These fields are part of a zone's edge settings (GET/PATCH /v1/orgs/{org}/zones/{zone}/edge). A PATCH changes only the fields you send; nested objects merge field by field and lists are replaced whole. Every field except redirects can also be set for one name under hosts.<name> (see Per-name settings).
| Field | Type | Default | Meaning |
|---|---|---|---|
mode | active, log, off | active | WAF mode. |
waf_level | off, low, medium, high | medium | WAF level. |
stack | generic, wordpress, nextjs, static | generic | Application. |
enable_feed | boolean | true | Block addresses of the threat feeds. |
rate_limit_rpm | integer ≥ 0 | 0 | Basic rate limit per IP and minute; 0 = off. |
rate_rules | list, at most 25 | [] | Rate limiting rules; see fields. |
access_gate | object | off | Access gate: enabled, path, ttl_hours, emails. |
block_page_mode | branded, nginx, apache, generic, custom | branded | Block page. |
block_page_html | string, at most 256 KiB | "" | HTML of the custom block page. |
fake_server_header | string | "" | Value of the Server header; empty = nginx. |
max_body_mb | integer ≥ 0 | 0 | Largest request body in MB; larger requests get 413. 0 = the edge default. |
timeout_ms | integer ≥ 0 | 0 | How long the edge waits for the origin, in milliseconds. 0 = the edge default. |
redirect_allow_hosts | list of hosts | [] | Extra hosts the open redirect shield accepts. |
cors_allow_origins | list of hosts | [] | Sister domains whose reflected CORS origins are kept (see CORS). |
compression | boolean | false | Compress text responses that the origin sends uncompressed (gzip, Brotli). |
redirect_allow_hosts
Each entry is a lower-case host name (partner.example.net), localhost, an IPv4 address or a bracketed IPv6 address ([2001:db8::1]). A host name matches itself and its subdomains; an address matches only itself. Wildcards are not accepted.
cors_allow_origins
Each entry is a lower-case host name, without scheme or port (app.example.net). It matches itself and its subdomains. Duplicates are rejected.
Other edge settings
| Field | Documented in |
|---|---|
origin, hsts | SSL/TLS |
redirects | Redirect rules |
hosts | Per-name settings |
ai_agents | AI Crawl Control settings |
cache, early_hints | Cache |
rum | Analytics |
Validation
An invalid value is rejected with 422 and a message that names the field, for example rate_rules[0].path_prefix: … or hosts.www.example.com.rate_rules[1].hosts: …. Nothing is applied.