Create a host
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/hosts';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"name":"Production","accountId":"023e105f4ecef8ad9ca31a8372d0c353","apiToken":"YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T","wfp":true}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/hosts \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "name": "Production", "accountId": "023e105f4ecef8ad9ca31a8372d0c353", "apiToken": "YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T", "wfp": true }'Connects a Cloudflare account to the team as a host. Use it once per Cloudflare account the team should manage domains under; the returned hostId is what subsequent host operations reference.
How it works
The API token is verified against Cloudflare before anything is stored: a token that is inactive or cannot read the account fails with invalid_credentials and creates nothing. Verification does not prove every permission later host operations need. The token is write-only — no read operation returns it. The host also needs a zone: an account with exactly one has it chosen automatically, otherwise zoneRequired lists the candidates and the zone operation records the choice, which adding sites waits on. A wfpSync that reports not pushed can be retried with the sync operation.
Required permissions
domain:writeon all domains, or on the addressed domain when its id is in the route
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Request Bodyrequired
Section titled “Request Bodyrequired”Connection details for the Cloudflare account.
Connection details for the Cloudflare account to register as a host.
object
Display name for the host, shown wherever the Blotout platform lists it. Pick something the team recognizes, e.g. the environment it serves. At most 80 characters; must be unique within the team.
Example
ProductionId of the Cloudflare account to manage. Copy it from the Cloudflare dashboard (Account Home → the account’s overview sidebar).
Example
023e105f4ecef8ad9ca31a8372d0c353Cloudflare API token that authorizes managing the account. It is verified live against the Cloudflare API before anything is stored, and it is write-only: no read operation ever returns it.
Example
YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7TEnable Workers for Platforms for this account when it hosts multiple customer workers behind the Qinto dispatcher (for example, an agency managing several customers). A control token is generated and installed on the account’s dispatcher. Defaults to false.
Example
trueResponses
Section titled “Responses”The host was verified and created; the response echoes its stored representation.
object
A Cloudflare account connected to the team. The API token that authorizes it is write-only and never part of this shape.
object
Server-assigned unique id of the host. Address the host with it in the get, update and delete operations.
Display name of the host, as shown on the Blotout platform.
Id of the Cloudflare account this host manages. It is fixed when the host is created.
Cloudflare zone this host serves customer traffic from. Custom hostnames are created on it, and customers point their CNAME records at <subdomain>.customers.<zoneDomain>. Null until a zone is chosen — set it with the zone operation.
Whether the account participates in Workers for Platforms — it hosts multiple customer workers behind the Qinto dispatcher (for example, an agency account).
When the host was connected to the team, as an ISO 8601 UTC timestamp.
Outcome of pushing the account’s Workers-for-Platforms control-token registry to its dispatcher. Null when WFP was not enabled for the host.
object
Whether the account’s control-token registry reached its dispatcher.
Why provisioning stopped: zone_required means no zone is chosen yet, so nothing was provisioned; custom_hostnames_disabled means the zone’s plan does not include Cloudflare for SaaS; fallback_origin_failed, subdomain_failed, namespace_failed, dispatcher_failed, and route_failed name the account-provisioning step that errored; qinto_url_failed names a step that only runs for Qinto-managed hosting, so it never appears here; dispatcher_missing and push_failed mean the token-registry push itself did not land; bundles_missing means the Blotout platform deployment is missing its released worker bundles; registry_busy means another rewrite of the account’s control-token registry — a token rotation, its cleanup, or another deploy — was running, so the dispatcher deploy stepped aside. Every step is idempotent, so syncing again retries the whole provisioning. configuration_failed requires checking account credentials and hosting settings; shared_dispatcher_missing means EdgeTag removed shared hosting, which Qinto will not recreate. Contact the account operator. Absent when pushed is true.
Zones the host’s Cloudflare account can reach, present only when Qinto could not pick one for you — the account has none, or more than one. Choose one with the zone operation; provisioning finishes then. Null when a zone is already set.
Example
{ "host": { "hostId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15", "name": "Production", "accountId": "023e105f4ecef8ad9ca31a8372d0c353", "zoneDomain": "agency.example.com", "wfp": false, "createdAt": "2026-06-18T00:00:00.000Z" }, "wfpSync": { "pushed": true, "reason": "configuration_failed" }, "zoneRequired": [ "agency.example.com", "agency-eu.example.com" ]}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}invalid_credentials — The host details failed verification: Cloudflare rejected the account id and API token, the name duplicates an existing host in the team, or (on update) no token is stored to verify with. message states the exact reason.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "invalid_credentials", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}