b2c-ecdn

What this skill does

# B2C eCDN Skill

Use the `b2c` CLI plugin to manage eCDN (embedded Content Delivery Network) zones, certificates, security settings, and more.

> **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli ecdn zones list`).

## Configuration

Values like `tenantId` resolve from `dw.json` / `SFCC_*` env vars / the active instance. Examples below show minimal usage; add flags only to override configured values. If a required value is missing, the CLI emits an actionable error pointing at the flag, env var, and config key. See the `b2c-config` skill for precedence details.

## Prerequisites

- OAuth credentials with `sfcc.cdn-zones` scope (read operations)
- OAuth credentials with `sfcc.cdn-zones.rw` scope (write operations)
- Tenant ID for your B2C Commerce organization (from config or `--tenant-id`)

## Examples

### List CDN Zones

```bash
# list all CDN zones for the configured tenant
b2c ecdn zones list

# JSON output
b2c ecdn zones list --json

# target a different tenant than the active config
b2c ecdn zones list --tenant-id zzxy_prd
```

### Create a Storefront Zone

```bash
# create a new storefront zone
b2c ecdn zones create --domain-name example.com
```

### Purge Cache

```bash
# purge cache for specific paths
b2c ecdn cache purge --zone my-zone --path /products --path /categories

# purge by cache tags
b2c ecdn cache purge --zone my-zone --tag product-123 --tag category-456
```

### Manage Certificates

```bash
# list certificates for a zone
b2c ecdn certificates list --zone my-zone

# add a new certificate
b2c ecdn certificates add --zone my-zone --hostname www.example.com --certificate-file ./cert.pem --private-key-file ./key.pem

# validate a custom hostname
b2c ecdn certificates validate --zone my-zone --certificate-id abc123
```

### Manage Rate Limiting Rules

```bash
# list rate limiting rules
b2c ecdn rate-limit list --zone my-zone

# create a rate limiting rule
b2c ecdn rate-limit create --zone my-zone --description "Rate limit /checkout" --expression '(http.request.uri.path matches "^/checkout")' --characteristics cf.unique_visitor_id --action block --period 60 --requests-per-period 50 --mitigation-timeout 600

# get a rule
b2c ecdn rate-limit get --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e

# update a rule
b2c ecdn rate-limit update --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --requests-per-period 100

# delete a rule
b2c ecdn rate-limit delete --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --force
```

### Security Settings

```bash
# get security settings
b2c ecdn security get --zone my-zone

# update security settings
b2c ecdn security update --zone my-zone --ssl-mode full --min-tls-version 1.2 --always-use-https
```

### Speed Settings

```bash
# get speed optimization settings
b2c ecdn speed get --zone my-zone

# update speed settings
b2c ecdn speed update --zone my-zone --browser-cache-ttl 14400 --auto-minify-html --auto-minify-css
```

## Additional Topics

For less commonly used eCDN features, see the reference files:

- **[SECURITY.md](references/SECURITY.md)** — WAF (v1 and v2), custom firewall rules, rate limiting, and Page Shield (CSP policies, script detection, notification webhooks)
- **[ADVANCED.md](references/ADVANCED.md)** — Logpush jobs, MRT routing rules, mTLS certificates, cipher suite configuration, and origin header modification

## Configuration Overrides

The tenant ID can be overridden via flag or environment variable:

- `--tenant-id` / `SFCC_TENANT_ID` / `tenantId` in dw.json

The `--zone` flag accepts either:

- Zone ID (32-character hex string)
- Zone name (human-readable, case-insensitive lookup)

### OAuth Scopes

| Operation | Required Scope |
|-----------|---------------|
| Read operations | `sfcc.cdn-zones` |
| Write operations | `sfcc.cdn-zones.rw` |

### More Commands

See `b2c ecdn --help` for a full list of available commands and options in the `ecdn` topic.