eCDN Commands

Commands for managing eCDN (embedded Content Delivery Network) for B2C Commerce storefronts.

Global Flags

All eCDN commands support these flags:

Flag	Description	Environment Variable
--tenant-id	B2C Commerce tenant ID	SFCC_TENANT_ID
--short-code	API short code	SFCC_SHORT_CODE
--json	Output as JSON	-

Zone Selection

Commands that operate on a specific zone use the --zone / -z flag:

Flag	Description
--zone, -z	Zone ID (32-char hex) or zone name

Zone names are resolved to IDs automatically via case-insensitive lookup.

Authentication

eCDN commands require OAuth authentication with these scopes:

Operation Type	Required Scope
Read operations	sfcc.cdn-zones
Write operations	sfcc.cdn-zones.rw

For complete setup instructions, see the Authentication Guide.

---

Zone Management

b2c ecdn zones list

List all CDN zones for a tenant.

b2c ecdn zones list --tenant-id zzxy_prd

Output

Column	Description
Name	Zone name
ID	Zone ID
Status	Zone status
Type	Zone type (storefront)

---

b2c ecdn zones create

Create a new storefront zone.

b2c ecdn zones create --tenant-id zzxy_prd --storefront-hostname www.example.com --origin-hostname origin.example.com

Flags

Flag	Description	Required
--storefront-hostname	Customer-facing hostname	Yes
--origin-hostname	Origin server hostname	Yes

---

Cache Management

b2c ecdn cache purge

Purge cached content from the CDN.

# Purge by path
b2c ecdn cache purge --zone my-zone --path /products --path /categories

# Purge by cache tag
b2c ecdn cache purge --zone my-zone --tag product-123

# Purge everything
b2c ecdn cache purge --zone my-zone --purge-everything

Flags

Flag	Description
--path	Path to purge (can be repeated)
--tag	Cache tag to purge (can be repeated)
--host	Host for path purging
--purge-everything	Purge all cached content

At least one purge method must be specified.

---

b2c ecdn cache ocapi-toggle

Toggle OCAPI caching page rule.

b2c ecdn cache ocapi-toggle --zone my-zone --enabled
b2c ecdn cache ocapi-toggle --zone my-zone --no-enabled

Flags

Flag	Description
--enabled	Enable or disable OCAPI caching

---

Certificate Management

b2c ecdn certificates list

List certificates for a zone.

b2c ecdn certificates list --zone my-zone

---

b2c ecdn certificates add

Add a certificate to a zone.

b2c ecdn certificates add --zone my-zone --hostname www.example.com --certificate-file ./cert.pem --private-key-file ./key.pem

Flags

Flag	Description	Required
--hostname	Custom hostname	Yes
--certificate-file	Path to certificate PEM file	Yes
--private-key-file	Path to private key PEM file	Yes

---

b2c ecdn certificates get

Get certificate details.

b2c ecdn certificates get --zone my-zone --certificate-id abc123

---

b2c ecdn certificates update

Update a certificate.

b2c ecdn certificates update --zone my-zone --certificate-id abc123 --certificate-file ./new-cert.pem --private-key-file ./new-key.pem

---

b2c ecdn certificates delete

Delete a certificate.

b2c ecdn certificates delete --zone my-zone --certificate-id abc123

---

b2c ecdn certificates validate

Validate a custom hostname certificate.

b2c ecdn certificates validate --zone my-zone --certificate-id abc123

---

Security Settings

b2c ecdn security get

Get security settings for a zone.

b2c ecdn security get --zone my-zone

Output

Displays settings including:

• SSL mode
• Always use HTTPS
• Minimum TLS version
• TLS 1.3 status
• Automatic HTTPS rewrites
• Opportunistic encryption

---

b2c ecdn security update

Update security settings.

b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --always-use-https

Flags

Flag	Description	Options
--ssl-mode	SSL/TLS mode	off, flexible, full, strict
--min-tls-version	Minimum TLS version	1.0, 1.1, 1.2, 1.3
--always-use-https / --no-always-use-https	Force HTTPS	-
--tls-1-3 / --no-tls-1-3	Enable TLS 1.3	-
--automatic-https-rewrites / --no-automatic-https-rewrites	Rewrite HTTP links	-
--opportunistic-encryption / --no-opportunistic-encryption	Enable opportunistic encryption	-

