List registered domains together with key portfolio details such as owner label, DNSSEC status, renewal status, and expiry date. Supports text search, filtering, sorting, and pagination.

Delegates the domain to one of the account's vanity nameserver sets (`vanity_set_id`), or reverts it to the regfish standard nameservers (`vanity_set_id: null`). Free-form nameservers are intentionally NOT supported on this endpoint, externally hosted delegations must be managed in the regfish dash. Guarded by the Domain-Guardian (`ns_change` rule class), domain status checks (pending transfer, cancellation) and a daily per-domain change limit.

Check whether a domain is still registrable. Answered from the regfish lookup service (RDAP/WHOIS against the registries), the same source that powers the domain search on regfish.de, not the account database. This endpoint deliberately works on **any** domain, not just the ones in the account: the whole point is to ask about domains nobody owns yet. A check that cannot be completed (registry unreachable, timeout) returns `502` rather than reporting the domain as taken, guessing here would cost the customer a registration. Rate limit: 60 checks per minute and API key.

Retrieve details for a single registered domain, same field semantics as the domain list plus the currently delegated nameservers.

Returns the current nameserver delegation of the domain (mode `standard`, `vanity`, or `external`) together with the vanity nameserver sets available on the account.

Generates the transfer authorization code (AuthInfo) for the domain at the registry. The code enables an outbound transfer, request it only on the domain owner's explicit demand. Guarded by the Domain-Guardian (`authinfo` rule class) and limited to 3 requests per domain and 10 per account per day, the account limit is what bounds a bulk harvest across the whole portfolio. Every issued code is recorded in the domain guard log (outcome `issued`), as is every refusal.

List DNS zones with SOA data, delegated nameservers, DNSSEC status, and record counts.

Retrieve the complete DNS zone for the specified domain. The response includes SOA metadata, delegated nameservers, DNSSEC status, record counts, and all records stored in the zone, including `NS` records.

Export the specified zone as a BIND-compatible zone file. Non-standard `ALIAS` records are included as comments and, when possible, as resolved `A` records.

List all DNS records stored in the zone for the specified domain.

Retrieve details about a specific Resource Record (`rrid`).

Create a new DNS record and automatically detect the zone based on the `fqdn` specified in the `name` parameter.

Update a DNS record and automatically detect the record based on the `name` and `type` specified in the parameters. If you want to update the `name` or `type` attribute, please refer to the `PATCH /dns/rr/{rrid}` endpoint.

Update a specific Resource Record (`rrid`). This is useful for modifying the record’s name or type, or when managing multiple records with the same name and type combination.

Delete a specific Resource Record (`rrid`).

Put a question to Flossi, the regfish assistant, and get back the answer it would give in the dashboard chat. Same assistant, same knowledge base (help center articles, curated procedures, the service FAQ derived from the console itself, the legal pages and the developer documentation), same access to the account behind the API key. Ask it before describing a click path: the assistant knows the exact menu names, and those are what invented instructions get wrong. It also answers questions no article covers, because they are about this account: when a domain expires, which domains have no DNSSEC, whether anything is unpaid. Account data follows the key's own permissions. A key with domain:read gets domain answers; billing answers need billing:read, certificate answers need tls:read. Without the right the assistant leaves that part out rather than refusing the whole question. The answer is Markdown and may link places in the dashboard as relative paths (/my/...). Resolve them against dashboard_url from the response. One question at a time: the assistant runs on a single local GPU. A busy assistant answers 503, and so does one that cannot be reached. Rate limit: 10 questions per minute and API key, 20 per 10 minutes and account.

Get a web hosting package

Returns the public key id, the granted permissions (`null` = legacy key with full access), and the customer id of the authenticated API key. Used by the regfish MCP server and other integrations for capability discovery.

Lists the databases of the package. Credentials are never returned , database passwords are available only in the regfish dash.

List domain aliases of a hosting package

Lists the customer's web hosting packages with plan, status, PHP version and counts of aliases and databases.

Retrieve the current DNSSEC configuration and status for the specified domain. Important response fields: - `desired_state`: the target DNSSEC state - `live_state`: the last state observed from the registry and delegation checks - `dnssec_state`: high-level status for quick status checks (`active`, `pending`, `inactive`) - `pending_job`: the current DNSSEC transition job, if processing is still in progress DNSSEC changes can be asynchronous, so `desired_state` and `live_state` may differ temporarily.

Enable, disable, or update registry DNSSEC for the specified domain. Use `mode=regfish` only when the domain uses regfish authoritative nameservers. Use `mode=external` only when DNSSEC data must be supplied for external nameservers. Use `mode=none` together with `state=disabled` to disable registry DNSSEC. The response may already be final, or it may include a `pending_job` while the registry or DNS delegation is still converging. If the update cannot be completed, the response returns the last stable DNSSEC state.

Refresh registry DNSSEC state and verify whether delegation is visible. This endpoint is useful after asynchronous registry processing or delayed DS/DNSKEY delegation. A successful response can still be `pending` when the target state has not propagated completely yet.

Retrieve recent registry DNSSEC jobs for the specified domain.

Cancel a currently pending DNSSEC activation or, for regfish-managed nameservers, a pending DNSSEC deactivation. If no cancellable transition exists, the request fails with `409`.