Skip to content
StratumStratum Docs

Update a hosted zone's tunable fields.

PATCH
/v1/projects/{projectId}/dns/zones/{zoneId}
Code sample: Shell / cURL
curl --request PATCH \
  --url https://stratum.example.com/v1/projects/example/dns/zones/example \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "soaRName": "example", "comment": "example", "defaultTtl": 1, "tags": {}, "dnssecEnabled": true }'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
projectId
required
string
/^p-[a-z0-9-]+$/
zoneId
required
string
/^zone-[a-z0-9]+$/

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
soaRName
string
comment
string
defaultTtl
integer
tags
object
key
additional properties
any
dnssecEnabled

Turn DNSSEC signing on or off for this zone.

Enabling is all an operator needs to do: the data plane mints the zone’s KSK and ZSK on its next reload and begins serving signed answers. There is no separate key-generation call.

Disabling stops the zone being signed. The existing keys are left in place rather than destroyed, so re-enabling resumes with the same keys and resolvers that cached the old DNSKEY are not stranded.

boolean

Example generated

{
  "soaRName": "example",
  "comment": "example",
  "defaultTtl": 1,
  "tags": {},
  "dnssecEnabled": true
}

Responses

Section titled “Responses”

200

Section titled “200”

The updated hosted zone.

Media typeapplication/json
object
id
required
string
/^zone-[a-z0-9]+$/
projectId
required
string
region
string
name
required

The logical zone FQDN with a trailing dot.

string
servedFqdn

The on-wire delegated FQDN the zone is served at (...), recorded by the reconciler when it publishes the zone’s delegation. Read-only; empty until the zone becomes active.

string
soaMName
string
soaRName
string
soaSerial
integer format: int64
soaRefresh
integer
soaRetry
integer
soaExpire
integer
soaMinimum
integer
defaultTtl
integer
dnssecEnabled

The DESIRED signing state — what was asked for. Whether the zone is signed and anchored right now is dnssecState.

boolean
dnssecState

The OBSERVED signing state, converged by the reconciler. A pending_ds zone is signed but anchored by nothing, which every validating resolver treats as unsigned. Read-only.

string
Allowed values: insecure pending_ds secure withdrawing
dnssecDsWithdrawnAt

When the zone’s DS was withdrawn from its parent. Set only while withdrawing, during which the zone keeps signing until the DS expires from resolver caches. Read-only.

string format: date-time
visibility
string
Allowed values: public private
vpcId
string
nullable
systemManaged

True for a control-plane-owned zone (e.g. stratum.internal): it is desired state the reconciler keeps present and cannot be deleted through this API (a delete returns 403). Read-only; tenant-created zones are always false.

boolean
generation
integer format: int64
comment
string
nullable
tags
object
key
additional properties
any
state
required
string
createdAt
string format: date-time
updatedAt
string format: date-time
createdBy
string

Example 

{
  "dnssecState": "insecure",
  "visibility": "public"
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

404

Section titled “404”

Resource not found.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}