Dommate REST API

Generate an API token at /api-keys (requires login). Tokens look like dom_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. They are shown once at creation time; we only store the SHA-256 hash. Lost tokens cannot be recovered — create a new one.

curl -H "Authorization: Bearer dom_xxxxxxxx" \
     https://api.dommate.com/api/v1/domains

Every request must send Authorization: Bearer dom_<token>. Cookie sessions are not accepted on /api/v1/* — this prevents accidental cross-site request forgery if a logged-in user follows an attacker-controlled link.

Tokens have no expiry but you should rotate them periodically. Revoke instantly from the dashboard; clients using a revoked token start getting 401 invalid_api_key within seconds.

Base: https://api.dommate.com/api/v1. We promise breaking-changes get a new version path (/api/v2); v1 stays stable until a 6-month deprecation window after v2 ships. Watch the changelog for non-breaking additions.

• Read endpoints (GET): 60 requests/minute/key
• Write endpoints (POST / PATCH / DELETE): 30 requests/minute/key
• Daily write cap: 500 writes/day/key

Exceeding any limit returns 429 rate_limited. Use multiple keys for independent rate buckets if you run several integrations.

All non-2xx responses follow the same envelope:

{
  "error": {
    "code": "string_error_code",
    "message": "Human-readable explanation"
  }
}

Common codes:

• missing_api_key / invalid_api_key — auth failure (401)
• not_found— resource doesn't exist or doesn't belong to you (404)
• not_approved — domain still pending or rejected (409)
• quota_exceeded — DNS record count for the domain hit the age-tier cap (409)
• mx_locked / ns_locked — special record type requires admin unlock (403)
• rate_limited — too many requests (429)
• dnspod_failed — upstream DNS provider rejected the change (502)

List domains

Returns all your domains regardless of status. Each item has id, suffix, label, FQDN, status, expiry, etc.

curl -H "Authorization: Bearer dom_..." \
     https://api.dommate.com/api/v1/domains

{
  "items": [
    {
      "id": 12,
      "suffix": "net.rich",
      "label": "alice",
      "fqdn": "alice.net.rich",
      "status": "approved",
      "created_at": "2026-04-30T08:00:00Z",
      "approved_at": "2026-04-30T08:00:30Z",
      "expires_at": "2027-04-30T08:00:00Z",
      "mx_unlocked": false,
      "ns_unlocked": false
    }
  ]
}

Get one domain

List DNS records

Includes current quota state, MX/NS lock status. Same response shape as the dashboard uses.

Create DNS record

curl -X POST -H "Authorization: Bearer dom_..." \
     -H "Content-Type: application/json" \
     -d '{"type":"A","name":"www","content":"203.0.113.1","ttl":600}' \
     https://api.dommate.com/api/v1/domains/12/records

Body fields: type (A, AAAA, CNAME, TXT, MX, NS, SRV, CAA), name (subdomain or empty for apex), content, ttl (seconds), and priority for MX.

Update DNS record

Body: content, ttl, optional priority. type and name cannot be changed — delete and recreate.

Delete DNS record

Returns 204 No Content on success. Idempotent — deleting an already-deleted record returns 404.

• Creating / renewing / revoking domains — use the dashboard. We want a human in the loop for these high-stakes operations.
• OAuth verifications, score management, referrals — dashboard only.
• Admin operations (approve, suffix config) — dashboard only; admin actions are not exposed via API.

Bug reports / feature requests: email contact@dommate.com with subject prefix [API]. For security issues, see .well-known/security.txt.