Replace the ingestion origin allowlist
Replace the location's allowed origins with the supplied list. Requires an agency key (ak_) and ?location_id=; viewer keys get 403 agency_required.
Each entry is normalized to a bare, lowercase hostname: full URLs, host:port, a leading *., and trailing dots are all accepted and reduced to the host. Entries must be valid hostnames with at least one dot (so localhost or a bare label is rejected); up to 50 are allowed. Duplicates are removed. Send an empty array to turn enforcement off.
Enforcement semantics once the list is non-empty:
- Applies only to browser ingestion (
/e). Server-side ingestion (/ingestwith a Bearer key) is never restricted. - A bare domain covers its subdomains:
acme.commatchesacme.comandapp.acme.com, but notnotacme.comoracme.com.evil.com. - Lenient on a missing origin: a request that sends no
OriginorReferer(server calls,sendBeacon, privacy tools) is allowed through. Only a present host that isn't covered is rejected (403 origin not allowedfrom/e). Origin/Refererare spoofable by a non-browser client, so this stops casual snippet reuse, not a determined attacker. To disable a key entirely, deactivate the location.
Changes take effect within about a minute (the edge config cache TTL).
curl -X PUT "https://mythic-analytics.gulp.workers.dev/client/v1/settings/allowed-origins" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer YOUR_API_TOKEN" \
-d '{
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
}'
import requests
import json
url = "https://mythic-analytics.gulp.workers.dev/client/v1/settings/allowed-origins"
headers = {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
}
response = requests.put(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/settings/allowed-origins", {
method: "PUT",
headers: {
"Content-Type": "application/json",
"Authorization": "Bearer YOUR_API_TOKEN"
},
body: JSON.stringify({
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
}`)
req, err := http.NewRequest("PUT", "https://mythic-analytics.gulp.workers.dev/client/v1/settings/allowed-origins", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/settings/allowed-origins')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Put.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
}'
response = http.request(request)
puts response.body
{
"success": true,
"data": {
"allowed_origins": [
"acme.com",
"shop.acme.com"
]
}
}
{
"error": "Bad Request",
"message": "The request contains invalid parameters or malformed data",
"code": 400,
"details": [
{
"field": "email",
"message": "Invalid email format"
}
]
}
{
"error": "Forbidden",
"message": "You don't have permission to access this resource",
"code": 403
}
/allowed-origins
Target server for requests. Edit to use your own host.
Builder/client key as a bearer token. Agency key for read-write (Bearer ak_...) or viewer key for read-only (Bearer sk_...). Scoped keys (mcp_) are accepted too and need settings:read or settings:write. See Using an mcp_ key over HTTP.
Bearer ak_...) or viewer key for read-only (Bearer sk_...). Scoped keys (mcp_) are accepted too and need settings:read or settings:write. See Using an mcp_ key over HTTP.The media type of the request body
Bare hostnames to allow (subdomains included). Empty array turns enforcement off.
Request Preview
Response
Response will appear here after sending the request
Authentication
Bearer token. Builder/client key as a bearer token. Agency key for read-write (Bearer ak_...) or viewer key for read-only (Bearer sk_...). Scoped keys (mcp_) are accepted too and need settings:read or settings:write. See Using an mcp_ key over HTTP.
Body
Bare hostnames to allow (subdomains included). Empty array turns enforcement off.
["acme.com","shop.acme.com"]