API endpoint reference
Find each public endpoint's parameters, required permissions and responses.
BlazingFast Customer API
Automate account billing, VPS and dedicated servers, DNS and Website Protection, TCP Proxy, domains, SSH keys, firewall policies and storage. Use an official SDK for HMAC-signed requests, or a bearer-mode API key. Generic OpenAPI-generated clients do not implement BlazingFast HMAC signing automatically. Pagination is endpoint-specific: follow the documented page/limit, cursor/next_cursor or offset/next_offset model. limit is the canonical page-size parameter; page_size and pageSize are deprecated compatibility aliases only where documented. Begin by reading the resource, confirm changes, and inspect the result or returned task. Draft order creation does not charge the account. Atomic deployment is the documented exception: order + full final order amount paid from account balance + queued provisioning. Payment is not successful provisioning; accepted is not completed. Access depends on key scopes and account permissions.
DNS
Create an empty zone or use a template, JSON records or a zone file. Preview imports, manage DNS records, and inspect record protection and country policies. A DNS zone is not a domain registration.
Authentication
SignedAuth
SignedAuth is represented by x-api-key for discovery only. Generic OpenAPI-generated clients do not automatically implement BlazingFast HMAC signing. Use BearerAuth with a bearer-mode credential or an official SDK, unless you implement the signing algorithm manually. Signed-key mode requires all five headers. SDKs send x-api-key, x-ts (Unix seconds), x-nonce, x-content-sha256 (Base64 SHA-256 of the exact body), and x-signature (Base64 HMAC-SHA256). Custom signing is explained in the API authentication guide. Every HTTP attempt needs a fresh timestamp and nonce; an action retry retains its original idempotency key and payload. Key expiry, IP restrictions, account permissions and scopes still apply.
BearerAuth
Alternative mode for integrations that prefer Authorization: Bearer <prefix.secret>. Key status, expiry, scope checks, IP policy, and rate limits still apply.
Endpoints
/v1/dns/templates
Save DNS template
Operation ID: dnsTemplateCreate
Creates a reusable DNS template from a zone-file fragment.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 64
},
"zone_file": {
"type": "string",
"minLength": 1,
"maxLength": 500000
}
},
"required": [
"name",
"zone_file"
],
"additionalProperties": false
}Responses
Created DNS template.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dns/templates" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","zone_file":"example"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"template": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example template",
"zoneFile": "@ 300 IN A 192.0.2.10",
"createdAt": "2026-10-01T00:00:00.000Z",
"updatedAt": "2026-10-01T00:00:00.000Z",
"system": false,
"visibility": "private"
}
}Illustrative values, not a live result.
/v1/dns/zones
Create or preview DNS zone
Operation ID: createDnsZone
Body: name; at most one of templateId UUID, zoneFile text (100000 characters max), or records array ({name,type,ttl,values}, max 200 sets, 50 values/set, TTL 1–86400 seconds). Omit all sources for an empty zone. dryRun:true validates and returns records/notes without creating or reserving a zone; requires an existing active DNS service. Use separate Idempotency-Keys for preview and creation. Platform apex NS replaces imported NS and SOA is managed automatically. Zone files support IN records, relative names, $ORIGIN, $TTL and multiline records; external includes/generation and foreign owners are rejected. Resolve template names via GET /v1/dns/templates and inspect their details; templates must be owned or public. Existing zones are never overwritten. A records may be proxied by the existing protection policy. Does not register domains or change registrar delegation.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"template_id": {
"type": "string",
"format": "uuid"
},
"zone_file": {
"type": "string",
"minLength": 1,
"maxLength": 100000
},
"records": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"type": {
"type": "string",
"enum": [
"A",
"AAAA",
"CNAME",
"MX",
"TXT",
"NS",
"SOA",
"PTR",
"SRV",
"CAA",
"SSHFP",
"TLSA",
"NAPTR",
"LOC",
"DS",
"DNSKEY"
]
},
"ttl": {
"type": "integer",
"minimum": 1,
"maximum": 86400
},
"values": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"maxLength": 4096
},
"minItems": 1,
"maxItems": 50
}
},
"required": [
"name",
"type",
"values"
],
"additionalProperties": false
},
"maxItems": 200
},
"dry_run": {
"type": "boolean"
}
},
"required": [
"name"
],
"additionalProperties": false,
"description": "At most one of templateId, zoneFile or records. Omit all three for an empty zone. Names and record ownership are validated by the backend."
