openapi: 3.2.0 info: title: CdnManagementClient AFD Domains API version: '2026-07-01' description: Use these APIs to manage Azure Front Door and CDN resources through the Azure Resource Manager. You must make sure that requests made to these resources are secure. x-typespec-generated: - emitter: '@azure-tools/typespec-autorest' servers: - url: https://management.azure.com security: - azure_auth: - user_impersonation tags: - name: AFDDomains paths: ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/profiles/{profileName}/customDomains : get: operationId: AFDCustomDomains_ListByProfile tags: - AFDDomains description: Lists existing AzureFrontDoor domains. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ responses: '200': description: Azure operation completed successfully. content: application/json: schema: $ref: '#/components/schemas/AFDDomainListResult' default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_ListByProfile: $ref: ./examples/AFDCustomDomains_ListByProfile.json x-ms-pageable: nextLinkName: nextLink summary: AFD custom domains list by profile x-summary-source: derived ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/profiles/{profileName}/customDomains/{customDomainName} : get: operationId: AFDCustomDomains_Get tags: - AFDDomains description: Gets an existing AzureFrontDoor domain with the specified domain name under the specified subscription, resource group and profile. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ - name: customDomainName in: path description: Name of the domain under the profile which is unique globally. required: true schema: type: string responses: '200': description: Azure operation completed successfully. content: application/json: schema: $ref: '#/components/schemas/AFDDomain' default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_Get: $ref: ./examples/AFDCustomDomains_Get.json summary: AFD custom domains get x-summary-source: derived put: operationId: AFDCustomDomains_Create tags: - AFDDomains description: Creates a new domain within the specified profile. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ - name: customDomainName in: path description: Name of the domain under the profile which is unique globally. required: true schema: type: string responses: '200': description: Resource 'AFDDomain' update operation succeeded content: application/json: schema: $ref: '#/components/schemas/AFDDomain' '201': description: Resource 'AFDDomain' create operation succeeded headers: Location: description: The Location header contains the URL where the status of the long running operation can be checked. schema: type: string content: application/json: schema: $ref: '#/components/schemas/AFDDomain' '202': description: The request has been accepted for processing, but processing has not yet completed. headers: Azure-AsyncOperation: description: A link to the status monitor schema: type: string Location: description: The Location header contains the URL where the status of the long running operation can be checked. schema: type: string content: application/json: schema: $ref: '#/components/schemas/AFDDomain' default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_Create: $ref: ./examples/AFDCustomDomains_Create.json x-ms-long-running-operation-options: final-state-via: azure-async-operation final-state-schema: '#/definitions/AFDDomain' x-ms-long-running-operation: true requestBody: content: application/json: schema: $ref: '#/components/schemas/AFDDomain' description: Domain properties required: true summary: AFD custom domains create x-summary-source: derived patch: operationId: AFDCustomDomains_Update tags: - AFDDomains description: Updates an existing domain within a profile. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ - name: customDomainName in: path description: Name of the domain under the profile which is unique globally. required: true schema: type: string responses: '200': description: Azure operation completed successfully. content: application/json: schema: $ref: '#/components/schemas/AFDDomain' '202': description: The request has been accepted for processing, but processing has not yet completed. headers: Azure-AsyncOperation: description: A link to the status monitor schema: type: string Location: description: The Location header contains the URL where the status of the long running operation can be checked. schema: type: string Retry-After: description: The Retry-After header can indicate how long the client should wait before polling the operation status. schema: type: integer format: int32 content: application/json: schema: $ref: '#/components/schemas/AFDDomain' default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_Update: $ref: ./examples/AFDCustomDomains_Update.json x-ms-long-running-operation-options: final-state-via: azure-async-operation final-state-schema: '#/definitions/AFDDomain' x-ms-long-running-operation: true requestBody: content: application/json: schema: $ref: '#/components/schemas/AFDDomainUpdateParameters' description: Domain properties required: true summary: AFD custom domains update x-summary-source: derived delete: operationId: AFDCustomDomains_Delete tags: - AFDDomains description: Deletes an existing AzureFrontDoor domain with the specified domain name under the specified subscription, resource group and profile. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ - name: customDomainName in: path description: Name of the domain under the profile which is unique globally. required: true schema: type: string responses: '200': description: Resource deleted successfully. '202': description: Resource deletion accepted. headers: Azure-AsyncOperation: description: A link to the status monitor schema: type: string Location: description: The Location header contains the URL where the status of the long running operation can be checked. schema: type: string Retry-After: description: The Retry-After header can indicate how long the client should wait before polling the operation status. schema: type: integer format: int32 '204': description: Resource does not exist. default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_Delete: $ref: ./examples/AFDCustomDomains_Delete.json x-ms-long-running-operation-options: final-state-via: azure-async-operation x-ms-long-running-operation: true summary: AFD custom domains delete x-summary-source: derived ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/profiles/{profileName}/customDomains/{customDomainName}/refreshValidationToken : post: operationId: AFDCustomDomains_RefreshValidationToken tags: - AFDDomains description: Updates the domain validation token. parameters: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ApiVersionParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/SubscriptionIdParameter - $ref: ../../../../../../common-types/resource-management/v6/types.json#/parameters/ResourceGroupNameParameter - name: profileName in: path description: Name of the Azure Front Door Standard or Azure Front Door Premium or CDN profile which is unique within the resource group. required: true schema: type: string maxLength: 260 minLength: 1 pattern: ^[a-zA-Z0-9]+(-*[a-zA-Z0-9])*$ - name: customDomainName in: path description: Name of the domain under the profile which is unique globally. required: true schema: type: string responses: '200': description: The request has succeeded. '202': description: Resource operation accepted. headers: Azure-AsyncOperation: description: A link to the status monitor schema: type: string Location: description: The Location header contains the URL where the status of the long running operation can be checked. schema: type: string Retry-After: description: The Retry-After header can indicate how long the client should wait before polling the operation status. schema: type: integer format: int32 default: description: An unexpected error response. content: application/json: schema: $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ErrorResponse x-ms-examples: AFDCustomDomains_Delete: $ref: ./examples/AFDCustomDomains_RefreshValidationToken.json x-ms-long-running-operation-options: final-state-via: azure-async-operation x-ms-long-running-operation: true summary: AFD custom domains refresh validation token x-summary-source: derived components: schemas: AFDDomain: type: object description: Friendly domain name mapping to the endpoint hostname that the customer provides for branding purposes, e.g. www.contoso.com. properties: properties: $ref: '#/components/schemas/AFDDomainProperties' description: The JSON object that contains the properties of the domain to create. x-ms-client-flatten: true allOf: - $ref: ../../../../../../common-types/resource-management/v6/types.json#/definitions/ProxyResource AFDDomainUpdatePropertiesParameters: type: object description: The JSON object that contains the properties of the domain to create. properties: profileName: type: string description: The name of the profile which holds the domain. readOnly: true tlsSettings: $ref: '#/components/schemas/AFDDomainHttpsParameters' description: The configuration specifying how to enable HTTPS for the domain - using AzureFrontDoor managed certificate or user's own certificate. If not specified, enabling ssl uses AzureFrontDoor managed certificate by default. mtlsSettings: $ref: '#/components/schemas/AFDDomainMtlsParameters' description: The configuration specifying how to enable mutual TLS for the domain, including specifying allowed FQDNs and which server certificate(s) to use. azureDnsZone: $ref: '#/components/schemas/ResourceReference' description: Resource reference to the Azure DNS zone preValidatedCustomDomainResourceId: $ref: '#/components/schemas/ResourceReference' description: Resource reference to the Azure resource where custom domain ownership was prevalidated AfdProvisioningState: type: string description: Provisioning status enum: - Succeeded - Failed - Updating - Deleting - Creating x-ms-enum: name: AfdProvisioningState modelAsString: true values: - name: Succeeded value: Succeeded - name: Failed value: Failed - name: Updating value: Updating - name: Deleting value: Deleting - name: Creating value: Creating AfdServerTlsGroupPolicy: type: string description: Server TLS group policy that will be used for Https. Standard and Enhanced are service-managed sets; Custom allows specifying serverTlsGroups explicitly. enum: - Standard - Enhanced - Custom x-ms-enum: name: AfdServerTlsGroupPolicy modelAsString: true values: - name: Standard value: Standard description: Uses the standard service-managed set of server TLS groups. - name: Enhanced value: Enhanced description: Uses the enhanced service-managed set of server TLS groups. - name: Custom value: Custom description: Uses the server TLS groups specified by serverTlsGroups. AFDDomainUpdateParameters: type: object description: The domain JSON object required for domain creation or update. properties: properties: $ref: '#/components/schemas/AFDDomainUpdatePropertiesParameters' description: The JSON object that contains the properties of the domain to create. x-ms-client-flatten: true AFDDomainHttpsParameters: type: object description: The JSON object that contains the properties to secure a domain. properties: certificateType: $ref: '#/components/schemas/AfdCertificateType' description: Defines the source of the SSL certificate. cipherSuiteSetType: $ref: '#/components/schemas/AfdCipherSuiteSetType' description: cipher suite set type that will be used for Https minimumTlsVersion: $ref: '#/components/schemas/AfdMinimumTlsVersion' description: TLS protocol version that will be used for Https when cipherSuiteSetType is Customized. customizedCipherSuiteSet: $ref: '#/components/schemas/AFDDomainHttpsCustomizedCipherSuiteSet' description: Customized cipher suites object that will be used for Https when cipherSuiteSetType is Customized. serverTlsGroupPolicy: $ref: '#/components/schemas/AfdServerTlsGroupPolicy' description: Server TLS group policy that will be used for Https. serverTlsGroups: type: array description: Server TLS groups that will be used for Https when serverTlsGroupPolicy is Custom. items: $ref: '#/components/schemas/AfdServerTlsGroup' secret: $ref: '#/components/schemas/ResourceReference' description: Resource reference to the secret. ie. subs/rg/profile/secret required: - certificateType AfdCustomizedCipherSuiteForTls13: type: string enum: - TLS_AES_128_GCM_SHA256 - TLS_AES_256_GCM_SHA384 x-ms-enum: name: AfdCustomizedCipherSuiteForTls13 modelAsString: true values: - name: TLS_AES_128_GCM_SHA256 value: TLS_AES_128_GCM_SHA256 - name: TLS_AES_256_GCM_SHA384 value: TLS_AES_256_GCM_SHA384 AfdCertificateType: type: string description: Defines the source of the SSL certificate. enum: - CustomerCertificate - ManagedCertificate - AzureFirstPartyManagedCertificate x-ms-enum: name: AfdCertificateType modelAsString: true values: - name: CustomerCertificate value: CustomerCertificate - name: ManagedCertificate value: ManagedCertificate - name: AzureFirstPartyManagedCertificate value: AzureFirstPartyManagedCertificate AfdServerTlsGroup: type: string description: Supported key-exchange groups and curves. The ML-KEM groups are hybrid post-quantum groups. enum: - SecP256r1MLKEM768 - SecP384r1MLKEM1024 - X25519MLKEM768 - prime256v1 - X25519 - secp384r1 - secp521r1 x-ms-enum: name: AfdServerTlsGroup modelAsString: true values: - name: SecP256r1MLKEM768 value: SecP256r1MLKEM768 description: Hybrid post-quantum group combining secp256r1 with ML-KEM-768. - name: SecP384r1MLKEM1024 value: SecP384r1MLKEM1024 description: Hybrid post-quantum group combining secp384r1 with ML-KEM-1024. - name: X25519MLKEM768 value: X25519MLKEM768 description: Hybrid post-quantum group combining X25519 with ML-KEM-768. - name: prime256v1 value: prime256v1 description: The prime256v1 elliptic curve group. - name: X25519 value: X25519 description: The X25519 elliptic curve group. - name: secp384r1 value: secp384r1 description: The secp384r1 elliptic curve group. - name: secp521r1 value: secp521r1 description: The secp521r1 elliptic curve group. DomainValidationState: type: string description: Provisioning substate shows the progress of custom HTTPS enabling/disabling process step by step. DCV stands for DomainControlValidation. enum: - Unknown - Submitting - Pending - Rejected - TimedOut - PendingRevalidation - Approved - RefreshingValidationToken - InternalError x-ms-enum: name: DomainValidationState modelAsString: true values: - name: Unknown value: Unknown - name: Submitting value: Submitting - name: Pending value: Pending - name: Rejected value: Rejected - name: TimedOut value: TimedOut - name: PendingRevalidation value: PendingRevalidation - name: Approved value: Approved - name: RefreshingValidationToken value: RefreshingValidationToken - name: InternalError value: InternalError DomainValidationProperties: type: object description: The JSON object that contains the properties to validate a domain. properties: validationToken: type: string description: Challenge used for DNS TXT record or file based validation readOnly: true expirationDate: type: string description: The date time that the token expires readOnly: true AfdCustomizedCipherSuiteForTls12: type: string enum: - ECDHE_RSA_AES128_GCM_SHA256 - ECDHE_RSA_AES256_GCM_SHA384 - DHE_RSA_AES256_GCM_SHA384 - DHE_RSA_AES128_GCM_SHA256 - ECDHE_RSA_AES128_SHA256 - ECDHE_RSA_AES256_SHA384 x-ms-enum: name: AfdCustomizedCipherSuiteForTls12 modelAsString: true values: - name: ECDHE_RSA_AES128_GCM_SHA256 value: ECDHE_RSA_AES128_GCM_SHA256 - name: ECDHE_RSA_AES256_GCM_SHA384 value: ECDHE_RSA_AES256_GCM_SHA384 - name: DHE_RSA_AES256_GCM_SHA384 value: DHE_RSA_AES256_GCM_SHA384 - name: DHE_RSA_AES128_GCM_SHA256 value: DHE_RSA_AES128_GCM_SHA256 - name: ECDHE_RSA_AES128_SHA256 value: ECDHE_RSA_AES128_SHA256 - name: ECDHE_RSA_AES256_SHA384 value: ECDHE_RSA_AES256_SHA384 MtlsScenarioType: type: string description: Supported scenarios for establishing mTLS connection. enum: - ClientCertificateRequiredAndValidated - ClientCertificateRequiredAndOriginValidates - ClientCertificateValidatedIfPresented - CompleteMtlsPassthroughToOrigin x-ms-enum: name: MtlsScenarioType modelAsString: true values: - name: ClientCertificateRequiredAndValidated value: ClientCertificateRequiredAndValidated - name: ClientCertificateRequiredAndOriginValidates value: ClientCertificateRequiredAndOriginValidates - name: ClientCertificateValidatedIfPresented value: ClientCertificateValidatedIfPresented - name: CompleteMtlsPassthroughToOrigin value: CompleteMtlsPassthroughToOrigin ResourceReference: type: object description: Reference to another resource. properties: id: type: string description: Resource ID. AFDDomainHttpsCustomizedCipherSuiteSet: type: object description: Customized cipher suite set object that will be used for Https when cipherSuiteSetType is Customized. properties: cipherSuiteSetForTls12: type: array description: Cipher suites for TLS 1.2. Required at least one in minimumTlsVersion TLS 1.2. items: $ref: '#/components/schemas/AfdCustomizedCipherSuiteForTls12' cipherSuiteSetForTls13: type: array description: Cipher suites for TLS 1.3. Required at least one in minimumTlsVersion TLS 1.2, TLS 1.3. items: $ref: '#/components/schemas/AfdCustomizedCipherSuiteForTls13' AfdCipherSuiteSetType: type: string description: cipher suite set type that will be used for Https enum: - Customized - TLS10_2019 - TLS12_2022 - TLS12_2023 x-ms-enum: name: AfdCipherSuiteSetType modelAsString: true values: - name: Customized value: Customized - name: TLS10_2019 value: TLS10_2019 - name: TLS12_2022 value: TLS12_2022 - name: TLS12_2023 value: TLS12_2023 AFDDomainListResult: type: object description: The response of a AFDDomain list operation. properties: value: type: array description: The AFDDomain items on this page items: $ref: '#/components/schemas/AFDDomain' nextLink: type: string format: uri description: The link to the next page of items required: - value DeploymentStatus: type: string enum: - NotStarted - InProgress - Succeeded - Failed x-ms-enum: name: DeploymentStatus modelAsString: true values: - name: NotStarted value: NotStarted - name: InProgress value: InProgress - name: Succeeded value: Succeeded - name: Failed value: Failed AFDDomainMtlsParameters: type: object description: Contains the properties to configure mutual TLS for a custom domain with FQDN. Mutual TLS cannot be configured for custom domains with wildcard host names. properties: scenario: $ref: '#/components/schemas/MtlsScenarioType' description: Supported scenarios for establishing mTLS connection. discriminator: propertyName: scenario required: - scenario AfdMinimumTlsVersion: type: string description: TLS protocol version that will be used for Https when cipherSuiteSetType is Customized. enum: - TLS10 - TLS12 - TLS13 x-ms-enum: name: AfdMinimumTlsVersion modelAsString: false AFDDomainProperties: type: object description: The JSON object that contains the properties of the domain to create. properties: profileName: type: string description: The name of the profile which holds the domain. readOnly: true tlsSettings: $ref: '#/components/schemas/AFDDomainHttpsParameters' description: The configuration specifying how to enable HTTPS for the domain - using AzureFrontDoor managed certificate or user's own certificate. If not specified, enabling ssl uses AzureFrontDoor managed certificate by default. mtlsSettings: $ref: '#/components/schemas/AFDDomainMtlsParameters' description: The configuration specifying how to enable mutual TLS for the domain, including specifying allowed FQDNs and which server certificate(s) to use. azureDnsZone: $ref: '#/components/schemas/ResourceReference' description: Resource reference to the Azure DNS zone preValidatedCustomDomainResourceId: $ref: '#/components/schemas/ResourceReference' description: Resource reference to the Azure resource where custom domain ownership was prevalidated provisioningState: $ref: '#/components/schemas/AfdProvisioningState' description: Provisioning status readOnly: true deploymentStatus: $ref: '#/components/schemas/DeploymentStatus' readOnly: true domainValidationState: $ref: '#/components/schemas/DomainValidationState' description: Provisioning substate shows the progress of custom HTTPS enabling/disabling process step by step. DCV stands for DomainControlValidation. readOnly: true hostName: type: string description: The host name of the domain. Must be a domain name. extendedProperties: type: object description: Key-Value pair representing migration properties for domains. additionalProperties: type: string validationProperties: $ref: '#/components/schemas/DomainValidationProperties' description: Values the customer needs to validate domain ownership readOnly: true required: - hostName securitySchemes: azure_auth: type: oauth2 flows: implicit: scopes: user_impersonation: impersonate your user account authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize description: Azure Active Directory OAuth2 Flow.