---
title: "DigiCert DNS API"
description: "Automate DigiCert DNS domain, record, access-control, and reporting workflows with the REST API."
source_url: https://dev.digicert.com/digicert-dns-api.html
---

DigiCert® DNS API lets you automate domain and DNS infrastructure management. Use it to manage primary and secondary domains, primary-domain records, reusable DNS settings, access controls, and reporting workflows from CI/CD pipelines and infrastructure automation systems.

## What you can do

- **Manage domains:** Create, retrieve, update, and delete primary and secondary domains, and provision or delete them in bulk.
- **Manage DNS records:** Perform full CRUD operations on supported primary-domain records and retrieve records transferred to secondary domains.
- **Configure advanced DNS:** Configure Global Traffic Director (GTD)-based routing, SOA records, TSIG keys, IP sets, and nameserver sets.
- **Control access:** Manage API keys, user and group assignments, roles, permissions, and resource groups.
- **Monitor and report:** Check domain health, query activity logs, and track usage, quotas, and accounting statistics.


> **Tip**
>
> See the [API reference](https://dev.digicert.com/md/digicert-dns-api/api-reference-resolved.md) for the complete list of endpoints, request parameters, and response schemas.


## Authentication

The DigiCert DNS API uses a two-step authentication flow. Exchange an API key for a JSON Web Token (JWT), then send that token as a bearer token with each request to the manager API.

1. Generate an API key from the DigiCert DNS manager. API keys use the format `<prefix_identifier>.<secretkey>`.
1. Send the API key to the authentication service's `/auth/login` endpoint to receive a JWT access token.

```bash
curl -X POST https://authentication.digicertdns.com/v1/auth/login \
  -H "Authorization: Bearer <prefix_identifier>.<secretkey>"
```

Include the returned `access_token` in the `Authorization` header of all other requests:

```bash
curl -X GET https://manager.digicertdns.com/v1/domains/primary \
  -H "Authorization: Bearer <access_token>"
```


> **Note**
>
> Access tokens are valid for one hour (`expires_in: 3600`). Reuse the token until it expires, then request a new token from `/auth/login`.


## Base URLs

The API uses separate production hosts for authentication and resource operations.

| Purpose | Base URL | Operations |
| --- | --- | --- |
| Authentication | `https://authentication.digicertdns.com/v1` | `POST /auth/login` |
| Manager API | `https://manager.digicertdns.com/v1` | All other operations |

Append the endpoint path to the appropriate base URL. For example, use `https://manager.digicertdns.com/v1/domains/primary` to list primary domains.

## Primary and secondary domains

DigiCert DNS manages two types of domains. The type determines the source of the zone data and how records are updated.

| Type | Description | How records are managed |
| --- | --- | --- |
| **Primary** | DigiCert DNS is the authoritative source for the zone | Create and manage records directly through the API |
| **Secondary** | An external primary nameserver is the source of the zone data | Retrieve records that DigiCert DNS receives through AXFR; records are read-only through the API |

IP sets define zone-transfer and notification addresses. Primary IP sets use `transferTo` and `notifyTo` addresses for external secondary servers. Secondary IP sets use `transferFrom` and `notifyFrom` addresses for external primary servers. You can optionally associate a TSIG key with an IP set to authenticate zone transfers.

## DNS record types

Primary domains support full create, read, update, and delete operations for the following record types.

| Type | Purpose |
| --- | --- |
| **A** | Maps a hostname to an IPv4 address |
| **AAAA** | Maps a hostname to an IPv6 address |
| **CNAME** | Aliases one hostname to another |
| **MX** | Directs mail to the responsible mail servers |
| **NS** | Delegates a zone to authoritative nameservers |
| **TXT** | Stores arbitrary text, such as SPF or domain-verification values |
| **SRV** | Advertises the location of a service |
| **PTR** | Maps an IP address to a hostname for reverse lookups |
| **CAA** | Specifies which certificate authorities can issue certificates for the domain |

Use `POST /domains/primary/{domainId}/records/bulk/delete` to delete selected records from a primary domain in a single request. To delete all records, use `DELETE /domains/primary/{domainId}/records` with the required `confirmDeleteAll` query parameter.

