# OpenWAF Docs > Guides, references and the API for the firewall, DNS and AI controls at the OpenWAF edge. Every page is also available as Markdown at index.md. Spanish: https://developers.openwaf.dev/es/llms.txt. Full text in one file: https://developers.openwaf.dev/llms-full.txt. ## Fundamentals https://developers.openwaf.dev/fundamentals/llms.txt - [Fundamentals](https://developers.openwaf.dev/fundamentals/index.md): Start here: create your account, add your first site and learn how OpenWAF organizations, zones, roles and API tokens fit together. - [Create an account](https://developers.openwaf.dev/fundamentals/create-account/index.md): Sign up at dash.openwaf.dev with a one-time email code, Google or GitHub, and create your organization. - [Organizations, members and roles](https://developers.openwaf.dev/fundamentals/organizations-and-roles/index.md): An organization owns domains, members and tokens. Learn the four roles, client scopes and how the effective role of a request is computed. - [Add your first site](https://developers.openwaf.dev/fundamentals/add-site/index.md): Add a domain to OpenWAF, point it at the edge with nameservers or a CNAME, and put its first site behind the WAF with an automatic certificate. - [Proxied and DNS-only records](https://developers.openwaf.dev/fundamentals/proxied-and-dns-only/index.md): Proxied names answer with the OpenWAF edge and go through the WAF; DNS-only records answer exactly as you write them. - [How OpenWAF works](https://developers.openwaf.dev/fundamentals/how-openwaf-works/index.md): The path of a request through OpenWAF, from the nameservers to the edge nodes in Germany and Spain and on to your origin. - [Zones, names and sites](https://developers.openwaf.dev/fundamentals/zones-names-and-sites/index.md): What a zone, a name, a host, a site and an origin are in OpenWAF, and how per-name settings inherit from the zone. - [API tokens](https://developers.openwaf.dev/fundamentals/api-tokens/index.md): API tokens act for the member who creates them, with a role no higher than theirs, an optional domain or client scope and an expiry of 1 to 365 days. - [Agencies and clients](https://developers.openwaf.dev/fundamentals/agencies-and-clients/index.md): Create a client for each end customer, assign their domains, add domains in bulk and give the client's people access to their domains only. - [White-label dashboard](https://developers.openwaf.dev/fundamentals/white-label/index.md): Show your agency's brand in the dashboard, emails and block page, serve the dashboard on your own domain and use your own nameservers. - [Team members](https://developers.openwaf.dev/fundamentals/team-members/index.md): Invite people to your organization with a role and an optional client scope, change their role and remove their access. - [Limits and plans](https://developers.openwaf.dev/fundamentals/limits/index.md): OpenWAF is free during early access. These are the limits that apply to every organization, domain, record, token and sign-in. - [Glossary](https://developers.openwaf.dev/fundamentals/glossary/index.md): Short definitions of the terms used across the OpenWAF dashboard, API, CLI, MCP server and these docs. - [Trust and security](https://developers.openwaf.dev/fundamentals/trust-and-security/index.md): Where OpenWAF runs, how it protects your configuration, the legal documents (terms, DPA, sub-processors) and how to report a vulnerability. ## DNS https://developers.openwaf.dev/dns/llms.txt - [DNS](https://developers.openwaf.dev/dns/index.md): Authoritative DNS on your own nameserver pair, or keep your DNS provider and point sites with a CNAME. Every record change is versioned. - [Delegate a zone to OpenWAF](https://developers.openwaf.dev/dns/delegate-a-zone/index.md): Set your organization's nameserver pair at the registrar so OpenWAF answers for the domain, and follow the delegation until the zone is active. - [Keep your DNS provider (external zones)](https://developers.openwaf.dev/dns/external-zones/index.md): Protect sites without changing nameservers. Verify the domain with a _openwaf TXT record, then point each site to edge.openwaf.dev with a CNAME. - [Delegated and external zones](https://developers.openwaf.dev/dns/dns-modes/index.md): The two DNS modes of a zone, what each one stores and publishes, and the statuses a zone goes through from pending to active. - [Proxied records](https://developers.openwaf.dev/dns/proxied-records/index.md): How OpenWAF answers proxied names with the edge, keeps the origin private and applies the proxy flag to every A, AAAA and CNAME of a name. - [Zone versions](https://developers.openwaf.dev/dns/zone-versions/index.md): Every DNS change creates a new zone version with author, reason and diff. Simulate first, apply against the expected version and roll back. - [Manage DNS records](https://developers.openwaf.dev/dns/manage-records/index.md): Create, edit and delete DNS records from the dashboard, the CLI, the API or an AI assistant, and