# Domains and the edge

```
list_domains          connected domains, verification state, certificates
add_domain            connect (target: site | api, branch, pair_www, *.example.com)
remove_domain         disconnect
set_domain_redirect   send to another domain / open the site again
move_domain                 move a domain to another project of the organisation with its proof and certificate (no new TXT record)
get_edge              view the firewall and request limits
set_edge              block or allow IPs, requests per minute, scope (all | site | api)
purge_edge_cache      discard responses stored at the edge
get_network           inbound addresses (A records), static outbound IP
set_static_outbound_ip turn the static outbound IP on or off (paid, Pro and above)
```

- After connecting, put the TXT record you get back (_blackwall.<domain>) in DNS to verify it. Then move traffic with the A record.
- A domain with target=api answers data, auth, storage and realtime exactly like <ref>.<zone>.
- `set_domain_redirect` takes a domain or a domain and a path as to (REST: `PUT /v1/projects/<ref>/domains/<domain>/redirect {to, status}`). With a path, the visited path is appended and the query string goes along: with to=example.com/vision, vision.example.com/x?y=1 → example.com/vision/x?y=1, and the home page goes to example.com/vision. The status is 308 (default), 307, 301 or 302. The domain in to must be connected to this project and not itself a redirect.
- Certificates are obtained automatically on the first visit. Upload a certificate you already have with `upload_certificate` (the PEM chain and private key), and go back to automatic issuing with `remove_certificate`. Only owners and admins can do this.
- The edge cache stores only responses a server deployment allows with `Cache-Control: s-maxage=N`.
- The address for an A record is inbound in `get_network`.
- Requests that server deployments, functions' fetch() and database webhooks send out leave by default from **a shared address that is not static and may change without notice.** Do not put it on an allow list. If a payment gateway or database firewall needs an allow list, turn on the static outbound IP, a paid add-on, with `set_static_outbound_ip` (Pro and above; owners, admins and billing members), and register every address in outbound.addresses from `get_network`. Changes to these addresses are announced by email 30 days ahead.

## Firewall rules

Rules collect in a draft and apply once published with `publish_firewall`. Only attack challenge mode applies at once.

```
get_firewall                the draft, the published version, what changes (changes), attack mode, version history
save_firewall_rule          save a rule (groups: groups of conditions, action: deny | challenge | rate_limit ...)
move_firewall_rule          a rule's place (up | down)
set_firewall_rule_enabled   turn a rule on or off
remove_firewall_rule        remove a rule
set_firewall_managed        bots, AI training crawlers, AI search and answer bots, attack patterns (off | log | deny)
publish_firewall            publish the draft as a new version
reset_firewall_draft        throw away unpublished changes
restore_firewall_version    load an earlier version into the draft
set_attack_mode             attack challenge mode (turns itself off after hours)
```

Only owners and admins can change these. Editing rules is not on the Free plan.

## Routing rules, bulk redirects, skew protection

```
get_routing_rules           the versions of the redirect, rewrite and header rules set in the console
save_routing_rules          save and apply rules shaped like blackwall.json as a new version
activate_routing_rules      apply an earlier version; null turns them off
get_bulk_redirects          bulk redirect versions uploaded and the first 100 rows
upload_bulk_redirects       upload a new version as a CSV (10,000 rows, activate)
activate_bulk_redirects     apply one version; null turns them off
purge_edge_cache_item       throw away one path (/blog/*) or one Cache-Tag from the cache
get_skew_protection         skew protection and its maximum age
set_skew_protection         turn skew protection on or off, its maximum age
```

Routing rules apply ahead of each deployment's blackwall.json. Changing them takes owners and admins; purging part of the cache, developers and above.

---

https://end.blackall.ai/docs/domains?lang=en