List registered domains together with key portfolio details such as owner label, DNSSEC status, renewal status, and expiry date. Supports text search, filtering, sorting, and pagination.

Delegates the domain to one of the account's vanity nameserver sets (`vanity_set_id`), or reverts it to the regfish standard nameservers (`vanity_set_id: null`). Free-form nameservers are intentionally NOT supported on this endpoint — externally hosted delegations must be managed in the regfish dash. Guarded by the Domain-Guardian (`ns_change` rule class), domain status checks (pending transfer, cancellation) and a daily per-domain change limit.

Check whether a domain is still registrable. Answered from the regfish lookup service (RDAP/WHOIS against the registries) — the same source that powers the domain search on regfish.de, not the account database. This endpoint deliberately works on **any** domain, not just the ones in the account: the whole point is to ask about domains nobody owns yet. A check that cannot be completed (registry unreachable, timeout) returns `502` rather than reporting the domain as taken — guessing here would cost the customer a registration. Rate limit: 60 checks per minute and API key.

Retrieve details for a single registered domain — same field semantics as the domain list plus the currently delegated nameservers.

Returns the current nameserver delegation of the domain (mode `standard`, `vanity`, or `external`) together with the vanity nameserver sets available on the account.

Generates the transfer authorization code (AuthInfo) for the domain at the registry. The code enables an outbound transfer — request it only on the domain owner's explicit demand. Guarded by the Domain-Guardian (`authinfo` rule class) and limited to 3 requests per domain and 10 per account per day — the account limit is what bounds a bulk harvest across the whole portfolio. Every issued code is recorded in the domain guard log (outcome `issued`), as is every refusal.

List DNS zones with SOA data, delegated nameservers, DNSSEC status, and record counts.

Retrieve the complete DNS zone for the specified domain. The response includes SOA metadata, delegated nameservers, DNSSEC status, record counts, and all records stored in the zone, including `NS` records.

Export the specified zone as a BIND-compatible zone file. Non-standard `ALIAS` records are included as comments and, when possible, as resolved `A` records.

List all DNS records stored in the zone for the specified domain.

Retrieve details about a specific Resource Record (`rrid`).

Create a new DNS record and automatically detect the zone based on the `fqdn` specified in the `name` parameter.

Update a DNS record and automatically detect the record based on the `name` and `type` specified in the parameters. If you want to update the `name` or `type` attribute, please refer to the `PATCH /dns/rr/{rrid}` endpoint.

Update a specific Resource Record (`rrid`). This is useful for modifying the record’s name or type, or when managing multiple records with the same name and type combination.

Delete a specific Resource Record (`rrid`).

Get a web hosting package

Returns the public key id, the granted permissions (`null` = legacy key with full access), and the customer id of the authenticated API key. Used by the regfish MCP server and other integrations for capability discovery.

Lists the databases of the package. Credentials are never returned — database passwords are available only in the regfish dash.

List domain aliases of a hosting package

Lists the customer's web hosting packages with plan, status, PHP version and counts of aliases and databases.

Retrieve the current DNSSEC configuration and status for the specified domain. Important response fields: - `desired_state`: the target DNSSEC state - `live_state`: the last state observed from the registry and delegation checks - `dnssec_state`: high-level status for quick status checks (`active`, `pending`, `inactive`) - `pending_job`: the current DNSSEC transition job, if processing is still in progress DNSSEC changes can be asynchronous, so `desired_state` and `live_state` may differ temporarily.

Enable, disable, or update registry DNSSEC for the specified domain. Use `mode=regfish` only when the domain uses regfish authoritative nameservers. Use `mode=external` only when DNSSEC data must be supplied for external nameservers. Use `mode=none` together with `state=disabled` to disable registry DNSSEC. The response may already be final, or it may include a `pending_job` while the registry or DNS delegation is still converging. If the update cannot be completed, the response returns the last stable DNSSEC state.

Refresh registry DNSSEC state and verify whether delegation is visible. This endpoint is useful after asynchronous registry processing or delayed DS/DNSKEY delegation. A successful response can still be `pending` when the target state has not propagated completely yet.

Retrieve recent registry DNSSEC jobs for the specified domain.

Cancel a currently pending DNSSEC activation or, for regfish-managed nameservers, a pending DNSSEC deactivation. If no cancellable transition exists, the request fails with `409`.