Skip to main content
PATCH
Update zone
Requires the IAM action dns:UpdateZone. See DNS permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

zone_id
string<uuid>
required

DNS Zone ID

Body

application/json

Patches description and tags. The name, visibility and DNSSEC posture are fixed at creation; records are their own sub-resource.

description
string

Omit to preserve the description; send an empty string to clear it.

Example:

"Production DNS"

tags
object

Omit to leave the zone's tags untouched. A present map REPLACES them, so send an empty object to clear them. Tags are policy-relevant — a statement can condition on basalt:ResourceTag/ — so changing them is authorized against both the tags requested and the tags already on the zone.

Example:

Response

The updated zone

zone
object