# Glossary

> Short definitions of the terms used across the OpenWAF dashboard, API, CLI, MCP server and these docs.

## A–C

- **Apex**: the zone's own name (`example.com`), written `@` in records. Also called the root of the domain.
- **API token**: a secret (`owf_…`) that lets scripts and integrations call the API as a member, with a role, a scope
  and an expiry. See [API tokens](https://developers.openwaf.dev/fundamentals/api-tokens/).
- **Audit log**: the organization's list of every change, with its actor, action and target.
- **Client**: a sub-account inside an organization for one end customer. Domains, members and tokens can be limited to
  a client. See [Agencies and clients](https://developers.openwaf.dev/fundamentals/agencies-and-clients/).
- **Control plane**: the part of OpenWAF that stores your configuration, versions it and publishes it, signed, to the
  edge.

## D–E

- **Delegated zone**: a zone whose DNS is served by OpenWAF's nameservers. See
  [Delegated and external zones](https://developers.openwaf.dev/dns/dns-modes/).
- **Delegation check**: the periodic check that a delegated zone's nameservers at the registry are exactly the
  organization's pair.
- **DNS only**: a record answered exactly as written, without going through the edge.
- **Dry run**: a simulation of a change. It returns the diff and warnings and applies nothing: `?dry_run=1` in the API,
  `--dry-run` in the CLI, `confirm: false` in MCP tools.
- **Edge**: the OpenWAF nodes, in Germany and Spain, that terminate TLS, inspect requests and forward allowed ones to
  the origin.
- **Effective configuration**: what the edge applies to one name: the zone's settings with the name's own on top, plus
  the rules that reach it.
- **Effective role**: the role a request is authorised with. For a token, the lower of the token's role and its
  member's current role.
- **External zone**: a zone whose DNS stays at another provider; each site points to OpenWAF with a CNAME (or A/AAAA at
  the apex). See [Keep your DNS provider](https://developers.openwaf.dev/dns/external-zones/).

## M–O

- **Member**: a person with access to an organization, with a role and an optional client scope.
- **Name**: a host name inside a zone, such as `www.example.com`. The API also calls it a host.
- **Nameserver pair**: the two nameservers under `ns.openwaf.dev` assigned to an organization when it is created,
  shared by all its delegated zones.
- **Organization**: the account that owns domains, members, clients, tokens and the brand.
- **Origin**: the server behind a site, given by the content of its proxied record. The edge forwards allowed requests
  to it.

## P–S

- **Propagation**: how far the edge nodes have applied the latest version of a zone. New versions reach all nodes in
  under a minute.
- **Proxied**: a record whose name answers with the edge, so its traffic goes through the WAF. Only `A`, `AAAA` and
  `CNAME` records can be proxied.
- **Reason**: the text (1–500 characters) that every configuration change must carry, kept in the zone history and the
  audit log.
- **Role**: `owner`, `admin`, `tech` or `readonly`. See
  [Organizations, members and roles](https://developers.openwaf.dev/fundamentals/organizations-and-roles/).
- **Site**: a name with proxied records. The edge serves it with its own certificate and rules.

## V–Z

- **Version**: a numbered snapshot of a zone's configuration, created by each change, with its author, reason and
  diff. See [Zone versions](https://developers.openwaf.dev/dns/zone-versions/).
- **White label**: your brand, your dashboard domain and your own nameservers instead of OpenWAF's. See
  [White-label dashboard](https://developers.openwaf.dev/fundamentals/white-label/).
- **Zone**: one registrable domain and everything below it. The dashboard calls it a domain. See
  [Zones, names and sites](https://developers.openwaf.dev/fundamentals/zones-names-and-sites/).
- **Zone status**: `pending`, `active`, `moved` or `disabled`. See [Zone status](https://developers.openwaf.dev/dns/dns-modes/#zone-status).