import or export whole zones. - [Batch changes](https://developers.openwaf.dev/dns/batch-changes/index.md): Create, update and delete up to 500 DNS records of a zone as one versioned, all-or-nothing change with POST records/batch or apply_records_batch. - [Move sites between zones](https://developers.openwaf.dev/dns/move-sites/index.md): Merge a zone that holds a single subdomain into the zone of its domain without changing what the edge serves, and undo the merge if needed. - [Check email records](https://developers.openwaf.dev/dns/email-records/index.md): Check MX, SPF and its DNS lookups, DKIM and DMARC as public resolvers see them, and set up a mail provider's records in one change. - [Custom nameservers](https://developers.openwaf.dev/dns/custom-nameservers/index.md): Give your customers nameservers under your own domain (ns1/ns2.youragency.com) that answer with OpenWAF's DNS servers. - [Record types and validation](https://developers.openwaf.dev/dns/record-types/index.md): The DNS record types OpenWAF supports, the content format of each, TTL limits, names, priorities and the rules for records that share a name. - [Error codes](https://developers.openwaf.dev/dns/error-codes/index.md): The HTTP status and error codes the API returns for zones, records, delegation checks, batches, merges and the email check. - [Delegation not detected](https://developers.openwaf.dev/dns/delegation-not-detected/index.md): Your zone stays pending or inconclusive after changing nameservers. Find what the registry and resolvers see and fix the usual causes. - [Sites not pointing to OpenWAF](https://developers.openwaf.dev/dns/external-hosts-not-pointing/index.md): In an external zone, find out why a site does not reach the edge: the statuses ok, missing, wrong and proxied_elsewhere and how to fix each. ## SSL/TLS https://developers.openwaf.dev/ssl/llms.txt - [SSL/TLS](https://developers.openwaf.dev/ssl/index.md): Automatic HTTPS certificates at the edge, verified encryption to your origin, free origin certificates, mTLS and HSTS. - [Get started with SSL/TLS](https://developers.openwaf.dev/ssl/get-started/index.md): Check that every proxied name has a valid certificate, verify the connection to your origin and turn on HSTS. - [Edge certificates](https://developers.openwaf.dev/ssl/edge-certificates/index.md): How OpenWAF issues and renews a Let's Encrypt certificate for every proxied name, and what Valid, Pending and Failed mean. - [Origin TLS modes](https://developers.openwaf.dev/ssl/origin-tls/index.md): How the edge connects to your origin over HTTP or HTTPS, what Full and Full (strict) verify, and which name it checks. - [OpenWAF Origin CA](https://developers.openwaf.dev/ssl/origin-ca/index.md): Free certificates for your origin servers, trusted by the OpenWAF edge in Full (strict). Generated key or your own CSR, up to 15 years. - [Install an origin certificate](https://developers.openwaf.dev/ssl/install-origin-certificate/index.md): Install an OpenWAF Origin CA certificate on nginx, Caddy, Apache or Traefik so the edge can verify your origin in Full (strict). - [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/index.md): Switch an existing zone or one name from Full to Full (strict) without 526 errors, using the origin status to check first. - [Authenticated origin pulls (mTLS)](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/index.md): Make the edge present a client certificate so your origin accepts only connections that come through OpenWAF. - [HSTS](https://developers.openwaf.dev/ssl/hsts/index.md): Send Strict-Transport-Security from the edge so browsers always use HTTPS for your sites, with subdomains and preload options. - [SSL/TLS settings reference](https://developers.openwaf.dev/ssl/settings/index.md): Every SSL/TLS edge setting with its values and default, the origin certificate limits and the API routes, CLI commands and MCP tools. - [Troubleshooting SSL/TLS](https://developers.openwaf.dev/ssl/troubleshooting/index.md): Fix 525 and 526 errors between the edge and your origin, and edge certificates stuck in Pending or Failed. - [SSL/TLS FAQ](https://developers.openwaf.dev/ssl/faq/index.md): Common questions about edge certificates, Full (strict), the OpenWAF Origin CA and mTLS. ## Rules https://developers.openwaf.dev/rules/llms.txt - [Rules](https://developers.openwaf.dev/rules/index.md): Redirect rules answered at the edge, and per-name settings that give one name of a zone its own WAF, origin, limits or AI policy. - [Create your first redirect](https://developers.openwaf.dev/rules/get-started/index.md): Redirect every request for a retired name to your main domain at the edge, keeping the path and the query string. - [Redirect rules](https://developers.openwaf.dev/rules/redirects/index.md): Answer redirects at the edge by name and path prefix: how rules match, how the destination is built, the order of checks and what they require. - [Per-name settings](https://developers.openwaf.dev/rules/per-name-settings/index.md): Give