---
title: "Block or unblock a storefront hostname"
method: POST
path: "/projects/{projectId}/hostnames"
tags: ["Previews and hostnames"]
---

# Block or unblock a storefront hostname

`POST /projects/{projectId}/hostnames`

## Request

- Base URL: `https://studio.weaverse.io/api/v1/content`
- URL: `https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames`
- Auth: HTTP bearer

Sets the block policy for one hostname. This changes edge serving outside Studio: requests attributed to a blocked hostname (by the storefront URL the Hydrogen SDK declares) are refused this project's content. It is containment, not authentication.

- `hostname` must be a bare canonical hostname (no scheme, path, port or credentials, at most 253 characters); anything else is refused with 400 rather than reinterpreted.
- `confirm` must equal the hostname (lowercase); a missing or different value is a 400.
- Desired-state write: `blocked` sets the state, so a replayed request converges instead of toggling.
- The change reaches the edge within `propagationSeconds`.
- 503 when the policy service is unavailable; nothing changed.

Required scope: `project:manage`

## Request body

- HostnamePolicy
  - `hostname` string, required
  - `blocked` boolean, required
  - `confirm` string, required: Must equal the hostname

## Response `200`

Policy applied (propagationSeconds)

- object

## Other responses

- `400`: Non-canonical hostname or missing confirmation
- `401`: Missing or invalid credentials
- `403`: Foreign project or missing scope (INSUFFICIENT_SCOPE)
- `404`: Not found (never discloses other tenants)
- `503`: Policy service unavailable; nothing changed

---

[API](https://skmtc.dev/weaverse/apis/weaverse-content-api.md) - [All operations](https://skmtc.dev/weaverse/apis/weaverse-content-api/llms.txt) - [OpenAPI document](https://skmtc.dev/weaverse/apis/weaverse-content-api/revisions/d189794169bb?raw)