Domains

Update a custom domain's proxy settings

Partial update — only the fields you send change; omitted fields are left as-is. The Basic Auth password is write-only and bcrypt-hashed server-side.

patch/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}

Request

  • Base URL: https://krova.cloud/api/v1
  • URL: https://krova.cloud/api/v1/spaces/{spaceId}/cubes/{cubeId}/domains/{mappingId}
  • Auth: API key in header X-API-KEY

Path parameters

spaceIdstring required
cubeIdstring required
mappingIdstring required

Request body

securityHeadersMode'enforced' | 'app_managed'

enforced = proxy sets platform security headers (HSTS, X-Frame-Options, …); app_managed = the app's own headers pass through. Default enforced.

responseHeaderTimeoutSecsinteger

Seconds the app may take to send response headers (streaming unaffected). Default 60.

maxRequestBodyMbinteger nullable

Max request body size (MB). Null = unlimited (default).

originScheme'http' | 'https'

Scheme the edge speaks to the CUBE on the backend hop. http (default) = cleartext. https = the cube terminates TLS itself (a control panel holding its own certificate, or an app listening on HTTPS) and answers plain HTTP with a redirect, so it cannot be reached over cleartext at all. Visitors are on HTTPS either way. The dial port is derived: https on the default port 80 connects on 443; a deliberate custom port is honored exactly. Applied as saved: if the cube does not serve this hostname over HTTPS, requests to the domain fail until you set it back to http.

proxyProtocol'v1' | 'v2' nullable

Send a PROXY protocol header (v1 text or v2 binary) at the start of every connection to the cube, so the app reads the visitor's address from the connection itself, as on a plain VPS. Null (default) = off. The app must accept PROXY protocol on this port, or every request to the domain fails; it is applied as saved. Every domain on the same cube port must use the same setting: a save that would mix them is refused with 409 unless confirmMixedProxyProtocol is true.

confirmMixedProxyProtocolboolean

Accept a save that leaves domains on the same cube port with different proxyProtocol settings (for an app that handles both on one port, or mid-migration). Not stored.

responseCompressionboolean

Edge gzip/zstd compression. Default false (domains behind a CDN are already compressed there).

ipAllowListstring[] nullable

Visitor IP/CIDR allow-list (v4+v6). Non-empty ⇒ only these reach the app. Null/empty = open.

ipDenyListstring[] nullable

Visitor IP/CIDR deny-list (v4+v6) → 403. Null/empty = none.

basicAuthUserstring nullable

HTTP Basic Auth username. Null/empty clears Basic Auth. Setting it requires basicAuthPassword.

basicAuthPasswordstring

Plaintext Basic Auth password — bcrypt-hashed server-side, never stored or returned. Required when setting basicAuthUser.

Response

Settings updated

Changes

No recorded changes to this operation across all 1 revision of this API.