Update a host
const url = 'https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/hosts/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15';const options = { method: 'PUT', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"name":"Production","apiToken":"YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request PUT \ --url https://qinto-api.blotout.io/teams/7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9/hosts/3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15 \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "name": "Production", "apiToken": "YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T" }'Replaces a host’s editable fields — its name and its Cloudflare API token — in one call. Send the full desired state, not a diff. A host’s Cloudflare account is fixed when the host is created: to manage a different account, create a separate host for it. The original host can be deleted once no sites reference it.
How it works
The API token alone is optional: omit it (or send an empty string) to keep the stored one. A replacement token is verified against Cloudflare before anything is written — a rejected token fails with invalid_credentials and leaves the stored one unchanged. Any property other than name and apiToken is rejected as invalid_body.
Required permissions
team:writeon the team
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Example
7b8d1a52-6c1e-4b6f-9a30-2f8a54d1c3e9Unique id (UUID) of the team that owns the addressed resources, as shown in the team settings on the Blotout platform.
Unique id (UUID) of the host, as returned by the create and list operations.
Example
3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15Unique id (UUID) of the host, as returned by the create and list operations.
Request Bodyrequired
Section titled “Request Bodyrequired”The host’s full replacement state; only the API token may be omitted.
Full replacement of the host’s editable fields; the API token alone is optional. No other properties are accepted — a host’s Cloudflare account is fixed when it is created.
object
New display name for the host; replaces the current one. At most 80 characters; must be unique within the team.
Example
ProductionReplacement Cloudflare API token. Omit it (or send an empty string) to keep the currently stored token; a non-empty value is verified live against the Cloudflare API before it replaces the stored one.
Example
YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7TResponses
Section titled “Responses”The host was updated; the response echoes its stored representation.
object
A Cloudflare account connected to the team. The API token that authorizes it is write-only and never part of this shape.
object
Server-assigned unique id of the host. Address the host with it in the get, update and delete operations.
Display name of the host, as shown on the Blotout platform.
Id of the Cloudflare account this host manages. It is fixed when the host is created.
Cloudflare zone this host serves customer traffic from. Custom hostnames are created on it, and customers point their CNAME records at <subdomain>.customers.<zoneDomain>. Null until a zone is chosen — set it with the zone operation.
Whether the account participates in Workers for Platforms — it hosts multiple customer workers behind the Qinto dispatcher (for example, an agency account).
When the host was connected to the team, as an ISO 8601 UTC timestamp.
Example
{ "host": { "hostId": "3f2a9c81-5d47-4e0b-8c66-91b2a7f04d15", "name": "Production", "accountId": "023e105f4ecef8ad9ca31a8372d0c353", "zoneDomain": "agency.example.com", "wfp": false, "createdAt": "2026-06-18T00:00:00.000Z" }}invalid_params — A path parameter failed validation (for example a malformed UUID); details pinpoints the offending parameter. invalid_body — The JSON body is unparseable or failed schema validation; details pinpoints the offending fields when the body could be parsed.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Field-level validation errors: a tree keyed by input property, each node carrying an errors array of human-readable messages. Render it to help the caller correct the request.
object
Example
{ "error": "invalid_params", "details": { "errors": [], "properties": { "teamId": { "errors": [ "Invalid UUID" ] } } }}unauthenticated — The Authorization: Bearer token is missing, malformed, or no longer valid. Generate a team API token or obtain a new OAuth access token.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "unauthenticated"}forbidden — The bearer credential lacks the required permission or belongs to another team, or its user lacks the organization role a developer operation needs. Update its policies, use a credential bound to the addressed team, or ask an organization owner for the role; message states the reason when one is known.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "forbidden", "message": "The Cloudflare API token is invalid or expired."}not_found — The addressed resource does not exist within this team; check the id and retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "not_found"}invalid_credentials — The host details failed verification: Cloudflare rejected the account id and API token, the name duplicates an existing host in the team, or (on update) no token is stored to verify with. message states the exact reason.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Human-readable reason for this specific failure, intended for display — do not parse it programmatically.
Example
{ "error": "invalid_credentials", "message": "The Cloudflare API token is invalid or expired."}internal — Unexpected server error. Nothing is guaranteed to have been persisted; idempotent operations are safe to retry.
object
Machine-readable error slug; switch on this value rather than on the HTTP status alone.
Example
{ "error": "internal"}