}Responses
Created zone, or normalized records and notes for dryRun.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dns/zones" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"zoneId": "00000000-0000-4000-8000-000000000001",
"zone": null
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/simple
Save simple record
Operation ID: dnsRecordsSimpleSet
Creates or replaces a simplified DNS record set.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"append",
"replace"
]
},
"record": {
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"type": {
"type": "string",
"minLength": 1,
"maxLength": 16
},
"ttl": {
"type": "integer",
"minimum": 1,
"maximum": 86400
},
"values": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1,
"maxItems": 50
},
"protect": {
"type": "boolean"
}
},
"required": [
"name",
"type",
"values"
],
"additionalProperties": false
}
},
"required": [
"record"
],
"additionalProperties": false
}Responses
Simple record upsert result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/simple" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"record":{"name":"example","type":"example","values":["example"]}}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"appliedTo": "powerdns",
"changeId": "00000000-0000-4000-8000-000000000002"
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records
Apply rrset changes
Operation ID: dnsRrsetsPatch
Applies advanced rrset changes using REPLACE or DELETE style operations.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"rrsets": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"type": {
"type": "string",
"minLength": 1,
"maxLength": 16
},
"ttl": {
"type": "integer",
"minimum": 0,
"maximum": 2147483647
},
"changetype": {
"type": "string",
"enum": [
"REPLACE",
"DELETE"
]
},
"records": {
"type": "array",
"items": {
"type": "object",
"properties": {
"content": {
"type": "string"
},
"disabled": {
"type": "boolean"
}
},
"required": [
"content"
],
"additionalProperties": false
}
}
},
"required": [
"name",
"type"
],
"additionalProperties": false
}
}
},
"required": [
"rrsets"
],
"additionalProperties": false
}Responses
Raw rrset patch result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"rrsets":[{"name":"example","type":"example"}]}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"appliedTo": "powerdns",
"changeId": "00000000-0000-4000-8000-000000000002"
}Illustrative values, not a live result.
/v1/dns/templates/{id}
Remove DNS template
Operation ID: dnsTemplateDelete
Deletes a DNS template.
Parameters
id- DNS template UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS template deletion result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/dns/templates/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). DNS template UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/dns/zones/{name}
Remove DNS zone
Operation ID: dnsZoneDelete
Deletes a DNS zone.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS zone deletion result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/simple
Remove simple record
Operation ID: dnsRecordsSimpleDelete
Deletes a simplified DNS record set from the zone.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"type": {
"type": "string",
"minLength": 1,
"maxLength": 16
}
},
"required": [
"name",
"type"
],
"additionalProperties": false
}Responses
Simple record deletion result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X DELETE "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/simple" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","type":"example"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"appliedTo": "powerdns",
"changeId": "00000000-0000-4000-8000-000000000002"
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/protection
Change DNS record protection
Operation ID: dnsRecordProtectionSet
Toggle mitigation only; preserves proxy routing, origin addresses, DNS values and TTL. Enabling requires an active entitlement or eligible origin IPs. Send an Idempotency-Key. MCP requests require dashboard approval. A failed/unconfirmed response may have changed provider state; never assume it did not execute.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"enabled": {
"type": "boolean"
}
},
"required": [
"name",
"enabled"
],
"additionalProperties": false
}Responses
Confirmed mitigation state and audit change ID, or stateUnknown on an unconfirmed update.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/protection" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","enabled":true}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"fqdn": "example.com",
"type": "A",
"proxied": true,
"protection": true,
"stateUnknown": false,
"changeId": "00000000-0000-4000-8000-000000000002"
}Illustrative values, not a live result.
/v1/dns/templates/{id}
Edit DNS template
Operation ID: dnsTemplateUpdate
Updates the name or zone-file content of an existing template.
