b2c-ecdn

# B2C eCDN Skill Use the `b2c` CLI plugin to manage eCDN (embedded Content Delivery Network) zones, certificates, security settings, and more. To investigate bot or abusive traffic before changing rules (which sources matter, who runs them, which rules cover them), use the `b2c-ops:b2c-edge-traffic-triage` runbook (MCP: `skill://b2c-ops/b2c-edge-traffic-triage/SKILL.md`). > **Tip:** If `b2c` is not installed globally, use `npx @salesforce/b2c-cli` instead (e.g., `npx @salesforce/b2c-cli ecdn zones list`). ## Configuration Values like `tenantId`, `clientId`, and `clientSecret` resolve from `dw.json` / `SFCC_*` env vars / the active instance / configuration plugins. Examples below show minimal usage; **add flags only to override configured values** — passing `--client-id`/`--client-secret`/`--tenant-id` is usually unnecessary. If a required value is missing, the CLI emits an actionable error pointing at the flag, env var, and config key. Run `b2c setup inspect` to see the resolved configuration and which source provided each value (`--json` for scripting; secrets stay masked by default). For precedence rules and troubleshooting, see the `b2c-cli:b2c-config` skill. ## Prerequisites - OAuth credentials with `sfcc.cdn-zones` scope (read operations) - OAuth credentials with `sfcc.cdn-zones.rw` scope (write operations) - Tenant ID for your B2C Commerce organization (from config or `--tenant-id`) ## Examples ### List CDN Zones ```bash # list all CDN zones for the configured tenant b2c ecdn zones list # JSON output b2c ecdn zones list --json # target a different tenant than the active config b2c ecdn zones list --tenant-id zzxy_prd ``` ### Create a Storefront Zone ```bash # create a new storefront zone b2c ecdn zones create --domain-name example.com ``` ### Purge Cache ```bash # purge cache for specific paths b2c ecdn cache purge --zone my-zone --path /products --path /categories # purge by cache tags b2c ecdn cache purge --zone my-zone --tag product-123 --tag category-456 ``` ### Manage Certificates ```bash # list certificates for a zone b2c ecdn certificates list --zone my-zone # add a new certificate b2c ecdn certificates add --zone my-zone --hostname www.example.com --type custom --certificate-file ./cert.pem --private-key-file ./key.pem # validate a custom hostname b2c ecdn certificates validate --zone my-zone --custom-hostname-id abc123 ``` ### Manage Rate Limiting Rules ```bash # list rate limiting rules b2c ecdn rate-limit list --zone my-zone # create a rate limiting rule b2c ecdn rate-limit create --zone my-zone --description "Rate limit /checkout" --expression '(http.request.uri.path matches "^/checkout")' --characteristics cf.unique_visitor_id --action block --period 60 --requests-per-period 50 --mitigation-timeout 600 # get a rule b2c ecdn rate-limit get --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e # update a rule b2c ecdn rate-limit update --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --requests-per-period 100 # delete a rule b2c ecdn rate-limit delete --zone my-zone --rule-id 2c0fc9fa937b11eaa1b71c4d701ab86e --force ``` ### Security Settings ```bash # get security settings b2c ecdn security get --zone my-zone # update security settings b2c ecdn security update --zone my-zone --security-level medium --always-use-https --tls13 ``` ### Speed Settings ```bash # get speed optimization settings b2c ecdn speed get --zone my-zone # update speed settings b2c ecdn speed update --zone my-zone --brotli on --http3 on --webp on ``` ## Additional Topics For less commonly used eCDN features, see the reference files: - **[SECURITY.md](references/SECURITY.md)** — WAF (v1 and v2), custom firewall rules, rate limiting, and Page Shield (CSP policies, script detection, notification webhooks) - **[ADVANCED.md](references/ADVANCED.md)** — Logpush jobs, MRT routing rules, mTLS certificates, cipher suite configuration, and origin header modification ## Configuration Overrides The tenant ID can be overridden via flag or environment variable: - `--tenant-id` / `SFCC_TENANT_ID` / `tenantId` in dw.json The `--zone` flag accepts either: - Zone ID (32-character hex string) - Zone name (human-readable, case-insensitive lookup) ### OAuth Scopes | Operation | Required Scope | | ---------------- | ------------------- | | Read operations | `sfcc.cdn-zones` | | Write operations | `sfcc.cdn-zones.rw` | ### More Commands See `b2c ecdn --help` for a full list of available commands and options in the `ecdn` topic.