# Zone Options Set
## Endpoint
`/api/zones/options/set`
## Method
GET
## Description
Sets the zone specific options.
## Authentication
Token required.
## Parameters
| `token` | string | Yes | - | Session token from `login` or `createToken`. |
| `node` | string | No | - | Node domain name for clustering. When unspecified, the current node is used. Only usable when Clustering is initialized. |
| `zone` | string | Yes | - | Domain name of the zone to set options for. |
| `disabled` | boolean | No | - | Sets if the zone is enabled or disabled. |
| `catalog` | string | No | - | Catalog zone name to register as its member. Valid only for `Primary`, `Secondary`, `Stub`, and `Forwarder` zones. |
| `overrideCatalogQueryAccess` | boolean | No | - | Override Query Access option in the Catalog zone. Valid only for `Primary`, `Secondary`, `Stub`, and `Forwarder` zones. |
| `overrideCatalogZoneTransfer` | boolean | No | - | Override Zone Transfer option in the Catalog zone. Valid only for `Primary`, `Secondary`, and `Forwarder` zones. |
| `overrideCatalogNotify` | boolean | No | - | Override Notify option in the Catalog zone. Valid only for `Primary` and `Forwarder` zones. |
| `primaryNameServerAddresses` | string | No | Required for `SecondaryForwarder` and `SecondaryCatalog` | Comma-separated list of IP addresses or domain names of primary name server. Used with `Secondary`, `SecondaryForwarder`, `SecondaryCatalog`, and `Stub` zones. Auto-resolved for `Secondary` and `Stub` if omitted. **Required** for `SecondaryForwarder` and `SecondaryCatalog`. |
| `primaryZoneTransferProtocol` | string | No | - | Zone transfer protocol for `Secondary`, `SecondaryForwarder`, and `SecondaryCatalog` zones. Valid values: [`Tcp`, `Tls`, `Quic`]. |
| `primaryZoneTransferTsigKeyName` | string | No | - | TSIG key name for zone transfer. Used by `Secondary`, `SecondaryForwarder`, and `SecondaryCatalog` zones. |
| `validateZone` | boolean | No | - | Enable ZONEMD validation for `Secondary` zones. Zone gets disabled if validation fails. Zone must be DNSSEC signed. Only valid for `Secondary` zones. |
| `queryAccess` | string | No | - | Valid values: [`Deny`, `Allow`, `AllowOnlyPrivateNetworks`, `AllowOnlyZoneNameServers`, `UseSpecifiedNetworkACL`, `AllowZoneNameServersAndUseSpecifiedNetworkACL`]. |
| `queryAccessNetworkACL` | string | No | Requires `queryAccess` = `UseSpecifiedNetworkACL` or `AllowZoneNameServersAndUseSpecifiedNetworkACL` | Comma-separated ACL of network entries. Prefix with `!` to deny. Set to `false` to remove existing values. Valid for all zones except `SecondaryCatalog`. |
| `zoneTransfer` | string | No | - | Zone transfer setting. Valid values: [`Deny`, `Allow`, `AllowOnlyZoneNameServers`, `UseSpecifiedNetworkACL`, `AllowZoneNameServersAndUseSpecifiedNetworkACL`]. Valid only for `Primary` and `Secondary` zones. |
| `zoneTransferNetworkACL` | string | No | Requires `zoneTransfer` = `UseSpecifiedNetworkACL` or `AllowZoneNameServersAndUseSpecifiedNetworkACL` | Comma-separated ACL of network entries. Prefix with `!` to deny. Set to `false` to remove existing values. Valid only for `Primary`, `Secondary`, `Forwarder`, and `Catalog` zones. |
| `zoneTransferTsigKeyNames` | string | No | - | Comma-separated TSIG key names authorized for zone transfer. Set to `false` to clear all. Valid only for `Primary`, `Secondary`, `Forwarder`, and `Catalog` zones. |
| `notify` | string | No | - | Notify setting. For `Primary`/`Secondary`: [`None`, `ZoneNameServers`, `SpecifiedNameServers`, `BothZoneAndSpecifiedNameServers`, `SeparateNameServersForCatalogAndMemberZones`]. For `Forwarder`/`Catalog`: [`None`, `SpecifiedNameServers`]. `SeparateNameServersForCatalogAndMemberZones` is valid only for `Catalog` zones. Valid only for `Primary`, `Secondary`, `Forwarder`, and `Catalog` zones. |
| `notifyNameServers` | string | No | Requires `notify` = `SpecifiedNameServers` or `BothZoneAndSpecifiedNameServers` | Comma-separated IP addresses to notify. Valid only for `Primary`, `Secondary`, `Forwarder`, and `Catalog` zones. |
| `notifySecondaryCatalogsNameServers` | string | No | Requires `notify` = `SeparateNameServersForCatalogAndMemberZones` | Comma-separated IP addresses to notify for catalog zone updates only. Valid only for `Catalog` zones. |
| `update` | string | No | - | Dynamic update (RFC 2136) setting. For `Primary`: [`Deny`, `Allow`, `AllowOnlyZoneNameServers`, `UseSpecifiedNetworkACL`, `AllowZoneNameServersAndUseSpecifiedNetworkACL`]. For `Secondary`/`Forwarder`: [`Deny`, `Allow`, `UseSpecifiedNetworkACL`]. Valid only for `Primary`, `Secondary`, and `Forwarder` zones. |
| `updateNetworkACL` | string | No | Requires `update` = `UseSpecifiedNetworkACL` or `AllowZoneNameServersAndUseSpecifiedNetworkACL` | Comma-separated ACL of network entries. Prefix with `!` to deny. Set to `false` to remove existing values. Valid only for `Primary`, `Secondary`, and `Forwarder` zones. |
| `updateSecurityPolicies` | string | No | - | Pipe `\|` separated table data (pipe used as both row and column separator). Each row: TSIG key name, domain name, comma-separated record types. Use wildcard domain for all sub domains. Set to `false` to clear all and stop TSIG auth. Valid only for `Primary` and `Forwarder` zones. |
## Response Fields
No additional response fields beyond `status: "ok"`.
