Prints the version's date, actor, action, reason and SHA-256, followed by its snapshot.
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/versions/42" \
-H "Authorization: Bearer $OPENWAF_TOKEN"Compare two versions
Under Compare versions, pick From and To and select Compare. Changes on a row compares that version with the one before it.
openwaf-cloud ctl zones diff example.com 40 42 # from 40 to 42
openwaf-cloud ctl zones diff example.com 40 # from 40 to the current versionEach line is + path: value (added), - path: value (removed) or ~ path: before → after (replaced). Certificate changes are listed apart, as information: their material is not versioned.
curl -sS "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/diff?from=40&to=42" \
-H "Authorization: Bearer $OPENWAF_TOKEN"to defaults to the current version and from to the version before to.
Ask what changed between two versions; the assistant calls zone_diff (by default, the current version against the one before it).
History of a deleted zone
A deleted zone no longer appears in the zone list, but its history is kept and ends with a zone.delete version. Name it by its id:
openwaf-cloud ctl zones history 3f1c2a9e-0000-4000-8000-000000000000
openwaf-cloud ctl zones diff 3f1c2a9e-0000-4000-8000-000000000000 11 12The MCP tool zone_history accepts the id of a deleted zone too.