one name of a zone its own WAF, origin, access gate, rate limits or AI Crawl Control settings while it inherits everything else from the zone. - [Effective configuration](https://developers.openwaf.dev/rules/effective-config/index.md): See the site a name gets at the edge, exactly as the edge nodes receive it: zone settings merged with the name's own, origin, rules and redirects. - [Redirect rule reference](https://developers.openwaf.dev/rules/redirect-reference/index.md): Fields of a redirect rule, their defaults, how they are normalized and the limits that apply. ## WAF https://developers.openwaf.dev/waf/llms.txt - [WAF](https://developers.openwaf.dev/waf/index.md): The OpenWAF web application firewall inspects every request to a proxied name on the edge, with OWASP CRS, OpenWAF rules, shields and rate limits. - [Get started with the WAF](https://developers.openwaf.dev/waf/get-started/index.md): Put a proxied name in log-only mode, review what the WAF would block, fix false positives and then switch to active protection. - [Modes and levels](https://developers.openwaf.dev/waf/modes-and-levels/index.md): The WAF mode decides whether detections block or are only recorded; the level decides how much evidence a request needs before it is blocked. - [How a request is processed](https://developers.openwaf.dev/waf/request-processing/index.md): The order in which the OpenWAF edge applies size limits, the access gate, IP and country rules, feeds, rate limits, AI policy, redirects, the WAF and shields. - [Stack shields](https://developers.openwaf.dev/waf/shields/index.md): Eight targeted protections that run after the WAF rules, for WordPress, SSRF, open redirects, pagination, source maps, GraphQL and prompt injection. - [Threat feeds](https://developers.openwaf.dev/waf/threat-feeds/index.md): OpenWAF blocks addresses listed in curated threat-intelligence feeds of known attackers; the feeds are on by default and can be switched off per zone or name. - [Browser challenge](https://developers.openwaf.dev/waf/browser-challenge/index.md): The proof-of-work page that the edge shows instead of a block when a rule's action is challenge; real browsers solve it automatically in milliseconds. - [WAF exceptions](https://developers.openwaf.dev/waf/waf-exceptions/index.md): Switch off one WAF rule, every WAF rule or one shield on a path when it blocks legitimate traffic, without lowering the level for the whole site. - [IP and country rules](https://developers.openwaf.dev/waf/ip-and-country-rules/index.md): Allow or block single addresses, CIDR ranges and countries at the edge, for a whole zone or only for some of its names. - [Rate limiting](https://developers.openwaf.dev/waf/rate-limiting/index.md): Limit how many requests a path accepts per IP, header, cookie or JSON field, per name or for the whole zone, with block, challenge or log actions. - [Access gate](https://developers.openwaf.dev/waf/access-gate/index.md): Protect an admin path such as /wp-admin with one-time codes sent by email to an allow list, without changing the application. - [Block page](https://developers.openwaf.dev/waf/block-page/index.md): Choose what a blocked visitor sees: an nginx- or Apache-style error, a generic page, OpenWAF's page or your own HTML, and the Server header. - [WAF settings reference](https://developers.openwaf.dev/waf/settings/index.md): Every WAF-related edge setting of a zone or name: values, defaults and how the edge uses them. - [Rule reference](https://developers.openwaf.dev/waf/rule-reference/index.md): Fields of the four edge rule kinds (ip, geo, waf_exception, rate_limit) and of rate limiting rules, with their limits and defaults. - [Edge responses and headers](https://developers.openwaf.dev/waf/responses/index.md): Status codes the OpenWAF edge answers on its own, the bodies it sends, the headers it adds or removes on responses and the headers your origin receives. - [Troubleshooting](https://developers.openwaf.dev/waf/troubleshooting/index.md): What to do when the WAF blocks a legitimate request, a WordPress login, a large upload or a partner, and how to find out which rule did it. ## AI Crawl Control https://developers.openwaf.dev/ai-crawl-control/llms.txt - [AI Crawl Control](https://developers.openwaf.dev/ai-crawl-control/index.md): Classify each request as AI training, AI search, AI assistant, search engine, unverified automation, spoofed or human, and decide what each may do. - [Get started with AI Crawl Control](https://developers.openwaf.dev/ai-crawl-control/get-started/index.md): Turn AI Crawl Control on in log mode, see which crawlers and agents visit your site and what would be blocked, then pick a policy and enforce it. - [Categories](https://developers.openwaf.dev/ai-crawl-control/categories/index.md): The seven request categories and the extra policy keys for unverifiable bots, trap followers, secret probes, robots.txt violations and bursts. - [Bot