deSEC DNS API

Name: deSEC DNS API
Brand: deSEC DNS API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingbearer23 EndpointsREST

For Agents

Manage deSEC domains and DNSSEC-signed DNS record sets, plus issue and scope per-token RRset policies for automation.

Install Jentic One Beta

Connect the deSEC DNS API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the deSEC DNS API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with deSEC DNS API.

Create, list, retrieve, and delete domains via /domains/ endpoints

Bulk create, update, or patch RRsets across a zone with /domains/{name}/rrsets/

Edit a single RRset by name and type with full or partial updates

GET STARTED

Start building with deSEC DNS API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for deSEC DNS API, keeping it validated and agent-ready. deSEC is a free, open-source, non-profit DNS hosting service that signs all zones with DNSSEC by default. The API exposes 23 endpoints covering domain management, DNS record sets, zonefile export, account tokens, and per-token RRset policies that scope what each token can change. Authentication uses Token-style Bearer auth, making it well suited for automation that needs least-privilege access to specific records.

Use Cases

Patterns agents use deSEC DNS API for, with concrete tasks.

★ ACME DNS-01 Challenge Automation

Automate the DNS-01 challenge for Let's Encrypt by adding a TXT record to a deSEC zone, then removing it once issuance is complete. POST and DELETE on /domains/{name}/rrsets/{subname}/{type}/ are the two endpoints that drive this flow, and a token policy can restrict the automation to only the _acme-challenge subname.

POST a TXT RRset for _acme-challenge under the target domain, wait for issuance, then DELETE the same RRset.

DNSSEC-Signed Zone Management

Manage DNS records for a domain that needs DNSSEC by default by creating it via POST /domains/ and editing record sets via /domains/{name}/rrsets/. deSEC signs every zone automatically, so operators get DNSSEC without managing keys. Bulk PUT and PATCH operations are convenient for IaC-style updates.

PUT a list of RRsets to /domains/{name}/rrsets/ to bring a zone in line with the desired-state file.

Scoped Automation Tokens

Use deSEC's per-token RRset policies to grant CI pipelines or third-party tools the minimum DNS access they need. Issue a token via POST /auth/tokens/, attach a policy via /auth/tokens/{id}/policies/rrsets/, and the token can only modify the named subnames and types. Revoke at any time with DELETE.

POST a new token, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that allows only TXT changes under the _acme-challenge subname.

Zonefile Export for Backups

Export the current zonefile for a domain via GET /domains/{name}/zonefile/ to back up DNS state outside deSEC or feed it into another DNS provider. The output is a standard zonefile suitable for diffing against version control.

Call GET /domains/{name}/zonefile/ for each managed domain and write the output to a versioned backup directory.

AI Agent Integration via Jentic

An infrastructure agent can use Jentic to handle DNS changes during deploys, such as cutting over a CNAME or rotating a TXT record. Jentic resolves the deSEC token from the vault and exposes typed schemas for /domains and /auth/tokens operations, so the agent can act without reading the deSEC documentation.

Use Jentic to search for 'create a desec dns rrset', load POST /domains/{name}/rrsets/, and execute it with the desired record.

Key Endpoints

23 endpoints — jentic publishes the only available openapi specification for desec dns api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

DELETE

/domains/{name}/rrsets/{subname}/{type}/

Delete a specific RRset

POST

/auth/tokens/

Create a new API token

POST

/auth/tokens/{id}/policies/rrsets/

Create an RRset policy for a token

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

deSEC API tokens are stored encrypted in the Jentic vault. Agents reference operations by name and Jentic injects the Authorization header at execution time, keeping tokens out of prompts and logs.

Intent-based discovery

Agents search by intent (e.g. 'create a dns txt record on desec') and Jentic returns the matching operation along with its full input schema, so the agent can act without reading the deSEC docs.

Time to first call

Direct deSEC integration: half a day to wire auth, RRset shapes, and per-token policies. Through Jentic: under 30 minutes to drive an end-to-end DNS-01 automation.

FAQs

Specific to using deSEC DNS API through Jentic.

Why is there no official OpenAPI spec for deSEC DNS API?

deSEC does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call deSEC DNS API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the deSEC DNS API use?

The deSEC DNS API uses Token-style Bearer authentication: pass `Authorization: Token <token-value>` on every request. Through Jentic, tokens are stored encrypted in the vault and injected at execution time, so the secret never reaches the agent's context.

Can I add a TXT record with the deSEC DNS API?

Yes. POST /domains/{name}/rrsets/ creates an RRset of any type, including TXT. To delete it later, call DELETE /domains/{name}/rrsets/{subname}/{type}/ with the same subname and type.

How do I scope an API token to specific records?

Create the token with POST /auth/tokens/, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that names the subnames and RRset types the token may modify. Tokens with policies fail any request that falls outside their allowed surface.

Does deSEC sign zones with DNSSEC automatically?

Yes. deSEC signs every hosted zone with DNSSEC by default, so any RRset created or modified through the API is delivered as part of a DNSSEC-signed response. There is no separate signing call to make.

How do I automate the ACME DNS-01 challenge through Jentic?

Run `pip install jentic`, search for 'create a desec dns rrset', execute POST /domains/{name}/rrsets/ to add the _acme-challenge TXT record, wait for issuance, then call DELETE /domains/{name}/rrsets/_acme-challenge/TXT/ to clean up. Jentic uses the stored token for both calls.

deSEC DNS API

Connect the deSEC DNS API to your agent

Capabilities

Start building with deSEC DNS API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs