---
title: "Change the address or visibility of a site"
method: PUT
path: "/sites/{id}/address"
tags: ["Sites"]
---

# Change the address or visibility of a site

`PUT /sites/{id}/address`

## Request

- Base URL: `https://api.hypamoon.com/api/v1`
- URL: `https://api.hypamoon.com/api/v1/sites/{id}/address`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.hypamoon.com/oauth/authorize`, token URL `https://api.hypamoon.com/oauth/token`, scopes: `sites:write`)

Renames a site (slug) and/or switches it between public and unlisted. After a rename the old address redirects (301) to the new one for 90 days, then stays reserved for this project for 30 more days without redirecting, so nobody can grab it right away; after that it is free again. At most 2 old addresses redirect at a time (a new rename stops the oldest), every redirect goes straight to the current address, and a site that is offline, unlisted or deleted has no redirects. A site's address can change at most 3 times per 30 days, and at most 10 times per project per 30 days: past that the answer is 429 rate_limited with retry_at and a user_message that says when it can change again. A connected domain stays on the site, and public tokens keep working on every redirecting address of the same site. unlisted puts the site on a secret link (url in the response, 26 random characters, no name in it): the readable address and old addresses give 404, pages are sent with noindex and no-referrer. A secret link is not a login: anyone who has it can open the site. For real protection set a password as well (PUT /sites/{id}). A site on a domain cannot be unlisted. Four-eyes approval applies, just as for a deploy.

## Path parameters

- `id` string, uuid, required

## Request body

- object: Change the address of a site, its visibility, or both.
  - `slug` string: The new address: https://<slug>.hypamoon.app, 3 to 40 characters, lowercase letters, digits and hyphens. The old address keeps redirecting (301) to the new one and stays reserved for this project, so nobody else can take it. A connected domain stays on the site.
  - `visibility` 'public' | 'unlisted': public: the site lives at https://<slug>.hypamoon.app. unlisted: the site only lives at a secret link (https://<random>.hypamoon.app, 26 random characters, no name in it), the readable address gives 404, and search engines are told not to index it. A secret link is not a login: anyone who has the link can open the site. For real protection set a password as well.

## Response `200`

The site with its new address.

- object: A static site on hypamoon.app, with its visibility.
  - `id` string, uuid, required: The id of the site. Use it to update or delete the site.
  - `slug` string, required: The first part of the address: https://<slug>.hypamoon.app.
  - `name` string, required: Your name for the site.
  - `url` string, required: Where the site lives: https://<slug>.hypamoon.app, or the secret link when visibility is unlisted.
  - `files` SiteFile[], required: The files of the site, sorted by path, without their content.
    - `path` string, required: The path of the file on the site, like /index.html.
    - `content_type` string, required: The type it is served with, like text/html.
    - `bytes` integer, required: The size of the file in bytes.
    - `updated_at` string, date-time, required: When the file was last written.
  - `created_at` string, date-time, required: When the site was created.
  - `updated_at` string, date-time, required: When the site or its files last changed.
  - `version` string, required: The version that is live now. Changes on every update; every file on the site carries it as its ETag, so you can check that a page shows this version.
  - `password_protected` boolean, required: true when visitors have to enter the site's password first (set with password on POST /sites or PUT /sites/{id}). The password itself is never returned.
  - `test` boolean, required: true for a site of a test project. It is public all the same.
  - `taken_offline` object, nullable, required: null while the site is live. Set when Hypamoon took the site offline because of abuse: visitors get a page that says it is unavailable, the files are kept, and PUT and DELETE return 403 site_offline. To object, the owner replies to the email or writes to hello@hypamoon.com.
    - `at` string, date-time, required: When Hypamoon took the site offline.
    - `reason` string, required: Why, in the words the owner also received by email.
  - `warnings` union[]: Only in the answer of a deploy, and only when there is something to tell: files a deploy without keep_existing removed, and build hints. Warnings never block a deploy.
    - union
      - object
        - `code` 'files_removed', required: A deploy without keep_existing removed files that were on the site.
        - `message` string, required: What happened and what to do if it was not intended.
        - `paths` string[], required: The paths that are gone.
      - object
        - `code` 'build_hint', required: Something on the site looks like it works but does not: a form that saves nowhere, localStorage used as a database, a password checked in JavaScript, a button to # or javascript:, a cart without a checkout, test wording on the live project, or a map from a service that needs a key the site does not have. Advice only: the deploy succeeded.
        - `hint` string, required: Which hint, like form_no_target, local_storage_db or cart_without_checkout.
        - `message` string, required: What does not work, in plain words.
        - `paths` string[], required: The files the hint is about.
        - `next_step` string, required: What to do next, with the tool to use.
  - `visibility` 'public' | 'unlisted', required: public: the site lives at https://<slug>.hypamoon.app. unlisted: url is the secret link (https://<random>.hypamoon.app) and the readable address gives 404.

## Other responses

- `202`: Four-eyes approval is on: the change waits for another owner or builder. Nothing has changed yet.
- `400`: Bad Request: invalid_json.
- `401`: Unauthorized: unauthorized, missing_api_key, invalid_api_key, api_key_revoked, project_deleted.
- `403`: Forbidden: project_not_enabled, key_mode_mismatch, missing_scope, verification_required, site_offline, phone_verification_required.
- `404`: Not Found: not_found.
- `409`: Conflict: slug_taken, conflict.
- `422`: Unprocessable Content: validation_failed, slug_reserved, site_blocked.
- `429`: Too Many Requests: rate_limited, deploy_limit_reached.
- `500`: Internal Server Error: internal_error.
- `503`: Service Unavailable: service_unavailable.

---

[API](https://skmtc.dev/hypamoon/apis/hypamoon-api.md) · [All operations](https://skmtc.dev/hypamoon/apis/hypamoon-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hypamoon/apis/hypamoon-api/revisions/9f0b90004c06?raw)