verification](https://developers.openwaf.dev/ai-crawl-control/verification/index.md): How the edge checks that a crawler is who it claims: published IP ranges, forward-confirmed reverse DNS and Web Bot Auth, and what spoofed means. - [Bot catalog](https://developers.openwaf.dev/ai-crawl-control/bot-catalog/index.md): The catalog of verified AI and search bots the edge checks against: 31 bots from 18 operators, refreshed daily from 20 official sources. - [Set the policy](https://developers.openwaf.dev/ai-crawl-control/policy/index.md): Choose a template, set the action of each category and policy key, override single bots, and switch between log and enforce mode. - [robots.txt and Content-Signal](https://developers.openwaf.dev/ai-crawl-control/robots-txt/index.md): Let the edge prepend a managed section to your robots.txt with Disallow rules for the bots you block and a Content-Signal line with your preferences. - [Trap and tarpit](https://developers.openwaf.dev/ai-crawl-control/trap-and-tarpit/index.md): Insert an invisible canary link that only automated readers follow, and send scrapers into a slow maze of generated pages instead of your origin. - [Markdown for agents](https://developers.openwaf.dev/ai-crawl-control/markdown-for-agents/index.md): Answer requests that prefer text/markdown with a Markdown version of your HTML pages, converted at the edge. - [Protect your AI endpoints](https://developers.openwaf.dev/ai-crawl-control/ai-endpoints/index.md): Inspect requests to your own chat and completion APIs for prompt injection and exfiltration, cap their bodies and limit them per IP or per session. - [Agent readiness](https://developers.openwaf.dev/ai-crawl-control/agent-readiness/index.md): Scan a name of your zone for what AI agents look for, from robots.txt and sitemaps to llms.txt, Markdown, structured data and agent cards, and get a score. - [AI Crawl Control settings reference](https://developers.openwaf.dev/ai-crawl-control/settings/index.md): Every field of the ai_agents edge setting, its default and how a merge patch, a template and per-name settings change it. - [Report views](https://developers.openwaf.dev/ai-crawl-control/report-views/index.md): The AI Crawl Control reports by view, their filters, and where to read them in the dashboard, the CLI, the API and MCP. - [FAQ](https://developers.openwaf.dev/ai-crawl-control/faq/index.md): Common questions about AI Crawl Control: defaults, verification, search engines, robots.txt and what happens to people. ## MCP Shield https://developers.openwaf.dev/mcp-shield/llms.txt - [MCP Shield](https://developers.openwaf.dev/mcp-shield/index.md): MCP Shield checks your MCP server's traffic at the OpenWAF edge: method and tool policy, prompt-injection and credential-leak checks, per-token limits. - [Enable MCP Shield](https://developers.openwaf.dev/mcp-shield/enable/index.md): Protect an MCP endpoint in log mode from the dashboard, the CLI, the API or your AI assistant, read what it would block, then move to enforce. - [What is and isn’t detected](https://developers.openwaf.dev/mcp-shield/detection/index.md): Which text MCP Shield inspects, its prompt-injection detectors and DLP patterns, and what passes without inspection. - [Settings and modes](https://developers.openwaf.dev/mcp-shield/settings/index.md): Every MCP endpoint setting with its default and limits, and how log and enforce combine with off, log and block inspection. - [Errors and events](https://developers.openwaf.dev/mcp-shield/errors-and-events/index.md): Every JSON-RPC error code and HTTP status MCP Shield returns, why, and the event each one leaves. - [FAQ](https://developers.openwaf.dev/mcp-shield/faq/index.md): Short answers about MCP Shield: what it is, how it detects prompt injection, whether it breaks MCP clients and what it does not inspect. ## OpenWAF Egress https://developers.openwaf.dev/egress/llms.txt - [OpenWAF Egress](https://developers.openwaf.dev/egress/index.md): A zero-trust outbound gateway for AI agents that checks every request and injects the provider key, self-hosted or hosted by OpenWAF Cloud. - [Quickstart](https://developers.openwaf.dev/egress/quickstart/index.md): Run the OpenWAF Egress container on loopback, store a provider key in OpenBao and point an OpenAI-compatible SDK at the gateway. - [Get started with hosted egress](https://developers.openwaf.dev/egress/cloud/get-started/index.md): Set a provider key, create an agent and point your SDK at egress.openwaf.dev, the AI egress gateway hosted by OpenWAF Cloud. - [Security model](https://developers.openwaf.dev/egress/security-model/index.md): What OpenWAF Egress protects against, in which order it checks a request, and what it does not protect against. - [Manage agents](https://developers.openwaf.dev/egress/cloud/agents/index.md): Change an egress agent's targets and protection, disable it, rotate its token or delete it, from the dashboard, the API or MCP. - [Targets and provider keys](https://developers.openwaf.dev/egress/cloud/targets-and-keys/index.md): Set, replace