Domani

Get your account details, payment status, contact info status (has_contact), and referral code. Contact info must be set before purchasing domains.

Get truthful product milestones and the next useful actions for this account. Use this after authentication instead of treating token setup as success.

Check availability and price for one or more domains. Pass full domain names (e.g. mysite.com). For bulk TLD search, pass an array like ["myapp.com", "myapp.io", "myapp.dev"]. Uses RDAP + retail pricing.

AI-powered domain suggestions. Given a project description, generates full domain names with creative TLDs (e.g. codebuddy.dev, wavify.fm), checks availability, and returns only available domains with pricing.

List all available TLDs with registration and renewal pricing

Fast DNS-based domain existence check. Tests if a name is taken across many TLDs at once (faster than search, no pricing). Returns 'taken' (definitely registered) and 'candidates' (potentially available). Use this to narrow down before calling search for pricing. Use preset: 'extended' to check 30+

Purchase one or more domains. Always confirm with the user before calling. Accepts a single domain or an array of up to 10 (card only for bulk). If the user wants to pay with crypto/USDC: call with payment_method: 'usdc' - you'll get a 402 with a wallet address and amount. Tell the user to send that

Buy a taken domain that's listed for sale on an aftermarket (Afternic/Sedo) at its buy-now price, natively - no external site. Use when search shows a domain with for_sale.buyable = true. Always confirm the price with the user first. Pass max_price to cap it. If the listing is make-offer only (not b

Give an AI agent a complete internet identity in one call: buy a domain, set up email, create a mailbox, and (optionally) register a webhook for inbound email. Use this when someone wants to 'give my agent a domain and email' or 'set up an agent from scratch'. Confirm the domain and price with the u

List all domains you own

Get DNS records for a domain you own. Returns each record with a stable id, plus a zone_version token - pass it to set_dns to detect concurrent zone changes.

Upsert DNS records for a domain you own, at the rrset level: records at a (type, name) you send replace that rrset; rrsets you don't mention are preserved (NS never touched). An automatic zone backup is taken before every write. Best practice: call get_dns first and pass its zone_version so a concur

Capture all DNS records for a domain via public DNS lookups. Discovers subdomains from CT logs, SPF, and common names. Stores a server-side backup. Use before migrations or transfers.

Restore DNS records from the server-side backup (created by snapshot_dns or during transfers). Uses diff to avoid duplicates. Call snapshot_dns first to create a backup. Pass dry_run to preview what would be applied without writing.

Copy the DNS setup of one domain you own onto another (e.g. brand.com → brand.dev with the same A/CNAME/MX). Merges by default (source wins on collisions, keeps the target's other records); set replace=true for an exact mirror.

Give your agent a free identity at <handle>.domani.run - a live profile page, no domain purchase, instantly. The frictionless way to start; upgrade to your own real domain later. Optional name/bio/emoji/email/links.

List the free agent identities (<handle>.domani.run) you've claimed.

Update a free identity's name/bio/emoji/email/links.

Release a free identity handle so it's available again.

List the DNSSEC delegation-signer (DS) records for a domain you own, and whether DNSSEC is enabled. Pair with TLSA records (via set_dns) for DANE.

Publish a DNSSEC delegation-signer (DS) record at the registry to enable DNSSEC. Get the DS values from your zone provider after signing the zone.

Remove a DNSSEC delegation-signer (DS) record at the registry by its key tag. Removing all DS records disables DNSSEC.

Get the authoritative nameservers configured for a domain you own. If empty, DNS operations (parking, email, connect) will fail.

Replace the nameservers for a domain you own. Requires 2–13 valid hostnames. Common values: OpenSRS DNS (ns1.systemdns.com, ns2.systemdns.com, ns3.systemdns.com), Cloudflare (assigned per account), custom NS.

