curl --request POST \
--url https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hostname": "preview.example.com",
"blocked": true,
"confirm": "preview.example.com"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({hostname: 'preview.example.com', blocked: true, confirm: 'preview.example.com'})
};
fetch('https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames"
payload = {
"hostname": "preview.example.com",
"blocked": True,
"confirm": "preview.example.com"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"hostname": "preview.example.com",
"blocked": true,
"propagationSeconds": 30
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}Block or unblock a storefront hostname
Sets the block policy for one hostname. This changes edge serving outside Studio: requests attributed to a blocked hostname (by the storefront URL the Hydrogen SDK declares) are refused this project’s content. It is containment, not authentication.
hostnamemust be a bare canonical hostname (no scheme, path, port or credentials, at most 253 characters); anything else is refused with 400 rather than reinterpreted.confirmmust equal the hostname (lowercase); a missing or different value is a 400.- Desired-state write:
blockedsets the state, so a replayed request converges instead of toggling. - The change reaches the edge within
propagationSeconds. - 503 when the policy service is unavailable; nothing changed.
Required scope: project:manage
curl --request POST \
--url https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"hostname": "preview.example.com",
"blocked": true,
"confirm": "preview.example.com"
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({hostname: 'preview.example.com', blocked: true, confirm: 'preview.example.com'})
};
fetch('https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://studio.weaverse.io/api/v1/content/projects/{projectId}/hostnames"
payload = {
"hostname": "preview.example.com",
"blocked": True,
"confirm": "preview.example.com"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"hostname": "preview.example.com",
"blocked": true,
"propagationSeconds": 30
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}{
"object": "error",
"code": "UNAUTHORIZED",
"message": "<string>",
"status": 123,
"details": "<unknown>"
}Authorizations
Bearer authentication: a shop API key (WEAVERSE_API_KEY), a scoped API key, a delegated MCP OAuth token, or (translation-unit routes only) a project-bound translation agent token. Scopes: content:read — Read projects, pages, theme settings, versions, drafts and translation units. content:write — Save drafts and make non-destructive edits (page items, metadata, SEO, assignments, languages, glossary). Never publishes or deletes. content:publish — Publish drafts, schedule/reschedule/cancel publications, restore versions, publish global sections. content:delete — Delete pages, global sections, languages, static keys, override reverts; required with project:manage for project deletion. project:manage — Create/copy/delete projects, settings, variants, hierarchy, backups, restore-as-new, previews, hostname policy. translations:read — Read translation units only (no general content access). translations:write — Apply translation units only; never mutates page content. A legacy unscoped API key keeps read/write/translation baseline access and every pre-scope endpoint, but never gains publish/delete/project-manage implicitly.
Path Parameters
Body
Response
Policy applied (propagationSeconds)
The response is of type object.
Was this page helpful?