or remove the provider key of a target, and add or delete your own HTTPS targets for the hosted egress gateway. - [Blocked requests](https://developers.openwaf.dev/egress/cloud/blocked-requests/index.md): See the calls of your own AI agents that the hosted egress gateway refused, filter them, follow them live, and read them from the API or MCP. - [Configuration reference](https://developers.openwaf.dev/egress/configuration/index.md): Every field of the OpenWAF Egress JSON configuration, with its default and what the gateway does with it. - [Hosted egress reference](https://developers.openwaf.dev/egress/cloud/reference/index.md): Routes, roles, limits, the provider catalog, API errors and gateway answers of the AI egress gateway hosted by OpenWAF Cloud. - [Troubleshooting](https://developers.openwaf.dev/egress/troubleshooting/index.md): Every error the OpenWAF Egress gateway returns (401, 403, 404, 413, 502 and more), what causes it and how to fix it. ## Analytics https://developers.openwaf.dev/analytics/llms.txt - [Analytics](https://developers.openwaf.dev/analytics/index.md): Daily traffic counters, security events you can search and stream live, and Core Web Vitals measured in your visitors' browsers. - [Get started with Analytics](https://developers.openwaf.dev/analytics/get-started/index.md): Read a zone's traffic and security events, then turn on Real User Monitoring to measure Core Web Vitals from real visits. - [Core Web Vitals](https://developers.openwaf.dev/analytics/core-web-vitals/index.md): What LCP, INP, CLS, FCP and TTFB measure, the good and poor thresholds, how the 75th percentile and the assessment work, and the diagnostics. - [RUM privacy](https://developers.openwaf.dev/analytics/rum-privacy/index.md): What Real User Monitoring collects from your visitors, what it never collects or stores, and how long the data is kept. - [Traffic](https://developers.openwaf.dev/analytics/traffic/index.md): Daily counters of a zone at the edge, requests, blocked requests, bytes and DNS queries, from the dashboard, the API or MCP. - [Security events](https://developers.openwaf.dev/analytics/security-events/index.md): Search, filter and stream live every request the edge blocked, challenged or logged, from the dashboard or the API. - [Real User Monitoring](https://developers.openwaf.dev/analytics/real-user-monitoring/index.md): Turn on Core Web Vitals measurement without code changes, choose a sample rate, exclude paths, allow it in your CSP and read the report. - [RUM API reference](https://developers.openwaf.dev/analytics/rum-api/index.md): Routes, parameters and answers of the Real User Monitoring read API, the RUM settings, and the matching CLI and MCP commands. - [Troubleshooting Analytics](https://developers.openwaf.dev/analytics/troubleshooting/index.md): What to check when Real User Monitoring shows no data, pages aren't measured, or traffic and security events are missing. ## Cache https://developers.openwaf.dev/cache/llms.txt - [Cache](https://developers.openwaf.dev/cache/index.md): Store responses on the OpenWAF edge, purge them on every node in about a second and send 103 Early Hints. Off until you turn it on. - [Get started with the cache](https://developers.openwaf.dev/cache/get-started/index.md): Turn the edge cache on for a zone or one name, check a static file goes from MISS to HIT, and add a rule for HTML if you want it. - [Default cache behavior](https://developers.openwaf.dev/cache/default-behavior/index.md): Which requests the edge cache considers, which responses it stores, how long it keeps them and what it never caches. - [Cache keys](https://developers.openwaf.dev/cache/cache-keys/index.md): How the edge decides that two requests share a cached object, how query strings enter the key and which Vary headers it supports. - [Cache status headers](https://developers.openwaf.dev/cache/cache-status/index.md): Read X-Cache-Status, the standard Cache-Status header and Age to see whether the edge served a response from cache and why not. - [Cache tags](https://developers.openwaf.dev/cache/cache-tags/index.md): Label cached responses with the Cache-Tag header from your origin and purge every object with a tag in one call. - [Configure the cache](https://developers.openwaf.dev/cache/configure/index.md): Set the caching level, browser cache TTL, development mode, cache deception armor, stale content and maximum object size. - [Cache rules](https://developers.openwaf.dev/cache/cache-rules/index.md): Bypass the cache or make more requests eligible by path, extension, cookie or query parameter, with edge and browser TTLs per rule. - [Purge the cache](https://developers.openwaf.dev/cache/purge/index.md): Remove cached content by URL, prefix, hostname, Cache-Tag or everything; edge nodes apply it in about a second. Includes CI with a purge-only token. - [103 Early Hints](https://developers.openwaf.dev/cache/early-hints/index.md): Let browsers start loading stylesheets, fonts and the