Parameters
id- DNS template UUID.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"name": {
"type": "string",
"minLength": 1,
"maxLength": 64
},
"zone_file": {
"type": "string",
"minLength": 1,
"maxLength": 500000
}
},
"additionalProperties": false
}Responses
Updated DNS template.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PATCH "https://api.blazingfast.io/v1/dns/templates/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"name":"example","zone_file":"example"}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). DNS template UUID.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"template": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example template",
"zoneFile": "@ 300 IN A 192.0.2.10",
"createdAt": "2026-10-01T00:00:00.000Z",
"updatedAt": "2026-10-01T00:00:00.000Z",
"system": false,
"visibility": "private"
}
}Illustrative values, not a live result.
/v1/dns/zones/{name}/history/{changeId}/restore
Restore DNS change
Operation ID: dnsHistoryRestore
Restores the state before the selected applied change, including protection and origin addresses. Requires acknowledgement, a stable retry key and current entitlements. A locked or ambiguous zone is not modified.
Parameters
name- Zone or domain name.
changeId- Owned DNS change UUID.
Idempotency-Key- Stable retry key.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"acknowledge": {
"type": "boolean",
"const": true,
"enum": [
true
]
}
},
"required": [
"acknowledge"
],
"additionalProperties": false
}Responses
Restored DNS/protection state or already-current result.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X POST "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/history/${BF_PATH_CHANGE_ID}/restore" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"acknowledge":true}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_PATH_CHANGE_ID — path parameter changeId (required). Owned DNS change UUID.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Stable retry key.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"appliedTo": "live_dns",
"changeId": "00000000-0000-4000-8000-000000000001",
"restoredFromId": "00000000-0000-4000-8000-000000000002"
}Illustrative values, not a live result.
/v1/dns/zones/{name}/country-policy
Replace website country policy
Operation ID: dnsCountryPolicySet
Body: record and policy containing mode (off/allow/deny), countries (ISO alpha-2), optional unknown (allow/deny) and whitelist_bypass. Replacement can block visitors. Send an Idempotency-Key. Check saved and synchronized independently.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
application/json schema
{
"type": "object",
"properties": {
"record": {
"type": "string",
"minLength": 1,
"maxLength": 253
},
"policy": {
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"off",
"allow",
"deny"
]
},
"countries": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 249,
"default": []
},
"unknown": {
"type": "string",
"enum": [
"allow",
"deny"
]
},
"whitelist_bypass": {
"type": "boolean",
"default": false
}
},
"required": [
"mode"
],
"additionalProperties": false
}
},
"required": [
"record",
"policy"
],
"additionalProperties": false,
"description": "Use valid ISO alpha-2 country codes. allow/deny requires at least one country; off disables the policy."
}Responses
Saved and synchronized policy.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X PUT "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/country-policy" -H "Authorization: Bearer $BF_API_BEARER" -H "Idempotency-Key: $BF_REQUEST_KEY" -H 'Content-Type: application/json' --data '{"record":"example","policy":{"mode":"off"}}'Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
BF_REQUEST_KEY — header parameter Idempotency-Key (required). Reuse the same key and payload for retries of one intended operation.
Replace example body values with your configuration. Discover compatible profile IDs and account-owned key IDs before use.
Review the target and payload before running. For a payment, check the invoice and outstanding amount first. Reuse BF_REQUEST_KEY for retries of the same operation; check status after an interrupted request.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"hostname": "example.com",
"policy": {
"mode": "off",
"countries": [],
"unknown": "allow",
"whitelist_bypass": true
},
"saved": true,
"synchronized": true
}Illustrative values, not a live result.
/v1/dns/templates
Browse DNS templates
Operation ID: listDnsTemplates
Returns reusable DNS templates that can be applied during zone creation.
Parameters
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS template list.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/templates" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"templates": [
{
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example template",
"createdAt": "2026-10-01T00:00:00.000Z",
"updatedAt": "2026-10-01T00:00:00.000Z",
"system": false,
"visibility": "private",
"isHidden": false
}
]
}Illustrative values, not a live result.
/v1/dns/templates/{id}
Open DNS template
Operation ID: getDnsTemplate
Returns an owned or public system template by name or UUID. Name matching is case-insensitive and checks your templates first; public system defaults are a fallback. Other accounts are excluded. Only duplicate names within the selected scope return template_identifier_ambiguous. Edit/delete routes still require UUIDs.