---

Speed Settings

b2c ecdn speed get

Get speed optimization settings.

b2c ecdn speed get --zone my-zone

---

b2c ecdn speed update

Update speed optimization settings.

b2c ecdn speed update --zone my-zone --browser-cache-ttl 14400 --auto-minify-html --auto-minify-css --auto-minify-js

Flags

Flag	Description
--browser-cache-ttl	Browser cache TTL in seconds
--auto-minify-html / --no-auto-minify-html	Auto-minify HTML
--auto-minify-css / --no-auto-minify-css	Auto-minify CSS
--auto-minify-js / --no-auto-minify-js	Auto-minify JavaScript
--brotli / --no-brotli	Enable Brotli compression
--early-hints / --no-early-hints	Enable Early Hints
--h2-prioritization / --no-h2-prioritization	HTTP/2 prioritization
--image-resizing / --no-image-resizing	Enable image resizing
--mirage / --no-mirage	Enable Mirage
--polish	Polish mode (off, lossless, lossy)
--prefetch-preload / --no-prefetch-preload	Prefetch preload
--rocket-loader / --no-rocket-loader	Rocket Loader

---

WAF (Web Application Firewall)

WAF v1 Commands

b2c ecdn waf groups list

List WAF v1 rule groups.

b2c ecdn waf groups list --zone my-zone

---

b2c ecdn waf groups update

Update a WAF v1 group.

b2c ecdn waf groups update --zone my-zone --group-id abc123 --mode on

Flag	Description	Options
--mode	Group mode	on, off

---

b2c ecdn waf rules list

List WAF v1 rules in a group.

b2c ecdn waf rules list --zone my-zone --group-id abc123

---

b2c ecdn waf rules get

Get details of a WAF v1 rule.

b2c ecdn waf rules get --zone my-zone --rule-id abc123

---

b2c ecdn waf rules update

Update a WAF v1 rule.

b2c ecdn waf rules update --zone my-zone --rule-id abc123 --mode on

---

WAF v2 Commands

b2c ecdn waf rulesets list

List WAF v2 rulesets.

b2c ecdn waf rulesets list --zone my-zone

---

b2c ecdn waf rulesets update

Update a WAF v2 ruleset.

b2c ecdn waf rulesets update --zone my-zone --ruleset-id abc123 --action block

---

b2c ecdn waf managed-rules list

List WAF v2 managed rules.

b2c ecdn waf managed-rules list --zone my-zone

---

b2c ecdn waf managed-rules update

Update a WAF v2 managed rule.

b2c ecdn waf managed-rules update --zone my-zone --rule-id abc123 --action block

---

OWASP Settings

b2c ecdn waf owasp get

Get OWASP ModSecurity package settings.

b2c ecdn waf owasp get --zone my-zone

---

b2c ecdn waf owasp update

Update OWASP package settings.

b2c ecdn waf owasp update --zone my-zone --sensitivity high

---

WAF Migration

b2c ecdn waf migrate

Migrate a zone from WAF v1 to WAF v2.

b2c ecdn waf migrate --zone my-zone

---

Custom Firewall Rules

b2c ecdn firewall list

List custom firewall rules.

b2c ecdn firewall list --zone my-zone

---

b2c ecdn firewall create

Create a custom firewall rule.

b2c ecdn firewall create --zone my-zone --description "Block bad bots" --action block --filter '(cf.client.bot)'

Flags

Flag	Description	Required
--description	Rule description	Yes
--action	Rule action (block, challenge, js_challenge, managed_challenge, allow, log, bypass)	Yes
--filter	Firewall filter expression	Yes
--paused	Create rule in paused state	No
--priority	Rule priority	No

---

b2c ecdn firewall get

Get a firewall rule.

b2c ecdn firewall get --zone my-zone --rule-id abc123

---

b2c ecdn firewall update

Update a firewall rule.

b2c ecdn firewall update --zone my-zone --rule-id abc123 --action challenge

---

b2c ecdn firewall delete

Delete a firewall rule.

b2c ecdn firewall delete --zone my-zone --rule-id abc123

---

b2c ecdn firewall reorder

Reorder firewall rules.