main image while your origin builds the page, with links the edge learns from your HTML. - [Cache settings reference](https://developers.openwaf.dev/cache/settings/index.md): Every cache and Early Hints setting with its default and limits, the purge API and limits, the CLI commands and MCP tools. - [Troubleshooting the cache](https://developers.openwaf.dev/cache/troubleshooting/index.md): Find out why a response isn't cached, why visitors still see old content after a change, and why Early Hints don't appear. ## Change control https://developers.openwaf.dev/change-control/llms.txt - [Change control](https://developers.openwaf.dev/change-control/index.md): Every configuration change in OpenWAF is simulated, confirmed against a version, recorded with its reason and author, and can be undone. - [Make and undo a change](https://developers.openwaf.dev/change-control/get-started/index.md): Add a DNS record, read its diff, apply it, find it in the history and revert it, from the dashboard or the CLI. - [Configuration versions](https://developers.openwaf.dev/change-control/versions/index.md): Every change to a zone creates a numbered version with its author, reason, action and a full snapshot of the configuration. - [Simulate, then confirm](https://developers.openwaf.dev/change-control/simulate-and-confirm/index.md): How dry runs, change reasons and expected versions make every OpenWAF write reviewable and safe against concurrent changes. - [Propagation to the edge](https://developers.openwaf.dev/change-control/propagation/index.md): The desired version of a zone against the version each edge node has applied, the node statuses and how long a change takes. - [Audit log](https://developers.openwaf.dev/change-control/audit-log/index.md): The organisation-wide record of who changed what and when, from the dashboard, the API, the CLI, MCP or OpenWAF itself. - [View history and compare versions](https://developers.openwaf.dev/change-control/view-history/index.md): List a zone's versions, read the snapshot of one of them and see what changed between any two. - [Revert a zone](https://developers.openwaf.dev/change-control/revert-a-zone/index.md): Restore the configuration of an earlier version as a new version, and what happens to certificates, clients and node groups. - [Check propagation](https://developers.openwaf.dev/change-control/check-propagation/index.md): See whether every edge node serving a zone has applied its current version, and wait for a change to propagate. - [Read the audit log](https://developers.openwaf.dev/change-control/read-the-audit-log/index.md): Read and page through your organisation's audit log from the dashboard, the CLI, the API or an AI assistant. - [Version actions](https://developers.openwaf.dev/change-control/version-actions/index.md): Every action that can appear in a zone's version history, who causes it and what it changes. - [Errors](https://developers.openwaf.dev/change-control/errors/index.md): Error codes of versioned writes, simulations and reverts, with the HTTP status, the CLI exit code and what to do. ## CLI https://developers.openwaf.dev/cli/llms.txt - [CLI](https://developers.openwaf.dev/cli/index.md): openwaf-cloud ctl manages zones, DNS records, edge settings, rules and certificates from the command line, with simulation and confirmation on every change. - [Get started with the CLI](https://developers.openwaf.dev/cli/get-started/index.md): Get openwaf-cloud, point it at the OpenWAF API, give it an API token safely and run your first read and your first change. - [Changes: simulation and confirmation](https://developers.openwaf.dev/cli/changes/index.md): How every CLI change is simulated, shown as a diff, confirmed against the zone version and optionally followed to the edge. - [Arguments, output and exit codes](https://developers.openwaf.dev/cli/output-and-exit-codes/index.md): How to name zones and records, pass key=value settings and JSON, read the output with --json, and what each exit code means. - [Environment and global options](https://developers.openwaf.dev/cli/reference/options/index.md): The environment variables and options every openwaf-cloud ctl command understands, and the options of reads and changes. - [zones](https://developers.openwaf.dev/cli/reference/zones/index.md): Every openwaf-cloud ctl zones command: list, show, add, configure edge settings, check delegation, history, diff, revert, propagation, merge and delete. - [records](https://developers.openwaf.dev/cli/reference/records/index.md): openwaf-cloud ctl records commands to list, add, change, delete and import DNS records from a BIND zone file. - [rules](https://developers.openwaf.dev/cli/reference/rules/index.md): openwaf-cloud ctl rules commands to list, add and remove a zone's edge rules: IP, country, WAF exceptions and simple rate limits. - [ratelimit](https://developers.openwaf.dev/cli/reference/ratelimit/index.md): openwaf-cloud ctl ratelimit commands to list, add, change and remove per-path