Parameters
id- Your template name (cpanel2 or My template) or UUID; URL-encode spaces and Unicode.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS template detail.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/templates/${BF_PATH_ID}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_ID — path parameter id (required). Your template name (cpanel2 or My template) or UUID; URL-encode spaces and Unicode.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"template": {
"id": "00000000-0000-4000-8000-000000000001",
"name": "Example template",
"zoneFile": "@ 300 IN A 192.0.2.10",
"createdAt": "2026-10-01T00:00:00.000Z",
"updatedAt": "2026-10-01T00:00:00.000Z",
"system": false,
"visibility": "private"
}
}Illustrative values, not a live result.
/v1/dns/zones
Browse DNS zones
Operation ID: listDnsZones
Returns owned customer DNS zones. Use view=summary for a lightweight, read-only inventory with name search before pagination; it returns total, limit, offset and zones. The default legacy view remains unchanged. Summary results sort by zone name and do not contact nameservers or change billing links.
Parameters
q- Optional zone name search filter.
sort- Optional legacy-view sort key; summary always sorts by name.
view- Use summary for lightweight paginated zone cards.
limit- Summary only: maximum zones returned.
offset- Summary only: number of matching zones to skip.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS zone list. Summary adds total, limit and offset; zones contain name, status and createdAt only.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_QUERY_Q — query parameter q (optional). Optional zone name search filter. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_SORT — query parameter sort (optional). Optional legacy-view sort key; summary always sorts by name. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_VIEW — query parameter view (optional). Use summary for lightweight paginated zone cards. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_LIMIT — query parameter limit (optional). Summary only: maximum zones returned. Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_OFFSET — query parameter offset (optional). Summary only: number of matching zones to skip. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"zones": [
{
"name": "example.com",
"status": "active",
"createdAt": "2026-10-01T00:00:00.000Z"
}
]
}Illustrative values, not a live result.
/v1/dns/zones/{name}
Open DNS zone
Operation ID: getDnsZone
Returns one DNS zone and its customer-facing detail view.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS zone detail.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"domain": {
"name": "example.com",
"zoneId": "00000000-0000-4000-8000-000000000001",
"status": "active",
"adminLock": false,
"createdAt": "2026-10-01T00:00:00.000Z",
"updatedAt": "2026-10-01T00:00:00.000Z"
}
}Illustrative values, not a live result.
/v1/dns/zones/{name}/country-policy
Read website country policy
Operation ID: getDnsCountryPolicy
For an owned, active, proxied A record.
Parameters
name- Zone or domain name.
record- Record name; default @.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Saved policy.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/country-policy" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_QUERY_RECORD — query parameter record (optional). Record name; default @. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"hostname": "example.com",
"policy": {
"mode": "off",
"countries": [],
"unknown": "allow",
"whitelist_bypass": true
}
}Illustrative values, not a live result.
/v1/dns/zones/{name}/history
List DNS change history
Operation ID: dnsHistory
Owned-zone changes with DNS values and protection state. Stable cursor continuation; only this owner’s history is returned.
Parameters
name- Zone or domain name.
limit- Maximum changes (default 10; 1–50).
cursor- nextCursor returned by the preceding response; scoped to this owner and zone.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
DNS change history with nextCursor.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/history" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_QUERY_LIMIT — query parameter limit (optional). Maximum changes (default 10; 1–50). Supply the unencoded value; only required query parameters are included in the snippet.
BF_QUERY_CURSOR — query parameter cursor (optional). nextCursor returned by the preceding response; scoped to this owner and zone. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"items": [
{
"id": "00000000-0000-4000-8000-000000000002",
"action": "records.update",
"status": "applied",
"actorType": "userapi",
"restoredFromId": null,
"changes": [
{
"name": "example.com.",
"type": "A",
"changetype": "REPLACE",
"beforeTtl": 300,
"afterTtl": 300,
"beforeValues": [
"192.0.2.9"
],
"afterValues": [
"192.0.2.10"
]
}
],
"protectionChanges": [],
"beforeRecordCount": 3,
"afterRecordCount": 3,
"createdAt": "2026-10-01T00:00:00.000Z"
}
],
"nextCursor": null
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records
Browse raw rrsets
Operation ID: getDnsRrsets
Returns advanced rrset data for customers that need lower-level DNS editing.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Raw rrset list.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"source": "powerdns",
"rrsets": [
{
"name": "example.com.",
"type": "A",
"ttl": 300,
"records": [
{
"content": "192.0.2.10",
"disabled": false
}
]
}
]
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/config
Read Website Protection record settings
Operation ID: dnsRecordConfig
Read-only safe HTTPS/origin and custom-loader flags for an active, owned, proxied A record. No service UUID or domain registration is needed. Unknown flags are null; no raw provider configuration, scripts or keys are exposed.
