Glossary

#A–C

• Apex: the zone's own name (example.com), written @ in records. Also called the root of the domain.
• API token: a secret (owf_…) that lets scripts and integrations call the API as a member, with a role, a scope and an expiry. See API tokens.
• Audit log: the organization's list of every change, with its actor, action and target.
• Client: a sub-account inside an organization for one end customer. Domains, members and tokens can be limited to a client. See Agencies and clients.
• Control plane: the part of OpenWAF that stores your configuration, versions it and publishes it, signed, to the edge.

#D–E

• Delegated zone: a zone whose DNS is served by OpenWAF's nameservers. See Delegated and external zones.
• Delegation check: the periodic check that a delegated zone's nameservers at the registry are exactly the organization's pair.
• DNS only: a record answered exactly as written, without going through the edge.
• Dry run: a simulation of a change. It returns the diff and warnings and applies nothing: ?dry_run=1 in the API, --dry-run in the CLI, confirm: false in MCP tools.
• Edge: the OpenWAF nodes, in Germany and Spain, that terminate TLS, inspect requests and forward allowed ones to the origin.
• Effective configuration: what the edge applies to one name: the zone's settings with the name's own on top, plus the rules that reach it.
• Effective role: the role a request is authorised with. For a token, the lower of the token's role and its member's current role.
• External zone: a zone whose DNS stays at another provider; each site points to OpenWAF with a CNAME (or A/AAAA at the apex). See Keep your DNS provider.

#M–O

• Member: a person with access to an organization, with a role and an optional client scope.
• Name: a host name inside a zone, such as www.example.com. The API also calls it a host.
• Nameserver pair: the two nameservers under ns.openwaf.dev assigned to an organization when it is created, shared by all its delegated zones.
• Organization: the account that owns domains, members, clients, tokens and the brand.
• Origin: the server behind a site, given by the content of its proxied record. The edge forwards allowed requests to it.

#P–S

• Propagation: how far the edge nodes have applied the latest version of a zone. New versions reach all nodes in under a minute.
• Proxied: a record whose name answers with the edge, so its traffic goes through the WAF. Only A, AAAA and CNAME records can be proxied.
• Reason: the text (1–500 characters) that every configuration change must carry, kept in the zone history and the audit log.
• Role: owner, admin, tech or readonly. See Organizations, members and roles.
• Site: a name with proxied records. The edge serves it with its own certificate and rules.

#V–Z

• Version: a numbered snapshot of a zone's configuration, created by each change, with its author, reason and diff. See Zone versions.
• White label: your brand, your dashboard domain and your own nameservers instead of OpenWAF's. See White-label dashboard.
• Zone: one registrable domain and everything below it. The dashboard calls it a domain. See Zones, names and sites.
• Zone status: pending, active, moved or disabled. See Zone status.