rate limiting rules of a zone or of one name. - [certs](https://developers.openwaf.dev/cli/reference/certs/index.md): openwaf-cloud ctl certs list shows a zone's edge certificates and the certificate status of each proxied site. - [origin-certs and origin-tls](https://developers.openwaf.dev/cli/reference/origin-certs/index.md): Issue, list and revoke OpenWAF Origin CA certificates for your origin servers, check TLS from the edge to each origin and download the CA bundles. - [cache](https://developers.openwaf.dev/cli/reference/cache/index.md): openwaf-cloud ctl cache commands to purge a zone's edge cache by URL, prefix, name, tag or everything, and to see recent purges. - [clients](https://developers.openwaf.dev/cli/reference/clients/index.md): openwaf-cloud ctl clients commands to list, add, change and delete an agency's end clients, and assign zones to them. - [brand](https://developers.openwaf.dev/cli/reference/brand/index.md): openwaf-cloud ctl brand commands to read and change the name, accent colour and support e-mail of your white-label dashboard, e-mails and block page. - [whitelabel](https://developers.openwaf.dev/cli/reference/whitelabel/index.md): openwaf-cloud ctl whitelabel commands to set your own dashboard domain and your own name servers, check them and remove them. - [audit](https://developers.openwaf.dev/cli/reference/audit/index.md): openwaf-cloud ctl audit lists the organisation's audit log, newest first, with paging. - [ai](https://developers.openwaf.dev/cli/reference/ai/index.md): openwaf-cloud ctl ai commands for AI crawler and agent reports, MCP Shield, the AI bot catalog and agent readiness scans. - [rum](https://developers.openwaf.dev/cli/reference/rum/index.md): openwaf-cloud ctl rum report shows the Core Web Vitals your visitors measure, with filters and breakdowns by path, country, device or connection. - [dns](https://developers.openwaf.dev/cli/reference/dns/index.md): openwaf-cloud ctl dns answers shows what OpenWAF's DNS publishes for the proxied names of a delegated zone. ## MCP server https://developers.openwaf.dev/mcp/llms.txt - [MCP server](https://developers.openwaf.dev/mcp/index.md): The OpenWAF Cloud remote MCP server lets an AI assistant manage zones, DNS records, edge settings and rules through the same API, roles and audit log. - [Connect a client](https://developers.openwaf.dev/mcp/connect/index.md): Connect Claude Code, Claude Desktop, claude.ai, Cursor, Codex or any MCP client with OAuth and just the URL, or with an API token. - [Making changes](https://developers.openwaf.dev/mcp/making-changes/index.md): How writes work: simulate, show the diff, confirm with expected_version, handle version_conflict, and find every change in the audit log. - [OAuth and tokens](https://developers.openwaf.dev/mcp/oauth-and-tokens/index.md): What the OAuth consent screen asks, how the connection shows up and is revoked, API token roles and scopes, and the lite profile. - [Tools](https://developers.openwaf.dev/mcp/tools/index.md): Every read and write tool of the OpenWAF MCP server, the role it needs and the REST route behind it. ## SDKs https://developers.openwaf.dev/sdk/llms.txt - [SDKs](https://developers.openwaf.dev/sdk/index.md): Typed TypeScript and Python clients for the OpenWAF API, generated from its OpenAPI contract, one file each, with no dependencies. - [Get started with the SDKs](https://developers.openwaf.dev/sdk/get-started/index.md): Download the TypeScript or Python SDK from the OpenWAF API, configure an API token and list your zones. - [How the SDKs are generated](https://developers.openwaf.dev/sdk/how-the-sdks-are-generated/index.md): The SDKs are generated from the API's OpenAPI contract and served by the API itself, so the file you download always matches the API. - [Authentication and configuration](https://developers.openwaf.dev/sdk/authentication/index.md): Give the SDK client an API token, the API address and the organisation, from the environment or the constructor. - [Writes: reason, simulation and version](https://developers.openwaf.dev/sdk/writes/index.md): How SDK write methods take a change reason, simulate with dryRun and confirm against the zone version with ifMatch. - [Error handling](https://developers.openwaf.dev/sdk/error-handling/index.md): OpenWAFError carries the HTTP status, the API error code, the field and the decoded body; how to handle version conflicts and client-side failures. - [Pagination](https://developers.openwaf.dev/sdk/pagination/index.md): Page through a zone's version history and the audit log with limit and before; most other lists come whole. - [Create a DNS record](https://developers.openwaf.dev/sdk/create-a-record/index.md): Add a proxied DNS record from code with the SDK, simulating it first, reviewing the diff and confirming it against the zone version. - [Purge the cache](https://developers.openwaf.dev/sdk/purge-the-cache/index.md): Purge cached URLs, prefixes, names or tags from the OpenWAF edge after a deployment, from