Get a checkout URL for the user to add a payment card. Returns a URL - tell the user to open it in their browser. After they complete the form, call get_account to verify has_payment_method is true. Only needed for card payments - agents with crypto wallets can skip this and pay with USDC on Base vi

Get a Stripe checkout URL to upgrade the user to the Pro plan ($9/month). Returns a URL. Tell the user to open it in their browser to complete the upgrade. Pro includes 10,000 emails/month, unlimited mailboxes on custom domains, API/MCP/CLI access, webhooks, and forwarding. Use this when the user hi

Cancel the user's Pro subscription. The subscription remains active until the end of the current billing period, then reverts to the free plan. Returns the cancellation date.

List the user's payment invoices. Returns invoice number, amount, date, and links to view/download the PDF. Each invoice is generated by Stripe when a domain is purchased, renewed, or transferred.

List all API tokens for your account. Shows token name, masked key, creation date, last used, and expiration status. Expired tokens are marked.

Create a new API token with optional scoped permissions and spend caps. The full key is returned only once - save it immediately. A token can only grant scopes it already has (scope attenuation) and spend caps at or below its own. Scopes: domains:read (GET /api/domains, GET /api/domains/{domain}, GE

The account's security audit trail, newest first: token lifecycle (created/revoked/escalation attempts), spend-cap and max_price denials, charges, payout requests. Use it to review what the account's tokens have been doing.

Revoke an API token immediately. The token will stop working. Use list_tokens to find token IDs.

Connect a domain to a hosting or email provider. Auto-detects provider from target, or accepts explicit provider name. For domains bought through the platform, DNS records are set automatically (status: dns_set). For imported domains (external registrar), returns the records as instructions to add m

Check domain health: DNS propagation, SSL status, email (MX) configuration, and expiry date

Verify that a provider connection is working by checking DNS propagation. Use after connect_domain to confirm records are live.

Add DNS records to verify domain ownership for a third-party service (Stripe, Google Search Console, AWS SES, Postmark, Resend, Facebook, HubSpot, Microsoft 365). Unknown services fall back to a generic TXT record.

List all supported services for domain verification (Stripe, Google Search Console, etc.)

Look up domain registration data via RDAP (modern WHOIS). Returns registrar, dates, status, nameservers, DNSSEC, and contact information (registrant, admin, tech, billing - often redacted for privacy). Works for any domain - no ownership required.

Get website preview metadata (title, description, image, favicon) for any domain. Useful for understanding what a taken domain is currently used for. Data is cached for 7 days.

Enable or disable auto-renew for a domain you own. When enabled, the domain will be renewed automatically before expiry.

Enable or disable WHOIS privacy for a domain you own. When enabled, your personal contact information is hidden from public WHOIS lookups.

Lock or unlock a domain's transfer lock (clientTransferProhibited). When locked, transfer requests are rejected. Unlock before transferring to another registrar.

Forward a domain you own to another URL (e.g. brand.com -> brand.dev). The domain must point at domani's nameservers/parking IP. Permanent (308) by default, or temporary (307). Send an empty url to stop forwarding.

Get the EPP/auth code needed to transfer a domain to another registrar. Automatically unlocks the domain if it's locked. Give this code to the new registrar to initiate the transfer.

Check the status of an outbound domain transfer. Use after getting an auth code and initiating the transfer at the new registrar.

Check the status of an inbound domain transfer. Returns detailed status (pending_owner, pending_admin, pending_registry, completed, cancelled) with actionable hints.

Set your WHOIS contact information (recommended for ICANN compliance, required before transfers). You can purchase domains without setting contact info first - a default contact is used until you set your own.

Resend a verification email for your WHOIS contact email. If the contact email matches your login email, it's already verified. Rate limited to once per 15 minutes.

Get detailed information about a domain you own, including auto-renew status, security lock, WHOIS privacy, and provider data.

Read-only planner for an existing domain. Inspects registrar, nameservers, DNS provider, DNSSEC, account state, transfer eligibility, and price. Returns safe next actions. Call this before asking for an EPP code. Connecting is free and leaves registrar and DNS unchanged. Transferring preserves names

Pre-check whether a domain can be transferred. Returns transfer price, eligibility status, and any blockers (unsupported TLD, ICANN waiting period, domain locked, etc.). Always call this before transfer_domain to verify eligibility and show the user the price.

Initiate a domain transfer from another provider. PAID. The transfer includes 1 year of renewal, preserves current nameservers, and does not migrate DNS. Call plan_domain_adoption first, show the exact price and continuity plan, then get explicit confirmation before calling this. Requires the author

Watch a domain and get notified (email + webhook) when it becomes eligible for transfer. Uses RDAP to check ICANN lock periods and EPP status codes. If the domain is already eligible, returns immediately without creating a watch. If not eligible but has a known date, creates a watch and notifies you

Renew a domain you own for additional years. Always confirm with the user before calling this.

List all supported hosting and email providers with their connection methods, target requirements, and setup notes

Import an external domain you already own (registered at GoDaddy, Namecheap, Cloudflare, etc.) to manage through domani.run. Free, no transfer needed. Returns a TXT record to add at your DNS provider for ownership verification.

Verify DNS TXT record and complete domain import. Call after adding the TXT record from import_domain.

Enable or disable the parking page for a domain you own. When enabled, visitors to the domain see a default parking page (or a 'For Sale' page if a listing price is set). Parking is enabled by default for newly purchased domains. IMPORTANT: If the domain has existing DNS records, the response will i

Get visitor analytics for a parked domain - page views, inquiries, conversion rate, 30-day daily breakdown, and the 5 most recent inquiries. Use this to check how much traffic a parked domain gets and whether it's converting into buyer inquiries.

Set a 'For Sale' price on a parked domain, or remove the listing. When a price is set and parking is enabled, visitors see a 'For Sale' page with the price and a contact form to reach the domain owner. Set price to null to remove the listing.

List a domain you own for sale on the Domani marketplace. Buyers can purchase it directly via the API. The domain must be active and not already listed. Requires domains:write scope.

Update the price and/or description of an active marketplace listing. Requires domains:write scope.

Remove an active for-sale listing for a domain you own. The domain stays in your account but is no longer purchasable on the marketplace. Requires domains:write scope.

Open an anonymous price negotiation on a listed domain with an initial offer (below or at the asking price). The seller can counter, accept, or decline. Neither side sees the other's identity. Requires deals:write scope.

Counter, accept, or decline the current offer in a negotiation when it's your turn. 'accept' locks the price at the amount on the table; the buyer then finalizes payment. Requires deals:write scope.

As the buyer, pay the agreed price to create the escrow deal and start the transfer. Same payment methods as a purchase (card, USDC, x402). Requires domains:transfer scope. For a broker-sourced acquisition, if the agreed price is above the max_budget you set, this returns BUDGET_EXCEEDED - retry wit

List your active and past price negotiations (as buyer or seller). Counterparties are anonymized. Requires deals:read scope.

Get a role-aware receipt/statement for a marketplace deal. Buyers see what they paid; sellers see the sale, the platform commission line, and the net payout. Works for every payment method. Requires deals:read scope.

Ask domani to acquire a specific taken, unlisted domain on your behalf. Agents source the owner via RDAP, reach out anonymously, and negotiate - commission-only, no upfront fee. Owner interest opens an anonymous negotiation you can accept/counter. Note: many owners are unreachable (GDPR-redacted WHO

List your domain acquisition requests and their status (sourcing/contacted/negotiating/agreed/no_contact/declined). Requires deals:read scope.

Cancel an active domain acquisition request. Requires deals:write scope.

Owner-agent path: respond to a broker's acquisition inquiry using the token from the outreach email in your inbox - fully autonomous, no email round-trip, no magic-link. offer/counter names a price and opens/advances an anonymous negotiation; accept agrees to the buyer's current offer on the table;

Owner-agent read path: poll the current, anonymized state of a broker inquiry with your token before acting. Returns the domain, the buyer's offer on the table, whose move it is, and the actions available now. Never exposes the buyer's identity or budget.

Browse domains for sale on the Domani marketplace. Returns all active listings with prices. Use buy_domain to purchase a listed domain.

Place a backorder on a domain that is currently registered to someone else. We watch it and automatically register it for the user when it becomes available (drops) - availability is polled every few minutes. The user is charged only if the catch succeeds - no upfront fee. Requires a card on file or

List the user's backorders (watching, caught, failed, cancelled, expired). Optionally filter by status.

Stop watching a domain by cancelling a backorder. Only backorders in the 'watching' state can be cancelled.

List all webhook endpoints configured for the user's account. Returns URL, subscribed events, and active status for each webhook.

Register a new webhook endpoint to receive event notifications. The URL must use HTTPS. Choose which events to subscribe to (e.g. domain.purchased, transfer.completed). The webhook secret is returned only once - save it to verify incoming payloads with HMAC-SHA256.

Update an existing webhook's URL, subscribed events, or active status. Use list_webhooks to get the webhook ID first.

Delete a webhook endpoint. All pending deliveries will be cancelled. This action cannot be undone.

Get recent delivery attempts for a webhook - shows event type, HTTP status, number of attempts, and any errors. Useful for debugging webhook issues.

Redeliver one immutable webhook event. Requires a caller-stable idempotency key; retries with the same key return the same receipt and never send twice.

Pre-configure email DNS on a domain (optional). This is called automatically by create_mailbox when needed. Use this only to pre-configure DNS before creating mailboxes. Pass force=true to override existing email provider (Google Workspace, Fastmail, Proton).

Check if email is enabled on a domain and whether DNS records are verified. Returns record status and mailbox count.

Create an email address. Specify slug (required) and optionally domain. Pass workspace_id to create it inside a workspace you own; custom-domain creation atomically adopts the domain and all unscoped sibling mailboxes so a domain is never split. For custom domains: email DNS is auto-configured on fi

List all your email addresses. Optionally filter by domain. API: GET /api/emails (or GET /api/email).

Run the same deliverability and abuse-safety checks used by send_email, without sending or consuming quota. Use this before authentication, payment, onboarding, or high-volume messages. API: POST /api/emails/{address}/deliverability-check.

Send an email from one of your mailboxes. Specify domain and slug to identify the sender mailbox. Supports text and/or HTML body, CC/BCC, attachments (base64), and threading via In-Reply-To/References. Rate limited to 100 sends per hour per mailbox. API: POST /api/emails/{address}/send.

List messages in a system folder or virtual view. Defaults to Inbox. Supports pagination, direction and search filters. API: GET /api/emails/{address}/messages.

Incrementally synchronize a mailbox with an opaque cursor. Call without a cursor before a bounded full snapshot, then replay changes from next_cursor. API: GET /api/email/changes.

List canonical mailbox folders, virtual views, server-derived total/unread counts, and backend capabilities. API: GET /api/emails/{address}/folders.

Apply a retry-safe lifecycle action to up to 100 messages. Returns a durable per-item operation receipt. Reuse the exact idempotency key after timeouts; never invent a new key for the same logical action. Permanent deletion requires email:delete. API: POST /api/emails/{address}/messages/actions.

Get a single message by ID with full content, headers, delivery events, and attachment download URLs. API: GET /api/emails/{address}/messages/{id}.

Set or remove the inbound webhook URL for a mailbox. When set, incoming emails are POSTed to this URL in real-time with HMAC-SHA256 signing. Must be HTTPS. Set to null to remove. API: PUT /api/emails/{address}/webhook or DELETE /api/emails/{address}/webhook.

Regenerate the HMAC signing secret for a mailbox webhook. The old secret is immediately invalidated. API: POST /api/emails/{address}/webhook/rotate.

Send a signed test payload to the mailbox webhook URL. Returns HTTP status and success/failure. API: POST /api/emails/{address}/webhook/test.

Configure inbound handling for a mailbox: forward incoming emails to another address (in addition to storing) and/or drop spam-flagged messages. Set forward_to to null to remove forwarding. API: PATCH /api/emails/{address}.

Add an alias address that delivers into an existing mailbox, without using a mailbox slot. Useful for multiple public addresses (sales@, hello@, contact@) landing in one inbox. The alias must be on the same domain as the mailbox. API: POST /api/emails/{address}/aliases.

List all alias addresses that deliver into a mailbox. API: GET /api/emails/{address}/aliases.

Remove an alias address from a mailbox. Email to that address stops being delivered. API: DELETE /api/emails/{address}/aliases/{alias}.

Route any email sent to an unmatched address on a domain into a designated mailbox. Anything that does not match a mailbox, subaddress, or alias lands in the catch-all. The mailbox must already exist on the domain. API: PUT /api/domains/{domain}/email/catch-all.

Remove the catch-all on a domain. Email to unmatched addresses will be dropped again. API: DELETE /api/domains/{domain}/email/catch-all.

List addresses on your suppression list - hard bounces and complaints (added automatically) plus manual entries. Sends to these addresses are skipped. API: GET /api/suppressions.

Manually add an address to your suppression list so future sends skip it. Hard bounces and complaints are added automatically - use this for addresses you want to stop emailing. API: POST /api/suppressions.

Remove an address from your suppression list so you can email it again (e.g. after the recipient fixed their mailbox). API: DELETE /api/suppressions/{address}.

Add an inbound filtering rule to a mailbox. If a message matches (by from/to/subject/body), the action runs: drop, mark_read, forward (to action_arg), webhook_only (skip forward-to), or label (with action_arg). Rules run in priority order (lower first); first match wins. API: POST /api/emails/{addre

List a mailbox's inbound filtering rules, in the priority order they are applied. API: GET /api/emails/{address}/rules.

Remove an inbound filtering rule from a mailbox. API: DELETE /api/emails/{address}/rules/{ruleId}.

Delete a mailbox and all its messages (including attachments). Requires confirm=true. Call without confirm first to see what will be deleted. API: DELETE /api/emails/{address}.

Retry-safely mark messages read or unread and return a durable per-item receipt. Reuse the exact idempotency key after timeouts. API: PATCH /api/emails/{address}/messages/read.

Move an email message to Trash. This is reversible with update_email_messages action=restore. API: DELETE /api/emails/{address}/messages/{id}.

Retry-safely move messages to Trash and return a durable per-item receipt. Reuse the exact idempotency key after timeouts. Reversible with update_email_messages action=restore. API: POST /api/emails/{address}/messages/delete.

Forward an email message to another address. Includes the original message context (sender, date, subject, body). Optionally prepend a note. Subject is auto-prefixed with 'Fwd:'. API: POST /api/emails/{address}/messages/{id}/forward.

Reply to an email message. For shared human-agent mailboxes, first heartbeat composing presence and pass coordination plus a stable idempotency_key; the server atomically rejects stale/double replies. Threading headers are automatic. API: POST /api/emails/{address}/messages/{id}/reply.

Check email DNS health for a domain: MX records, SPF, DMARC, DKIM. Auto-detects the email provider from MX records.

Get an owner-scoped email health report for a domain. Separates deterministic DNS readiness, 30-day bounce and complaint outcomes, account safety state, and measured inbox placement. A readiness score is not an Inbox probability. API: GET /api/domains/{domain}/email/deliverability.

Create a real IMAP/SMTP mailbox on a domain you own (connect Apple Mail, Thunderbird, or any mail client), instead of an API mailbox. Pass workspace_id to create it in a workspace you own and atomically adopt the domain boundary. Provisions the mailbox on our mail server, publishes DNS when we manag

Get IMAP/SMTP settings for a hosted mailbox to configure a mail client (Apple Mail, Thunderbird). Username is the full address; password is an app password. API: GET /api/emails/{address}/client-settings.

Create an app password for a hosted mailbox, used as the password in a mail client. The secret is returned once - store it. API: POST /api/emails/{address}/credentials.

List the app passwords for a hosted mailbox (labels + metadata; secrets are shown only once at creation). API: GET /api/emails/{address}/credentials.

Revoke an app password on a hosted mailbox. Any mail client using it stops connecting. API: DELETE /api/emails/{address}/credentials/{id}.