---
title: "GET /v1/installations/{id}/zones"
method: GET
path: "/v1/installations/{id}/zones"
---

# GET /v1/installations/{id}/zones

`GET /v1/installations/{id}/zones`

## Request

- The document declares no server URL.
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Secure-better-auth.session_token`

The zones on the authorised Cloudflare account, for the founder to choose from.

## Path parameters

- `id` string, required

## Response `200`

The request has succeeded.

- AvailableZones: What the founder authorised, and what they can choose from it. ⛔ **An object rather than a bare array, since 2026-08-26.** The array could not carry the account, and the account is the first thing an onboarding screen has to be able to state: "you connected THIS one". ⚠️ It is also the shape a multi-account picker needs — `zones` refuses a grant covering several accounts today, and the fix for that is more than one of these.
  - `account` ConnectedAccount, required: The Cloudflare account an authorisation actually reached. ⛔ **Returned here because this is the ONLY moment it is knowable.** The installation row does not learn its account until `claimAccount` runs, which is part-way through the install itself — so between authorising and installing, a console has an authorised account it cannot name. The `Installer` resolves this exact account to list the zones at all and used to discard it. ⚠️ **Name AND id, as separate values.** `cloudflareAccountName` on `Installation` held the id for a while, because the code that read it from Cloudflare threw the name away — and a founder with several accounts then could not tell which one they had just handed over. Kept apart so the two cannot silently become the same string.
    - `id` string, required: Cloudflare's id for the account. Globally unique; one relay per account.
    - `name` string, required: What Cloudflare calls it, which is what a founder recognises.
  - `heldElsewhere` boolean, required: Another FounderMail installation already holds this account. ⛔ One account holds one relay, so installing here would be refused before anything is done in the account (P61). Said HERE, on the first screen after Cloudflare, rather than once a domain has been chosen (re-walked live 2026-10-20). Whose installation it is stays unsaid — it may be another organisation's.
  - `boundTo` ConnectedAccount, required: The Cloudflare account an authorisation actually reached. ⛔ **Returned here because this is the ONLY moment it is knowable.** The installation row does not learn its account until `claimAccount` runs, which is part-way through the install itself — so between authorising and installing, a console has an authorised account it cannot name. The `Installer` resolves this exact account to list the zones at all and used to discard it. ⚠️ **Name AND id, as separate values.** `cloudflareAccountName` on `Installation` held the id for a while, because the code that read it from Cloudflare threw the name away — and a founder with several accounts then could not tell which one they had just handed over. Kept apart so the two cannot silently become the same string.
    - `id` string, required: Cloudflare's id for the account. Globally unique; one relay per account.
    - `name` string, required: What Cloudflare calls it, which is what a founder recognises.
  - `zones` AvailableZone[], required
    - `domain` string, required: The zone's name, which is the domain a founder would serve.
    - `status` string, required: Cloudflare's own status for the zone — `active` is the only one that can serve mail.
    - `alreadyServed` boolean, required: Already served by this organisation, so it cannot be chosen again. ⚠️ Reported rather than filtered out. A founder who cannot find the domain they expected needs to be told it is already connected — a list that silently omits it reads as Cloudflare having lost the zone.

## Other responses

- `409`: The request conflicts with the current state of the server.
- `502`: Server error
- `default`: An unexpected error response.

---

[API](https://skmtc.dev/foundermail/apis/org.md) - [All operations](https://skmtc.dev/foundermail/apis/org/llms.txt) - [OpenAPI document](https://skmtc.dev/foundermail/apis/org/revisions/8bbb36e378ab?raw)