> ## Documentation Index > Fetch the complete documentation index at: https://weaverse.io/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Weaverse component configuration uses `settings`. `inspector` is deprecated; never generate it. > Weaverse Hydrogen themes use React Router v7: import from `react-router`, never `react-router-dom` or `@remix-run/*`. > Define component schemas with `createSchema()` from `@weaverse/hydrogen` (React Router themes) or `@weaverse/next` (Next.js themes). > These docs cover @weaverse/hydrogen, @weaverse/react and @weaverse/core 5.x, and @weaverse/next 1.x. Do not use APIs from other major versions. > For live project data (pages, theme settings, translations), use the Weaverse MCP server: https://docs.weaverse.io/developer-tools/weaverse-mcp # Block or unblock a storefront hostname > Sets the block policy for one hostname. This changes edge serving outside Studio: requests attributed to a blocked hostname (by the storefront URL the Hydrogen SDK declares) are refused this project's content. It is containment, not authentication. - `hostname` must be a bare canonical hostname (no scheme, path, port or credentials, at most 253 characters); anything else is refused with 400 rather than reinterpreted. - `confirm` must equal the hostname (lowercase); a missing or different value is a 400. - Desired-state write: `blocked` sets the state, so a replayed request converges instead of toggling. - The change reaches the edge within `propagationSeconds`. - 503 when the policy service is unavailable; nothing changed. Required scope: `project:manage` ## OpenAPI ````yaml https://studio.weaverse.io/api/v1/content/openapi.json post /projects/{projectId}/hostnames openapi: 3.1.0 info: title: Weaverse Content API version: 1.0.0 description: >- Authenticated REST API for querying Weaverse-managed content (projects, pages, theme settings, languages) and for reading and writing per-locale translations. servers: - url: https://studio.weaverse.io/api/v1/content description: Production security: - bearerAuth: [] tags: - name: Projects description: List, read, rename, create, copy and delete projects. - name: Pages description: List, read, create, update and delete the pages of a project. - name: Drafts and publishing description: >- Edit page drafts, then publish, schedule, restore and manage page versions. - name: Global sections description: Read, edit and publish sections shared across pages. - name: Page settings description: Read and edit page-level settings such as SEO metadata. - name: Assignments description: Map Shopify resources and routes to Weaverse pages and templates. - name: Theme settings description: Read and update a project's theme settings. - name: Languages and localization description: List project languages and manage locales, static text and glossary. - name: Translations description: >- Read and write per-locale translations, built for external translation agents. - name: Project structure description: Manage project variants and the project hierarchy. - name: Backups and portability description: Back up, restore, export and import project content. - name: Previews and hostnames description: Create preview links and manage the hostnames a project accepts. - name: Specification description: This OpenAPI document. paths: /projects/{projectId}/hostnames: summary: 'Hostname policy: list registry / set block (project:manage)' description: >- Setting a policy changes edge serving outside Builder: canonical-hostname validated, requires confirm="", and is a desired-state write (replays converge). parameters: - name: projectId in: path required: true schema: type: string post: tags: - Previews and hostnames summary: Block or unblock a storefront hostname description: >- Sets the block policy for one hostname. This changes edge serving outside Studio: requests attributed to a blocked hostname (by the storefront URL the Hydrogen SDK declares) are refused this project's content. It is containment, not authentication. - `hostname` must be a bare canonical hostname (no scheme, path, port or credentials, at most 253 characters); anything else is refused with 400 rather than reinterpreted. - `confirm` must equal the hostname (lowercase); a missing or different value is a 400. - Desired-state write: `blocked` sets the state, so a replayed request converges instead of toggling. - The change reaches the edge within `propagationSeconds`. - 503 when the policy service is unavailable; nothing changed. Required scope: `project:manage` operationId: setHostnamePolicy requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/HostnamePolicy' example: hostname: preview.example.com blocked: true confirm: preview.example.com responses: '200': description: Policy applied (propagationSeconds) content: application/json: schema: type: object example: hostname: preview.example.com blocked: true propagationSeconds: 30 '400': description: Non-canonical hostname or missing confirmation content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: Missing or invalid credentials content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Foreign project or missing scope (INSUFFICIENT_SCOPE) content: application/json: schema: $ref: '#/components/schemas/Error' '404': description: Not found (never discloses other tenants) content: application/json: schema: $ref: '#/components/schemas/Error' '503': description: Policy service unavailable; nothing changed content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: HostnamePolicy: type: object required: - hostname - blocked - confirm properties: hostname: type: string blocked: type: boolean confirm: type: string description: Must equal the hostname Error: type: object required: - object - code - message - status properties: object: type: string enum: - error code: type: string enum: - UNAUTHORIZED - FORBIDDEN - INSUFFICIENT_SCOPE - PROJECT_NOT_FOUND - PAGE_NOT_FOUND - STALE_PAGE - STALE_PROJECT - STALE_TRANSLATION - TRANSLATION_UNIT_NOT_FOUND - SERVICE_UNAVAILABLE - CONFLICT - PRECONDITION_REQUIRED - INVALID_PARAMS - INTERNAL_ERROR message: type: string status: type: integer details: description: >- Optional machine-readable context, for example the clashing handles of a 409 CONFLICT. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: WEAVERSE_API_KEY description: >- Bearer authentication: a shop API key (WEAVERSE_API_KEY), a scoped API key, a delegated MCP OAuth token, or (translation-unit routes only) a project-bound translation agent token. Scopes: content:read — Read projects, pages, theme settings, versions, drafts and translation units. content:write — Save drafts and make non-destructive edits (page items, metadata, SEO, assignments, languages, glossary). Never publishes or deletes. content:publish — Publish drafts, schedule/reschedule/cancel publications, restore versions, publish global sections. content:delete — Delete pages, global sections, languages, static keys, override reverts; required with project:manage for project deletion. project:manage — Create/copy/delete projects, settings, variants, hierarchy, backups, restore-as-new, previews, hostname policy. translations:read — Read translation units only (no general content access). translations:write — Apply translation units only; never mutates page content. A legacy unscoped API key keeps read/write/translation baseline access and every pre-scope endpoint, but never gains publish/delete/project-manage implicitly. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.