List rewrite rules

GET

/domains/{domain}/rules/rewrite/

const url = 'https://api.nsin.cloud/domains/example.com/rules/rewrite/';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.nsin.cloud/domains/example.com/rules/rewrite/ \
  --header 'Authorization: Bearer <token>'

Rewrites the path and/or query string before the request is sent to the origin. The visitor’s URL is unchanged.

Returned in evaluation order. Requires domain.view.

Authorizations

bearerAuth
apiKeyAuth

Parameters

Path Parameters

domain

required

string

The domain name (for example example.com) — not a numeric id.

Example

example.com

Responses

200

Rewrite rules.

application/json

Array

object

integer

domain_id

integer

record_id

Deprecated single-record scope. Prefer record_ids. Absent for zone-wide rules.

integer

record_ids

The proxied DNS records this rule applies to. Empty or absent means zone-wide — every proxied record of the domain.

Array<integer>

type

string

Allowed values: cache drop redirect rewrite waf captcha rate_limit bot_route origin_pool origin_route fingerprint error_page

enabled

boolean

priority

Evaluation order; lower runs first. Defaults to 100.

integer

host_pattern

Optional hostname filter. Empty means the rule is not host-scoped.

string

host_match_type

How host_pattern is matched. The empty string means “no host filter”, and is the only valid value when host_pattern is empty — the two fields are set and cleared together.

string

Allowed values: "" exact wildcard regex

action_mode

enforce — the rule acts (block, redirect, challenge, …).
dry_run — the rule matches and is logged as “would have acted”, but the request reaches the origin unchanged. Use it to test a rule safely.

Not every rule type honours this; cache ignores it.

string

Allowed values: enforce dry_run

created_at

string format: date-time

updated_at

string format: date-time

path_match_type

How path_includes and path_excludes are interpreted.

string

Allowed values: wildcard regex

path_includes

Paths the rule applies to. Defaults to ["/*"] — everything.

Array<string>

path_excludes

Paths carved back out of path_includes.

Array<string>

path_target

The path sent to the origin. With path_match_type: regex you may reference capture groups from path_includes.

string

query_mode

preserve — pass the original query string through.
replace — substitute query_target.
strip — drop the query string entirely.

string

Allowed values: preserve replace strip

query_target

The replacement query string, used when query_mode is replace.

string

Example

[
  {
    "type": "cache",
    "host_match_type": "",
    "action_mode": "enforce",
    "path_match_type": "wildcard",
    "query_mode": "preserve"
  }
]

401

Missing, malformed, revoked or expired API key, or a key whose owning user row is gone. A key whose owning account has merely been deactivated is not this: that is 403 with code: account_suspended, because the credential itself is intact and re-issuing it changes nothing.

application/json

The error shape used by every endpoint. error is always present. code is present only on the failures that have one — do not require it, and do not parse error to recover it.

object

error

required

Human-readable description of what went wrong.

string

code

Stable machine-readable reason. Present on some failures only; the wording of error may change, this will not.

account_suspended — 403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.
domain_disabled — 409, not 403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.
managed_by_reseller — 403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.
invite_email_mismatch — 403 from POST /invites/{token}/accept. The invitation was addressed to a different email; the body also carries invited_email, masked.

A panel session — not an API key — can additionally see session_check_failed on a 503, which means the session could not be verified, not that it is invalid. Retry it; do not discard the token.

string

Examples

invalidKey

{
  "error": "invalid API key"
}

404

No such domain, or you hold no role on it at all.

It no longer means “your role is too low”. The rules endpoints resolve access through the shared domain guard, which answers 403 when the caller can see the domain but lacks rules.edit, and 409 with code: domain_disabled when the domain is switched off and the request is a write. Reading is open to every role, so a GET can only fail here.

application/json

The error shape used by every endpoint. error is always present. code is present only on the failures that have one — do not require it, and do not parse error to recover it.

object

error

required

Human-readable description of what went wrong.

string

code

Stable machine-readable reason. Present on some failures only; the wording of error may change, this will not.

account_suspended — 403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.
domain_disabled — 409, not 403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.
managed_by_reseller — 403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.
invite_email_mismatch — 403 from POST /invites/{token}/accept. The invitation was addressed to a different email; the body also carries invited_email, masked.

string

Examples

notFound

{
  "error": "domain not found"
}

429

The key exceeded its request budget (300 requests per minute by default).

application/json

The error shape used by every endpoint. error is always present. code is present only on the failures that have one — do not require it, and do not parse error to recover it.

object

error

required

Human-readable description of what went wrong.

string

code

Stable machine-readable reason. Present on some failures only; the wording of error may change, this will not.

account_suspended — 403. The account behind the credential has been switched off, by an admin or by its provider. Every authenticated route answers this, so treat it as terminal rather than retrying.
domain_disabled — 409, not 403. You have every right to the operation; the domain is simply switched off and is not being served, so its configuration cannot change. It stays readable, and writes work again once it is enabled.
managed_by_reseller — 403. The account is a reseller’s client and this surface belongs to its provider. See If your account is managed by a reseller.
invite_email_mismatch — 403 from POST /invites/{token}/accept. The invitation was addressed to a different email; the body also carries invited_email, masked.

string

Examples

limited

{
  "error": "rate limit exceeded"
}