b2c ecdn firewall reorder --zone my-zone --rule-ids id1,id2,id3

---

Rate Limiting

b2c ecdn rate-limit list

List rate limiting rules.

b2c ecdn rate-limit list --zone my-zone

---

b2c ecdn rate-limit create

Create a rate limiting rule.

b2c ecdn rate-limit create --zone my-zone --description "API rate limit" --threshold 100 --period 60 --action block --match-url '/api/*'

Flags

Flag	Description	Required
--description	Rule description	Yes
--threshold	Request threshold	Yes
--period	Period in seconds	Yes
--action	Action (block, challenge, js_challenge, managed_challenge, log, simulate)	Yes
--match-url	URL pattern to match	Yes
--match-methods	HTTP methods (comma-separated)	No
--timeout	Block timeout in seconds	No

---

b2c ecdn rate-limit get

Get a rate limiting rule.

b2c ecdn rate-limit get --zone my-zone --rule-id abc123

---

b2c ecdn rate-limit update

Update a rate limiting rule.

b2c ecdn rate-limit update --zone my-zone --rule-id abc123 --threshold 200

---

b2c ecdn rate-limit delete

Delete a rate limiting rule.

b2c ecdn rate-limit delete --zone my-zone --rule-id abc123

---

Logpush

b2c ecdn logpush ownership

Create a Logpush ownership challenge token for destination verification.

b2c ecdn logpush ownership --zone my-zone --destination-path 's3://my-bucket/logs?region=us-east-1'

---

b2c ecdn logpush jobs list

List Logpush jobs.

b2c ecdn logpush jobs list --zone my-zone

---

b2c ecdn logpush jobs create

Create a Logpush job.

b2c ecdn logpush jobs create --zone my-zone --name "HTTP logs" --destination-path 's3://my-bucket/logs?region=us-east-1' --log-type http_requests --log-fields ClientRequestHost,ClientRequestMethod

Flags

Flag	Description	Required
--name	Job name	Yes
--destination-path	Log destination path	Yes
--log-type	Type of logs (http_requests, firewall_events, nel_reports, dns_logs)	Yes
--log-fields	Comma-separated log fields	No
--filter	JSON filter expression	No
--enabled	Enable job on creation	No

---

b2c ecdn logpush jobs get

Get Logpush job details.

b2c ecdn logpush jobs get --zone my-zone --job-id 123456

---

b2c ecdn logpush jobs update

Update a Logpush job.

b2c ecdn logpush jobs update --zone my-zone --job-id 123456 --enabled
b2c ecdn logpush jobs update --zone my-zone --job-id 123456 --no-enabled

---

b2c ecdn logpush jobs delete

Delete a Logpush job.

b2c ecdn logpush jobs delete --zone my-zone --job-id 123456

---

Page Shield

Notifications (Organization Level)

b2c ecdn page-shield notifications list

List Page Shield notification webhooks.

b2c ecdn page-shield notifications list --tenant-id zzxy_prd

---

b2c ecdn page-shield notifications create

Create a notification webhook.

b2c ecdn page-shield notifications create --tenant-id zzxy_prd --url https://example.com/webhook --secret my-secret --zones zone1,zone2

---

b2c ecdn page-shield notifications delete

Delete a notification webhook.

b2c ecdn page-shield notifications delete --tenant-id zzxy_prd --webhook-id abc123

---

Policies (Zone Level)

b2c ecdn page-shield policies list

List Page Shield policies.

b2c ecdn page-shield policies list --zone my-zone

---

b2c ecdn page-shield policies create

Create a Page Shield policy.

b2c ecdn page-shield policies create --zone my-zone --action allow --value script-src --expression 'http.request.uri.path contains "/trusted/"'

Flags

Flag	Description	Required
--action	Policy action (allow, log)	Yes
--value	Policy value (e.g., script-src)	Yes
--expression	Policy expression	No
--description	Policy description	No
--enabled	Enable policy	No

---

b2c ecdn page-shield policies get

Get a Page Shield policy.

b2c ecdn page-shield policies get --zone my-zone --policy-id abc123

---

b2c ecdn page-shield policies update

Update a Page Shield policy.

