Convenience Rules

Convenience rules (referred to as AddIns in the API’s URL paths, for backwards compatibility) are per-site rules such as redirects, URL rewrites, custom response headers, basic authentication, and code injection. These are called Convenience Rules throughout the Skip2 dashboard.

Endpoints

Method	Path	Description
GET	/sites/{site_id}/addins	List convenience rules
POST	/sites/{site_id}/addins	Create a convenience rule
PATCH	/sites/{site_id}/addins/{addin_id}	Update a convenience rule
DELETE	/sites/{site_id}/addins/{addin_id}	Delete a convenience rule

Fields

name

A label for the rule (required).

type

The rule type: redirect, rewrite, header, basic-auth, or code-inject (required). See Rule types and variables below for the fields each type expects.

match_key

The criterion to match the incoming request against. One of request_path, ip_address, http_header, http_method.

match_value

The value to match, format depends on match_key:

• request_path — a path, optionally with * wildcards (for example /api/*)

• ip_address — a single IP address or CIDR block (for example 203.0.113.0/24)

• http_header — Header-Name or Header-Name: value

• http_method — one of GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, TRACE, CONNECT

var1 … var4

Type-specific parameters. See Rule types and variables below.

Rule types and variables

Each rule type interprets var1 through var4 differently. Fields not listed for a given type are ignored and should be omitted or left null.

Type	Dashboard name	var1	var2	var3	var4
redirect	Redirect	Redirect mode: 307 (temporary), 308 (permanent), or html (HTML meta-refresh)	Destination URL — absolute (https://...) or a path starting with /	unused	unused
rewrite	URL Rewrite	Original path to match, for example /old-path	Path to rewrite the request to before it reaches the origin, for example /new-path	unused	unused
header	HTTP Header	Action: add, remove, or replace	Header name, for example X-Frame-Options	Header value (ignored when var1 is remove)	unused
basic-auth	Basic Auth	Username	Password hash, in the format matching var3 (see note below)	Hash algorithm: bcrypt or argon2id	unused
code-inject	Code Injection	Search string — or regex pattern if var2 is true — to match within the response body	true to treat var1 as a regular expression; omit or leave empty for a literal string match	Replacement content to inject (up to 100 KB)	unused

Note

For basic-auth rules, var2 must already be hashed — the API does not hash plaintext passwords for you (the dashboard UI hashes on your behalf before saving). Use bcrypt (cost 14) or argon2id with Caddy’s default parameters, matching whichever algorithm you set in var3. Hashes look like $2b$14$... (bcrypt) or $argon2id$v=19$... (argon2id).

Create a convenience rule

curl -X POST https://api.skip2.net/v1/sites/1000/addins \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "Redirect /old to /new",
        "type": "redirect",
        "match_key": "request_path",
        "match_value": "/old",
        "var1": "308",
        "var2": "/new"
      }'

{
  "success": true,
  "data": {
    "id": 1000, "site_id": 1000, "name": "Redirect /old to /new",
    "type": "redirect", "match_key": "request_path", "match_value": "/old",
    "var1": "308", "var2": "/new", "var3": null, "var4": null,
    "enabled": true
  }
}

Update a convenience rule

PATCH is a partial update — only the fields you supply are changed; anything omitted keeps its current value.

curl -X PATCH https://api.skip2.net/v1/sites/1000/addins/1000 \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"var2": "/newer"}'

Delete a convenience rule

curl -X DELETE https://api.skip2.net/v1/sites/1000/addins/1000 \
  -H "Authorization: Bearer $SKIP2_API_KEY"