## Conditional Logic Notes
### Zone-type validity matrix
| `catalog` | Yes | Yes | Yes | Yes | - | - | - |
| `overrideCatalogQueryAccess` | Yes | Yes | Yes | Yes | - | - | - |
| `overrideCatalogZoneTransfer` | Yes | Yes | - | Yes | - | - | - |
| `overrideCatalogNotify` | Yes | - | - | Yes | - | - | - |
| `primaryNameServerAddresses` | - | Yes | Yes | - | Yes (required) | - | Yes (required) |
| `primaryZoneTransferProtocol` | - | Yes | - | - | Yes | - | Yes |
| `primaryZoneTransferTsigKeyName` | - | Yes | - | - | Yes | - | Yes |
| `validateZone` | - | Yes | - | - | - | - | - |
| `queryAccess` | Yes | Yes | Yes | Yes | Yes | Yes | - |
| `queryAccessNetworkACL` | Yes | Yes | Yes | Yes | Yes | Yes | - |
| `zoneTransfer` | Yes | Yes | - | - | - | - | - |
| `zoneTransferNetworkACL` | Yes | Yes | - | Yes | - | Yes | - |
| `zoneTransferTsigKeyNames` | Yes | Yes | - | Yes | - | Yes | - |
| `notify` | Yes | Yes | - | Yes | - | Yes | - |
| `notifyNameServers` | Yes | Yes | - | Yes | - | Yes | - |
| `notifySecondaryCatalogsNameServers` | - | - | - | - | - | Yes | - |
| `update` | Yes | Yes | - | Yes | - | - | - |
| `updateNetworkACL` | Yes | Yes | - | Yes | - | - | - |
| `updateSecurityPolicies` | Yes | - | - | Yes | - | - | - |
### ACL Processing
- ACL entries are processed in order. If no networks match, the default policy is:
- `queryAccessNetworkACL`: deny all except loopback
- `zoneTransferNetworkACL`: deny all
- `updateNetworkACL`: deny all
- Prefix an entry with `!` to deny access for that network.
- Set any ACL parameter to `false` to remove existing values.
### Notify valid values by zone type
- `Primary`/`Secondary`: `None`, `ZoneNameServers`, `SpecifiedNameServers`, `BothZoneAndSpecifiedNameServers`
- `Catalog`: `None`, `SpecifiedNameServers`, `SeparateNameServersForCatalogAndMemberZones`
- `Forwarder`: `None`, `SpecifiedNameServers`
### Update valid values by zone type
- `Primary`: `Deny`, `Allow`, `AllowOnlyZoneNameServers`, `UseSpecifiedNetworkACL`, `AllowZoneNameServersAndUseSpecifiedNetworkACL`
- `Secondary`/`Forwarder`: `Deny`, `Allow`, `UseSpecifiedNetworkACL`
## Edge Cases
- The `updateSecurityPolicies` parameter uses pipe `|` as both row and column separator. Example: `key1|example.com|A,AAAA|key2|*.example.com|ANY`
- Setting `zoneTransferTsigKeyNames` or `updateSecurityPolicies` to the string `false` clears existing values (not a boolean, but the literal string).
- Requires Zones-level Modify permission and Zone-level Delete permission (higher permission than Get).
- All parameters except `token` and `zone` are optional -- you can set just the specific options you want to change.
## Obsolete Paths
- `/api/zone/options`