Parameters
name- Zone or domain name.
name- Record name, e.g. @ or www.; default @.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Safe Website Protection settings.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/config" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_QUERY_NAME — query parameter name (optional). Record name, e.g. @ or www.; default @. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"domain": "example.com",
"name": "www",
"settings": {
"ssl_schema": "https",
"force_ssl": "1",
"ssl": "ecc",
"custom_loader": "0"
}
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/protection
Read DNS record protection
Operation ID: getDnsRecordProtection
Read saved mitigation state for an owned, active, proxied A record, including external origins. No hosting service ID required. Null protection/stateUnknown must not be interpreted as disabled.
Parameters
name- Zone or domain name.
name- A record name; default @.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Mitigation state, proxy state, origin IPs and synchronization status. No internal provider configuration.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/protection" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_QUERY_NAME — query parameter name (optional). A record name; default @. Supply the unencoded value; only required query parameters are included in the snippet.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"fqdn": "example.com",
"type": "A",
"proxied": true,
"protection": true,
"originValues": [
"192.0.2.10"
],
"ttl": 300,
"stateUnknown": false,
"pending": false,
"lastSyncedAt": "2026-10-01T00:00:00.000Z"
}Illustrative values, not a live result.
/v1/dns/zones/{name}/records/simple
Browse simple records
Operation ID: listDnsRecordsSimple
Returns simplified DNS records for a zone.
Parameters
name- Zone or domain name.
x-client-request-id- Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
x-ts- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Unix timestamp in seconds; refresh it for every HTTP attempt. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-nonce- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Fresh nonce for every HTTP attempt; never reuse it when retrying. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-content-sha256- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 SHA-256 of the exact transmitted body bytes; hash the empty body for bodyless requests. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
x-signature- Required when using SignedAuth with x-api-key; omitted for BearerAuth. Base64 HMAC-SHA256 signature produced by the documented signing algorithm. Generic OpenAPI clients do not compute HMAC signatures; use an official SDK or implement signing manually.
Request body
No request body
Responses
Simple DNS records.
Canonical nested error envelope: use error.code, error.message, error.request_id and error.field_errors. Deprecated flat fields may be included for legacy clients. Generic server failures use service_unavailable without internal details. An interrupted connection may leave a write outcome unknown.
Request example
bash
curl --disable -sS --globoff --max-time 30 -X GET "https://api.blazingfast.io/v1/dns/zones/${BF_PATH_NAME}/records/simple" -H "Authorization: Bearer $BF_API_BEARER"Setup and request inputs
Create a bearer-mode key in Settings → API with the scopes shown above. Set BF_API_BEARER privately to its full prefix.secret value. These are request snippets, not complete applications. This page does not send requests.
Bash · cURL 7.87+. Supply URL-encoded path values; query values are encoded by cURL.
BF_PATH_NAME — path parameter name (required). Zone or domain name.
BF_HEADER_X_CLIENT_REQUEST_ID — header parameter x-client-request-id (optional). Optional client correlation label, 1–120 letters/digits/dots/underscores/colons/hyphens. Logged alongside the server request ID; never an idempotency key.
Check the HTTP status and handle errors in your application. Examples validate TLS, have a 30-second request limit, and never automatically retry or follow redirects. Run cURL on a private workstation: expanded tokens appear in process arguments, so disable shell tracing and command logging. Do not log passwords or share credential responses.
Example response · HTTP 200
json
{
"ok": true,
"service": {
"id": "00000000-0000-4000-8000-000000000001",
"status": "active",
"suspendedReason": null
},
"records": [
{
"name": "@",
"type": "A",
"ttl": 300,
"values": [
"192.0.2.10"
],
"proxied": false,
"originValues": null,
"protection": false,
"wafEligible": false,
"protectionMode": "none"
}
]
}Illustrative values, not a live result.
Errors and safe retries
Use HTTP status and error.code for decisions. The canonical envelope contains error.message, error.request_id and error.field_errors. Flat code, message, request_id, field_errors, details and status fields are legacy compatibility fields and may still appear; new integrations should read the nested error.
json
{
"ok": false,
"error": {
"code": "scope_denied",
"message": "Required scope is missing",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Error code reference
Server failures and interrupted connections
Generic API server failures intentionally omit internal error codes and provider details and use the same nested envelope with service_unavailable. An edge/network failure can also return non-JSON or no response at all.
json
{
"ok": false,
"error": {
"code": "service_unavailable",
"message": "The service is temporarily unavailable.",
"request_id": "00000000-0000-4000-8000-000000000001",
"field_errors": []
}
}Read-only GET requests can be retried with bounded backoff and jitter. SDKs perform limited retries for selected transient read failures; they do not automatically retry writes. A timeout or 5xx on a write does not prove it failed: check the resource, invoice or task before retrying. Where supported, reuse the same Idempotency-Key and identical request. Do not create a new operation key just because the response was lost.
For 429, honor the HTTP Retry-After header. SDK timeout, network_error and response_too_large codes describe client-side failures, not API error responses. For persistent errors, send support the request ID, HTTP status, method, endpoint and UTC time—never API secrets or passwords.
See error handling in PHP, Node.js, Python and GoThis reference is generated from the current OpenAPI schema and documents 182 public operations. Each operation has a stable operationId and shows its method, path, parameters, required permissions and response models. cURL is selected by default; switch to Node.js, PHP, Python or Go for native HTTP examples. Download the OpenAPI JSON for client generation.
Use the integration guide for SDK/CLI 0.1.17 installation, authentication, pagination, retries, idempotency, webhooks and workflows. Generic OpenAPI clients do not automatically implement HMAC signing; use Bearer authentication or an official SDK unless you implement signing yourself.
Current purchase and operation workflows
SDK/CLI 0.1.17 supports contract 2026-10-07.1. Read GET /v1/version and GET /v1/capabilities, then discover product purchase policies and requirements before configuring a purchase. A quote is optional: discovery can lead directly to an authorized deployment. Quotes do not reserve stock or lock prices; send an authorized max_total ceiling for the full final order amount.
Draft order creation does not charge the account. Atomic deployment is the documented exception: it combines order creation, payment of the full final order amount from account balance and queued provisioning. Paid is not ready; accepted is not completed. Service lifecycle status is separate from runtime power state.
Supported tracked deployment, VPS and dedicated writes can return a canonical operation receipt and be recovered using their original idempotency key. This does not extend recovery to every write or historical request. See HTTP, SDK, CLI and MCP examples. DNSSEC uses its separate endpoint and state contract.
Pagination is endpoint-specific. Follow each endpoint's page/limit, cursor/next_cursor or offset/next_offset contract. limit is the canonical page-size request parameter; page_size and pageSize are deprecated compatibility aliases only where documented.
For service lists, ownership and filters are applied server-side before pagination. GET /v1/services defaults to active and suspended. group_by=type groups only the current page; GET /v1/services/grouped returns the complete inventory under its documented status/type filters, with its legacy active-only default. Pass status explicitly for this compatibility endpoint; prefer /v1/services?statuses=active,suspended&group_by=type for new automation.
API errors use the canonical nested error.code, error.message, error.request_id and error.field_errors structure. Flat error fields remain legacy compatibility fields. Most CLI lifecycle --request-key flags are optional; DNSSEC enable/disable require an explicit key. Preserve generated keys for retries. Examples describe requests and responses; this page does not send API requests.
On this page
DNS
Save DNS template
Create or preview DNS zone
Save simple record
Apply rrset changes
Remove DNS template
Remove DNS zone
Remove simple record
Change DNS record protection
Edit DNS template
Restore DNS change
Replace website country policy
Browse DNS templates
Open DNS template
Browse DNS zones
Open DNS zone
Read website country policy
List DNS change history
Browse raw rrsets
Read Website Protection record settings
Read DNS record protection
Browse simple records