b2c ecdn page-shield policies update --zone my-zone --policy-id abc123 --enabled

---

b2c ecdn page-shield policies delete

Delete a Page Shield policy.

b2c ecdn page-shield policies delete --zone my-zone --policy-id abc123

---

Scripts (Zone Level)

b2c ecdn page-shield scripts list

List detected scripts.

b2c ecdn page-shield scripts list --zone my-zone

---

b2c ecdn page-shield scripts get

Get script details.

b2c ecdn page-shield scripts get --zone my-zone --script-id abc123

---

MRT Rules

b2c ecdn mrt-rules get

Get MRT ruleset for a zone.

b2c ecdn mrt-rules get --zone my-zone

---

b2c ecdn mrt-rules create

Create MRT rules to route requests to a Managed Runtime environment.

b2c ecdn mrt-rules create --zone my-zone --mrt-hostname customer-pwa.mobify-storefront.com --expressions '(http.host eq "example.com")' --descriptions "Route to PWA"

Flags

Flag	Description	Required
--mrt-hostname	Managed Runtime instance hostname	Yes
--expressions	Comma-separated rule expressions	Yes
--descriptions	Comma-separated rule descriptions	No

---

b2c ecdn mrt-rules update

Update MRT ruleset hostname or add new rules.

b2c ecdn mrt-rules update --zone my-zone --mrt-hostname new-customer-pwa.mobify-storefront.com

---

b2c ecdn mrt-rules delete

Delete an MRT ruleset and all rules.

b2c ecdn mrt-rules delete --zone my-zone

---

Individual MRT Rules

b2c ecdn mrt-rules rules update

Update an individual MRT rule.

b2c ecdn mrt-rules rules update --zone my-zone --ruleset-id abc123 --rule-id def456 --enabled

---

b2c ecdn mrt-rules rules delete

Delete an individual MRT rule.

b2c ecdn mrt-rules rules delete --zone my-zone --ruleset-id abc123 --rule-id def456

---

mTLS Certificates (Organization Level)

b2c ecdn mtls list

List mTLS certificates.

b2c ecdn mtls list --tenant-id zzxy_prd

---

b2c ecdn mtls create

Create an mTLS certificate for code upload authentication.

b2c ecdn mtls create --tenant-id zzxy_prd --name "Build Server" --ca-certificate-file ./ca.pem --leaf-certificate-file ./leaf.pem

Flags

Flag	Description	Required
--name	Certificate name	Yes
--ca-certificate-file	Path to CA certificate PEM	Yes
--leaf-certificate-file	Path to leaf certificate PEM	Yes

---

b2c ecdn mtls get

Get mTLS certificate details.

b2c ecdn mtls get --tenant-id zzxy_prd --certificate-id abc123

---

b2c ecdn mtls delete

Delete an mTLS certificate.

b2c ecdn mtls delete --tenant-id zzxy_prd --certificate-id abc123

---

Cipher Suites

b2c ecdn cipher-suites get

Get cipher suites configuration.

b2c ecdn cipher-suites get --zone my-zone

---

b2c ecdn cipher-suites update

Update cipher suites settings.

# Use a preset suite type
b2c ecdn cipher-suites update --zone my-zone --suite-type Modern

# Use custom ciphers
b2c ecdn cipher-suites update --zone my-zone --suite-type Custom --ciphers "ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256"

Flags

Flag	Description	Required
--suite-type	Cipher suite type (Compatible, Modern, Custom, Legacy)	Yes
--ciphers	Comma-separated cipher list (required for Custom)	Conditional

---

Origin Headers

b2c ecdn origin-headers get

Get origin header modification settings (MRT type).

b2c ecdn origin-headers get --zone my-zone

---

b2c ecdn origin-headers set

Set or update origin header modification.

b2c ecdn origin-headers set --zone my-zone --header-value my-secret-value
b2c ecdn origin-headers set --zone my-zone --header-value my-secret-value --header-name x-custom-header

Flags

Flag	Description	Required
--header-value	Value of the header to forward to origin	Yes
--header-name	Name of the header (cannot be changed for MRT origin)	No

---

b2c ecdn origin-headers delete

Delete origin header modification.

b2c ecdn origin-headers delete --zone my-zone