bunny.net CDN and Shield

List bunny.net pull zones (CDN sites) with their IDs, origins and hostnames.

One pull zone: hostnames, edge rules as readable one-line summaries (Guid first) and the caching, origin and security settings that matter when debugging. Credentials (ZoneSecurityKey, AWS signing keys, cookie and Authorization trigger values) are left out. For other settings, pass `fields` with the raw names; `detail: true` returns the full raw object (about 10,000 tokens) with the same credentials hidden.

CDN statistics: bandwidth, requests, cache hit rate and, with load_errors, non-2xx responses. Defaults to the last 30 days across all pull zones.

Change pull zone settings and return what changed. Send only the fields to change, using the raw names (e.g. CacheControlMaxAgeOverride, UseStaleWhileOffline); read current values with get_pull_zone and `fields`. `alsoChanged` lists settings Bunny changed that were not requested. Edit edge rules with save_edge_rule, not here.

Purge the CDN cache for one URL (wildcard * allowed at the end), or for a whole pull zone.

Create an edge rule, or update one by including its Guid (from get_pull_zone). Send the whole rule, not only changed fields; to switch a rule on or off use set_edge_rule_enabled. Fields: ActionType, ActionParameter1-3, Triggers [{Type, PatternMatches[], PatternMatchingType, Parameter1}], TriggerMatchingType, Description, Enabled, OrderIndex, ExtraActions [{ActionType, ActionParameter1-3}]. ActionType: 0 Force SSL, 1 Redirect, 2 Origin URL, 3 Override Cache Time, 4 Block Request, 5 Set Response Header, 6 Set Request Header, 7 Force Download, 8 Disable Token Authentication, 9 Enable Token Authentication, 10 Override Cache Time Public, 11 Ignore Query String, 12 Disable Optimizer, 13 Force Compression, 14 Set Status Code, 15 Bypass Perma-Cache, 16 Override Browser Cache Time, 17 Origin Storage, 18 Set Network Rate Limit, 19 Set Connection Limit, 20 Set Requests Per Second Limit, 21 Run Edge Script, 22 Origin Magic Containers, 23 Disable WAF, 24 Retry Origin, 25 Override Browser Cache Response Header, 26 Remove Browser Cache Response Header, 27 Disable Shield Challenge, 28 Disable Shield, 29 Disable Shield Bot Detection, 30 Bypass AWS S3 Authentication, 31 Disable Shield Access Lists, 32 Disable Shield Rate Limiting, 33 Enable Request Coalescing, 34 Disable Request Coalescing, 35 Use Load Balancer, 36 Force Load Balancer Sticky Session Mode, 37 Strip Cookies (Client to Origin). Trigger Type: 0 URL, 1 Request Header, 2 Response Header, 3 URL Extension, 4 Country Code, 5 Remote IP, 6 URL Query String, 7 Random Chance, 8 Status Code, 9 Request Method, 10 Cookie Value, 11 Country State Code, 12 Origin Retry Attempt Count, 13 Origin Connection Error. PatternMatchingType and TriggerMatchingType: 0 Match Any, 1 Match All, 2 Match None. Edge rules change CDN behaviour and log nothing; to block abusive traffic use a WAF rule (save_waf_rule), which can log first and records every match in shield_event_logs.

Switch an edge rule on or off without resending the whole rule.

Bunny's log of failed requests to a pull zone's origin on one day: why each failed (e.g. http_timeout, http_request_failure, dns_lookup, network_socket_exception). Use it to confirm 502 or 504 errors from Bunny's side. Origin responses with an error status, such as a PHP-FPM 502, may not appear here. Returns counts and samples for one page of up to 200 entries. Which part of the day that page covers varies between calls, so check from and to; hasMoreData means other entries exist that this tool does not fetch.

Permanently delete an edge rule. To switch one off but keep it, save it with Enabled: false instead.

WAF (bunny Shield) state for a pull zone: zone settings (wafEnabled, wafExecutionMode, wafDisabledRules, wafLogOnlyRules, learningMode), custom WAF rules, rate limits and bot detection. Read `notes` first: it explains coded settings and warns when settings stop rules from acting.

Requests the WAF blocked, challenged or logged for a pull zone. Only the last 72 hours are available. Use group_by to summarise, e.g. ["ruleId"], ["ja4"] or ["ip"]. Events can take a minute to appear, so wait at least a minute after a change before judging it.

Change WAF settings for a pull zone and return what changed. Fields use the names get_shield_zone returns: wafEnabled, wafExecutionMode (0 Log (no rule blocks, including custom Block rules), 1 Block), learningMode, wafDisabledRules, wafLogOnlyRules, dDoSShieldSensitivity and others. A list in `fields` replaces the whole list; to change part of a list use `add` or `remove`, e.g. add: {"wafDisabledRules": ["942100"]}.

Change bot detection for a pull zone and return what changed. executionMode: 0 LogOnly, 1 Challenge. requestIntegrity, ipAddress and browserFingerprint each take {sensitivity: 0 Off, 1 Low, 2 Medium, 3 High}; browserFingerprint also takes aggression and complexEnabled. Read the current values with get_shield_zone.

Create a custom WAF rule (no rule_id) or update one (with rule_id; send the whole rule). To test a rule, save it with actionType 2 (Log), check shield_event_logs, then save it again with 1 (Block). Returns warnings when zone settings would stop the rule from acting.

Create a rate limit (no rule_id) or update one (with rule_id). Fields: ruleName and ruleDescription (letters, numbers and spaces only) and ruleConfiguration. Copy the ruleConfiguration shape from an existing rate limit in get_shield_zone.

Permanently delete a custom WAF rule or a rate limit by its ID from get_shield_zone. To keep a WAF rule but stop it acting, save it with actionType 2 (Log) instead.