1# Snippets API Reference
2 
3## Request Object
4 
5### HTTP Properties
6```javascript
7request.method    // GET, POST, PUT, DELETE, etc.
8request.url       // Full URL string
9request.headers   // Headers object
10request.body      // ReadableStream (for POST/PUT)
11request.cf        // Cloudflare properties (see below)
12```
13 
14### URL Operations
15```javascript
16const url = new URL(request.url);
17url.hostname             // "example.com"
18url.pathname             // "/path/to/page"
19url.search               // "?query=value"
20url.searchParams.get("q") // "value"
21url.searchParams.set("q", "new")
22url.searchParams.delete("q")
23```
24 
25### Header Operations
26```javascript
27// Read headers
28request.headers.get("User-Agent")
29request.headers.has("Authorization")
30request.headers.getSetCookie() // Get all Set-Cookie headers
31 
32// Modify headers (create new request)
33const modifiedRequest = new Request(request);
34modifiedRequest.headers.set("X-Custom", "value")
35modifiedRequest.headers.delete("X-Remove")
36```
37 
38### Cloudflare Properties (`request.cf`)
39Access Cloudflare-specific metadata about the request:
40 
41```javascript
42// Geolocation
43request.cf.city            // "San Francisco"
44request.cf.continent       // "NA"
45request.cf.country         // "US"
46request.cf.region          // "California" or "CA"
47request.cf.regionCode      // "CA"
48request.cf.postalCode      // "94102"
49request.cf.latitude        // "37.7749"
50request.cf.longitude       // "-122.4194"
51request.cf.timezone        // "America/Los_Angeles"
52request.cf.metroCode       // "807" (DMA code)
53 
54// Network
55request.cf.colo            // "SFO" (airport code of datacenter)
56request.cf.asn             // 13335 (ASN number)
57request.cf.asOrganization  // "Cloudflare, Inc."
58 
59// Bot Management (if enabled)
60request.cf.botManagement.score        // 1-99 (1=bot, 99=human)
61request.cf.botManagement.verified_bot // true/false
62request.cf.botManagement.static_resource // true/false
63 
64// TLS/HTTP version
65request.cf.tlsVersion      // "TLSv1.3"
66request.cf.tlsCipher       // "AEAD-AES128-GCM-SHA256"
67request.cf.httpProtocol    // "HTTP/2"
68 
69// Request metadata
70request.cf.requestPriority // "weight=192;exclusive=0"
71```
72 
73**Use cases**: Geo-routing, bot detection, security decisions, analytics.
74 
75## Response Object
76 
77### Response Constructors
78```javascript
79// Plain text
80new Response("Hello", { status: 200 })
81 
82// JSON
83Response.json({ key: "value" }, { status: 200 })
84 
85// HTML
86new Response("<h1>Hi</h1>", { 
87  status: 200,
88  headers: { "Content-Type": "text/html" }
89})
90 
91// Redirect
92Response.redirect("https://example.com", 301) // or 302
93 
94// Stream (pass through)
95new Response(response.body, response)
96```
97 
98### Response Headers
99```javascript
100// Create modified response
101const newResponse = new Response(response.body, response);
102 
103// Set/modify headers
104newResponse.headers.set("X-Custom", "value")
105newResponse.headers.append("Set-Cookie", "session=abc; Path=/")
106newResponse.headers.delete("Server")
107 
108// Common headers
109newResponse.headers.set("Cache-Control", "public, max-age=3600")
110newResponse.headers.set("Content-Type", "application/json")
111```
112 
113### Response Properties
114```javascript
115response.status       // 200, 404, 500, etc.
116response.statusText   // "OK", "Not Found", etc.
117response.headers      // Headers object
118response.body         // ReadableStream
119response.ok           // true if status 200-299
120response.redirected   // true if redirected
121```
122 
123## REST API Operations
124 
125### List Snippets
126```bash
127GET /zones/{zone_id}/snippets
128```
129 
130### Get Snippet
131```bash
132GET /zones/{zone_id}/snippets/{snippet_name}
133```
134 
135### Create/Update Snippet
136```bash
137PUT /zones/{zone_id}/snippets/{snippet_name}
138Content-Type: multipart/form-data
139 
140[email protected]
141metadata={"main_module":"snippet.js"}
142```
143 
144### Delete Snippet
145```bash
146DELETE /zones/{zone_id}/snippets/{snippet_name}
147```
148 
149### List Snippet Rules
150```bash
151GET /zones/{zone_id}/rulesets/phases/http_request_snippets/entrypoint
152```
153 
154### Update Snippet Rules
155```bash
156PUT /zones/{zone_id}/snippets/snippet_rules
157Content-Type: application/json
158 
159{
160  "rules": [{
161    "description": "Apply snippet",
162    "enabled": true,
163    "expression": "http.host eq \"example.com\"",
164    "snippet_name": "my_snippet"
165  }]
166}
167```
168 
169## Available APIs in Snippets
170 
171### ✅ Supported
172- `fetch()` - HTTP requests (2-5 subrequests per plan)
173- `Request` / `Response` - Standard Web APIs
174- `URL` / `URLSearchParams` - URL manipulation
175- `Headers` - Header manipulation
176- `TextEncoder` / `TextDecoder` - Text encoding
177- `crypto.subtle` - Web Crypto API (hashing, signing)
178- `crypto.randomUUID()` - UUID generation
179 
180### ❌ Not Supported in Snippets
181- `caches` API - Not available (use Workers)
182- `KV`, `D1`, `R2` - Storage APIs (use Workers)
183- `Durable Objects` - Stateful objects (use Workers)
184- `WebSocket` - WebSocket upgrades (use Workers)
185- `HTMLRewriter` - HTML parsing (use Workers)
186- `import` statements - No module imports
187- `addEventListener` - Use `export default { async fetch() {}` pattern
188 
189## Snippet Structure
190```javascript
191export default {
192  async fetch(request) {
193    // Your logic here
194    const response = await fetch(request);
195    return response; // or modified response
196  }
197}
198```