## Advanced DNS features

- **GTD locations:** Enable GTD on primary domains, associate records with geographic locations, and retrieve available GTD locations.
- **SOA records:** Manage authoritative-zone settings, including the primary nameserver, serial, refresh, retry, expire, TTL, and negative-cache values.
- **TSIG keys:** Create, retrieve, update, and delete shared keys used to authenticate zone transfers.
- **IP sets:** Manage reusable transfer and notification address lists for primary and secondary domains.
- **Nameservers:** List available nameservers and retrieve their details.
- **Nameserver sets:** Create and reuse nameserver sets to apply consistent delegation to primary domains.

## Access management

DigiCert DNS provides role-based access controls for users, service API keys, and DNS resources.

- **API keys:** Generate, retrieve, update, rotate, disable, and delete user or service API keys.
- **Users:** Retrieve user details and effective resource groups, and bulk-update role and user-group assignments.
- **User groups:** Organize users and service API keys and manage group membership.
- **User roles:** Define permissions and assign roles directly to users or when associating user groups with resource groups.
- **Resource groups:** Group resources and associate user groups with roles to scope access.

## Monitoring and reporting

- **Health:** Check the health of primary and secondary domains, including nameserver, AXFR, and zone-transfer status.
- **Activity log:** Retrieve a log of account activity for auditing and troubleshooting.
- **Usage statistics:** Track daily and monthly usage for individual domains or across all domains.
- **Accounting:** Return current quotas, limits, and overall usage for the account.
- **Reporting:** Retrieve reports for top domains and API key counts.

## Important considerations

- **Reuse access tokens.** Cache each token for reuse during its one-hour lifetime rather than calling `/auth/login` before every request.
- **Secondary domains depend on the external primary.** Records for secondary domains are not editable through the API. They reflect whatever transfers in from the external primary nameserver.
- **Use IP sets for zone transfers.** Configure transfer and notification addresses for the appropriate direction. Associate a TSIG key when you want to authenticate transfers.
- **Use bulk endpoints for scale.** Provision or delete multiple domains and delete selected records in a single request instead of iterating one at a time.


> **Warning**
>
> Deleting a primary or secondary domain can return `202 Accepted` when the request is accepted for processing or `204 No Content` after successful deletion. Treat `202` as acceptance of the request, not as confirmation that deletion is complete. Confirm the domain's state before starting dependent operations.


## Common operations

| Method | Endpoint | Description |
| --- | --- | --- |
| POST | `/auth/login` | Exchange an API key for a JWT access token |
| GET | `/domains/primary` | List all primary domains |
| POST | `/domains/primary` | Create a new primary domain |
| POST | `/domains/primary/bulk` | Provision multiple primary domains in bulk |
| GET | `/domains/primary/{domainId}/records` | List all records for a primary domain |
| POST | `/domains/primary/{domainId}/records/A` | Create an A record for a primary domain |
| PUT | `/domains/primary/{domainId}/records/A/{recordId}` | Update a specific A record |
| GET | `/domains/secondary` | List all secondary domains |
| POST | `/tsig` | Create a TSIG key |
| GET | `/ipsets/primary` | List IP sets for primary domains |
| POST | `/accessmanagement/api-key` | Generate a new API key |
| POST | `/accessmanagement/api-key/{apiKeyId}/rotate` | Rotate an existing API key |
| GET | `/health/primary/{domainId}/health` | Return the health status of a primary domain |
| GET | `/activitylog` | Retrieve the account activity log |
| GET | `/accounting/quota` | Return the current usage quota |

## In this section

- [API reference (Resolved)](https://dev.digicert.com/md/digicert-dns-api/api-reference-resolved.md) — OpenAPI reference documentation for DigiCert® DNS (Resolved)
- [API reference (Unresolved)](https://dev.digicert.com/md/digicert-dns-api/api-reference-unresolved.md) — OpenAPI reference documentation for DigiCert® DNS (Unresolved)