# Import Allowed Zones
## Endpoint
`/api/allowed/import`
**Obsolete Path:** `/api/importAllowedZones`
## Method
POST
## Description
Imports domain names into the Allowed Zones. Accepts a comma-separated list of domain names in the request body. This is a bulk operation for adding multiple domains at once.
## Authentication
Required. A valid session token obtained from the `login` or `createToken` API call.
## Permissions
Allowed: Modify
## Parameters
### Query Parameters
| `token` | string | Yes | No | The session token generated by the `login` or the `createToken` call. |
### Body Parameters
Content-Type: `application/x-www-form-urlencoded`
| `allowedZones` | string | Yes | No | A comma-separated list of domain names to be imported into the Allowed Zones. Example: `google.com,twitter.com` |
## Response Fields
| `status` | string | `"ok"` on success. |
## Conditional Logic Notes
- This is the only Allowed Zones endpoint that uses the POST method; all others use GET.
- The request content type must be `application/x-www-form-urlencoded`, not JSON or multipart.
- The `allowedZones` body parameter uses comma separation with no spaces documented between entries.
- Shares the "Modify" permission level with the `add` endpoint.
## Edge Cases
- The documentation does not specify behavior for duplicate domains in the import list (e.g., `google.com,google.com`).
- The documentation does not specify behavior when importing domains that already exist in the Allowed Zones.
- The documentation does not specify a maximum number of domains that can be imported in a single request.
- The documentation does not clarify whether whitespace around commas is trimmed (e.g., `google.com, twitter.com` vs `google.com,twitter.com`).
- No `node` parameter is documented, so this may not support cluster-aware targeting.
- The token is passed as a query parameter even though the request body uses form encoding, meaning the token is not in the body.