Docs / Delivery

CDN pull zones

A pull zone maps an inbound hostname to an origin (or a storage zone) and defines how the OpenResty edge caches and gates that traffic — with per-zone TTL, CORS, ordered edge rules, hotlink signing, and instant purge.

cache + purgehotlink signingedge rulesanalytics

Create a zone

POST /v1/zones zones:write

Map a hostname to an upstream. Supply either origin_url (external origin — SSRF-vetted at creation) or storage_zone_id to back the zone with one of your storage zones. signed:true mints a hotlink signing secret returned once. Defaults: default_ttl_secs 3600, cache_version 1.

curl

curl -X POST https://api.ollanode.com/v1/zones \
  -H "Authorization: Bearer $OLLANODE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "hostname": "cdn.example.com",
    "origin_url": "https://origin.example.com",
    "default_ttl_secs": 86400,
    "cache_bypass": ["/api/"],
    "signed": true,
    "cors": "*"
  }'

201 (secret shown once)

{ "id":"zone_...", "hostname":"cdn.example.com",
  "origin_url":"https://origin.example.com", "default_ttl_secs":86400,
  "cache_version":1, "cache_bypass":["/api/"], "signed":true, "cors":"*",
  "rules":[], "active":true, "token_secret":"vbk_<shown once>" }

Use cases

Front a static-asset origin with edge caching.
Put a cacheable, hotlink-protected hostname in front of a storage zone (storage_zone_id).

List, get, delete

GET /v1/zones zones:read

List zones (paginated).

GET /v1/zones/{id} zones:read

Get the full zone, including its ordered rules and current cache_version (secret omitted).

DELETE /v1/zones/{id} zones:delete

Delete the zone and tell edges to drop it. Agent keys are approval-gated.

Update: caching, CORS & edge rules

PATCH /v1/zones/{id} zones:write

Update any field. cors:"" clears the header; signed:true/false enables/disables signing; rules **replaces** the whole ordered edge-rule set (max 50). Changes re-publish to all edges over NATS.

curl

curl -X PATCH https://api.ollanode.com/v1/zones/zone_abc \
  -H "Authorization: Bearer $OLLANODE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "default_ttl_secs": 3600,
    "cache_bypass": ["/api/", "/live/"],
    "cors": "https://app.example.com",
    "rules": [
      { "prefix":"/downloads/", "action":{"type":"block"} },
      { "prefix":"/old/", "action":{"type":"redirect","status":301,"location":"https://example.com/new/"} },
      { "action":{"type":"set_header","name":"X-Frame-Options","value":"DENY"} }
    ]
  }'

Edge rules are an ordered list of { prefix?, action }. An empty/absent prefix matches all paths. Actions: set_header {name,value}, redirect {status, location}, and block (→ 403). Evaluated in order; the first block/redirect short-circuits.

Hotlink signing

POST /v1/zones/{id}/rotate-token zones:rotate

Mint a fresh per-zone signing secret (invalidating all previously signed URLs). Returned once in token_secret.

curl

curl -X POST https://api.ollanode.com/v1/zones/zone_abc/rotate-token \
  -H "Authorization: Bearer $OLLANODE_API_KEY"

Use cases

Rotate after a leak, or on a schedule.

Signed URLs are computed client-side — no API call. For a protected zone, every edge request must carry ?exp=&token=:

signed-URL scheme

# For a hotlink-protected zone every edge request needs ?exp=&token=
# token = hex(HMAC_SHA256(zone_token_secret, "<request_uri>.<exp>"))
# Missing / expired / mismatched -> 403 at the edge.
GET https://cdn.example.com/video.mp4?exp=1735689600&token=<hex>

Purge

POST /v1/zones/{id}/purge zones:purge

No body / empty paths → full purge (bumps cache_version, instantly invalidating everything). A paths array (each must start with /) → granular purge of those exact paths (no version bump).

curl

# full purge
curl -X POST https://api.ollanode.com/v1/zones/zone_abc/purge \
  -H "Authorization: Bearer $OLLANODE_API_KEY"
# -> { "purged":"all", "cache_version":2 }

# granular
curl -X POST https://api.ollanode.com/v1/zones/zone_abc/purge \
  -H "Authorization: Bearer $OLLANODE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"paths":["/index.html","/assets/app.css"]}'
# -> { "purged": 2 }

Use cases

Bust the whole cache on a deploy.
Invalidate just the paths that changed.

Analytics

GET /v1/zones/{id}/analytics analytics:read

Live per-zone counters scraped from the edge (returns zeros if the edge is unreachable). Note the scope is analytics:read, not zones:read.

curl

curl https://api.ollanode.com/v1/zones/zone_abc/analytics \
  -H "Authorization: Bearer $OLLANODE_API_KEY"

Response

{ "requests":10432, "bytes":5837482910, "hits":9987, "misses":445, "hit_ratio":0.957 }

Use cases

A cache-efficiency widget.
Alert when hit_ratio drops.

The edge tags every response on the zone's hostname with X-Cache-Status: HIT | MISS | …. Config/purge propagate to edges over NATS — eventually-consistent, sub-minute.