edge

The gateway routes floo serves for an app and the IP/CIDR policy in front of them. Start here when a host, path, service, access mode, or client IP behaves unexpectedly.

routes list

Hosts, path prefixes, target services, and effective access policy.

floo edge routes list --app my-app
floo edge routes list --app my-app --env prod

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--env ENV`	Environment filter: `dev`, `prod`, or `preview`. Omit for all routes

JSON output

{
  "success": true,
  "data": {
    "routes": [
      {
        "id": "route_123",
        "host": "api.example.com",
        "path_prefix": "/",
        "env_id": "env_prod",
        "env": "prod",
        "env_slug": "prod",
        "service_id": "svc_api",
        "service_name": "api",
        "service_type": "api",
        "access_mode": "accounts",
        "api_key_enabled": true,
        "required_scope": "api:read",
        "source": "custom_domain",
        "source_of_truth": "gateway_routes",
        "propagation_status": "unknown",
        "created_at": "2026-07-02T10:00:00Z",
        "updated_at": "2026-07-02T10:05:00Z"
      }
    ],
    "total": 1
  }
}

The output omits internal backend URLs. floo hosts and custom domains are the public contract.

Troubleshooting

If an app is public when you expected auth, run:

floo edge routes list --app my-app --env prod --json 2>/dev/null | jq '.data.routes[] | {host, path_prefix, access_mode, api_key_enabled, required_scope}'

If a custom domain points at the wrong service, compare source, service_name, and path_prefix:

floo edge routes list --app my-app --json 2>/dev/null | jq '.data.routes[] | {host, path_prefix, service_name, source}'

source_of_truth: "gateway_routes" means the route was read from the serving table the gateway consumes. propagation_status is always "unknown": the API does not report per-worker gateway cache freshness, so use the row’s updated_at as the serving-table timestamp.

policy get

Show the IP/CIDR edge policy for one environment: the ordered allow/deny rules, the default action, and whether the policy is enabled. The policy is declared in floo.app.toml under [edge] and applied on deploy; this command is read-only. Previews inherit the dev policy.

floo edge policy get --env prod
floo edge policy get --app my-app --env dev --json

Edge policy for my-app in prod: enabled, default deny.
  #  Action  CIDR
  1  allow   203.0.113.0/24
  2  deny    198.51.100.7/32

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--env ENV`	Required. `dev` or `prod`; previews inherit `dev`

JSON output

{
  "success": true,
  "data": {
    "id": "policy_123",
    "app_id": "a1b2c3d4-...",
    "env": "prod",
    "rules": [
      { "action": "allow", "cidr": "203.0.113.0/24" },
      { "action": "deny", "cidr": "198.51.100.7/32" }
    ],
    "default_action": "deny",
    "enabled": true,
    "created_at": "2026-07-02T10:00:00Z",
    "updated_at": "2026-07-02T10:05:00Z"
  }
}

With no policy for the environment, every IP is admitted and the command prints No edge policy for my-app in prod with data of {"policy": null, "env": "prod"}. A stored policy with enabled: false is not enforced.

policy check

Evaluate one client IP against the environment’s policy: first-match rules, then the default action. The gateway is the authoritative enforcer; this mirrors its logic to debug a rejection without sending traffic.

floo edge policy check 203.0.113.7 --env prod
floo edge policy check 2001:db8::1 --env dev --json

203.0.113.7 in my-app/prod: ADMITTED (matched rule allow 203.0.113.0/24).

Arguments

Argument	Description
`IP`	The client IP to test, IPv4 or IPv6

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--env ENV`	Required. `dev` or `prod`; previews inherit `dev`

JSON output

{
  "success": true,
  "data": {
    "ip": "203.0.113.7",
    "env": "prod",
    "admitted": true,
    "enforced": true,
    "matched_rule": { "action": "allow", "cidr": "203.0.113.0/24" },
    "reason": "rule_match"
  }
}

reason is rule_match, default_action, policy_disabled, or no_policy. enforced is false and admitted is true for the last two. An IPv4-mapped IPv6 address is evaluated as its IPv4 form, matching the gateway.

Errors

Code	Meaning
`INVALID_FORMAT`	The argument is not an IPv4 or IPv6 address

CLI

Config

API

routes list

Flags

JSON output

Troubleshooting

policy get

Flags

JSON output

policy check

Arguments

Flags

JSON output

Errors

​routes list

​Flags

​JSON output

​Troubleshooting

​policy get

​Flags

​JSON output

​policy check

​Arguments

​Flags

​JSON output

​Errors

routes list

Flags

JSON output

Troubleshooting

policy get

Flags

JSON output

policy check

Arguments

Flags

JSON output

Errors