# Automate domain management

Manage accessible domains with separate permissions for inventory, DNS, settings, and security audits.

Create a token for your Space in [Dashio App](https://app.dashio.net). Use the [Space and domain scopes](/developers/authentication#space-and-domains) your integration needs.

## Find a domain

Use `domains:read` to [list the domains in the token's Space](/api/operations/listDomains) and [read one domain](/api/operations/getDomain). Use the domain name from this inventory when a request requires a domain path parameter. Use `space:domains:read` to [check verification status](/api/operations/listDeveloperSpaceDomainVerifications).

## Inspect DNS and domain settings

[List DNS records](/api/operations/listDomainRecords) before making changes and [read an individual record](/api/operations/getDeveloperDomainRecord) to verify a write. Use separate scopes to read [nameservers](/api/operations/getDeveloperDomainNameservers), [DNSSEC](/api/operations/getDeveloperDomainDnssec), or [forwarding](/api/operations/getDeveloperDomainForwarding).

[Check registration](/api/operations/getDeveloperDomainRegistration) for expiration, auto-renew, and transfer-lock status. [Check transfer state](/api/operations/getDeveloperDomainTransfer) to track inbound or completed outbound transfers. Use the Domains Portal for purchases, transfer authorization, or a managed nameserver change.

## Change DNS records

Use `dns:records:write` to [create a record](/api/operations/createDeveloperDomainRecord), [replace a record](/api/operations/updateDeveloperDomainRecord), or [delete a record](/api/operations/deleteDeveloperDomainRecord) in an active managed DNS zone. For a replacement, send the complete record, including any fields you want to keep. Use the record ID from the list response. The API supports `A`, `AAAA`, `CNAME`, `MX`, `TXT`, and `CAA`. Send a relative host name, using `@` for the zone apex where supported. TTL must be 60 to 86,400 seconds.

Generate and store an `Idempotency-Key` of 16 to 128 ASCII letters, digits, underscores, or hyphens per intended change. For an identical retry within 24 hours, use the same token, key, and request. Reusing a key for a different request returns **409**.

If Dashio returns **502** with `MUTATION_UNCERTAIN`, the provider may have applied the change. Keep the `X-Mutation-Request-Id` and contact Dashio support. Wait for reconciliation before issuing another write for that domain.

## Change custom nameservers

[Replace custom nameservers](/api/operations/replaceDeveloperDomainNameservers) with `domains:nameservers:write`. Send the full delegation of two to ten distinct nameservers and public glue addresses for nameservers inside the domain. DNSSEC must be off. Persist the required `Idempotency-Key` and keep the mutation request ID if Dashio cannot confirm the provider result.

## Check a domain security audit

[Queue an audit](/api/operations/requestDomainSecurityAudit) with `domains:security:write`. Generate and store an `Idempotency-Key` for the intended audit, then reuse the key for an identical retry. Keep the returned audit ID. Use `domains:security:read` to [check the audit status](/api/operations/getDomainSecurityAudit).