TypeScript or Python. - [TypeScript SDK reference](https://developers.openwaf.dev/sdk/typescript/index.md): The OpenWAF TypeScript client: constructor options, method signatures, per-call options, request, errors and types. - [Python SDK reference](https://developers.openwaf.dev/sdk/python/index.md): The OpenWAF Python client: constructor arguments, method signatures, change options, request, errors and return values. ## API reference https://developers.openwaf.dev/api/llms.txt - [API reference](https://developers.openwaf.dev/api/index.md): Manage zones, DNS records, edge settings, rules, analytics, AI agents and egress through the OpenWAF REST API. - [Authentication](https://developers.openwaf.dev/api/authentication/index.md): Authenticate API requests with owf_ tokens, understand roles and limit a token to one zone, one client or cache purges. - [Errors](https://developers.openwaf.dev/api/errors/index.md): The error format of the OpenWAF API, its HTTP statuses and every stable error code with its meaning. - [Organizations](https://developers.openwaf.dev/api/organizations/index.md): Read and rename your organization, the account that owns zones, members and tokens. - [Members and invitations](https://developers.openwaf.dev/api/members/index.md): List, add and remove the people of your organization, change their roles and manage invitations. - [API tokens](https://developers.openwaf.dev/api/tokens/index.md): Create, list and revoke the owf_ API tokens that authenticate requests to the API, the CLI and the MCP server. - [Clients](https://developers.openwaf.dev/api/clients/index.md): Group zones by the end customers of an agency and limit members and tokens to one client's zones. - [White label](https://developers.openwaf.dev/api/white-label/index.md): Brand the dashboard with your name, colour and logo, serve it on your own domain and use your own name servers. - [Audit log](https://developers.openwaf.dev/api/audit/index.md): Read the audit log of your organization, every change made through the API, the dashboard, the CLI or MCP. - [Zones](https://developers.openwaf.dev/api/zones/index.md): Add, list, check and delete zones (domains), in delegated or external DNS mode, and merge a zone into its parent. - [Configuration versions](https://developers.openwaf.dev/api/versions/index.md): Browse the version history of a zone, compare two versions, revert to an earlier one and follow its propagation to the edge. - [DNS records](https://developers.openwaf.dev/api/dns-records/index.md): List, create, update and delete the DNS records of a zone, in bulk or as one batch, and import existing records. - [Email DNS](https://developers.openwaf.dev/api/email/index.md): Plan the MX, SPF, DKIM and DMARC records for your email providers and check the mail records of a zone. - [Edge settings](https://developers.openwaf.dev/api/edge-settings/index.md): Read and change the edge settings of a zone (WAF, origin, TLS, cache, AI agents…) and the effective configuration of a name. - [Rules](https://developers.openwaf.dev/api/rules/index.md): Add, list and delete the edge rules of a zone, IP and country rules, WAF exceptions and rate limits. - [Cache](https://developers.openwaf.dev/api/cache/index.md): Purge what the edge cached for a zone, everything or by URL, prefix, host or cache tag, and follow recent purges. - [Edge certificates](https://developers.openwaf.dev/api/certificates/index.md): List the TLS certificates of a zone and the certificate status of each proxied site. - [Origin TLS and Origin CA](https://developers.openwaf.dev/api/origin-tls/index.md): Issue and revoke origin certificates of the OpenWAF Origin CA, check origin TLS and download the CA bundles. - [Security events](https://developers.openwaf.dev/api/security-events/index.md): Query the security events of a zone, with filters, summaries, histograms and a live Server-Sent Events stream. - [Usage](https://developers.openwaf.dev/api/usage/index.md): Daily traffic counters of a zone at the edge, requests, blocked requests, bytes and DNS queries. - [Real user monitoring](https://developers.openwaf.dev/api/rum/index.md): Core Web Vitals measured in your visitors' browsers, LCP, INP, CLS, FCP and TTFB, by page, country, device and more. - [AI agents](https://developers.openwaf.dev/api/ai-agents/index.md): How AI crawlers and agents use a zone, by category, bot and operator, plus traps, signals, MCP Shield and the bot catalog. - [Agent readiness](https://developers.openwaf.dev/api/agent-readiness/index.md): Scan how ready a name of the zone is for AI agents, robots.txt rules, sitemap, llms.txt, markdown and structured data. - [Egress](https://developers.openwaf.dev/api/egress/index.md): Manage OpenWAF Egress, the gateway between your AI agents and their providers, with targets, credentials, agents and events. - [Schemas](https://developers.openwaf.dev/api/schemas/index.md): Objects returned and accepted by the OpenWAF API, with their fields, types and allowed values.