Install Jentic One Beta

Connect the deSEC DNS API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the deSEC DNS API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdesec.io%2Fdesec" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fdesec.io%2Fdesec" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with deSEC DNS API.

Create, list, retrieve, and delete domains via /domains/ endpoints

Bulk create, update, or patch RRsets across a zone with /domains/{name}/rrsets/

Edit a single RRset by name and type with full or partial updates

Export a domain's zonefile through /domains/{name}/zonefile/

Issue and revoke API tokens for account automation via /auth/tokens/

GET STARTED

Start building with deSEC DNS API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use deSEC DNS API for, with concrete tasks.

★ ACME DNS-01 Challenge Automation

Automate the DNS-01 challenge for Let's Encrypt by adding a TXT record to a deSEC zone, then removing it once issuance is complete. POST and DELETE on /domains/{name}/rrsets/{subname}/{type}/ are the two endpoints that drive this flow, and a token policy can restrict the automation to only the _acme-challenge subname.

POST a TXT RRset for _acme-challenge under the target domain, wait for issuance, then DELETE the same RRset.

DNSSEC-Signed Zone Management

Manage DNS records for a domain that needs DNSSEC by default by creating it via POST /domains/ and editing record sets via /domains/{name}/rrsets/. deSEC signs every zone automatically, so operators get DNSSEC without managing keys. Bulk PUT and PATCH operations are convenient for IaC-style updates.

PUT a list of RRsets to /domains/{name}/rrsets/ to bring a zone in line with the desired-state file.

Scoped Automation Tokens

Use deSEC's per-token RRset policies to grant CI pipelines or third-party tools the minimum DNS access they need. Issue a token via POST /auth/tokens/, attach a policy via /auth/tokens/{id}/policies/rrsets/, and the token can only modify the named subnames and types. Revoke at any time with DELETE.

POST a new token, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that allows only TXT changes under the _acme-challenge subname.

Zonefile Export for Backups

Export the current zonefile for a domain via GET /domains/{name}/zonefile/ to back up DNS state outside deSEC or feed it into another DNS provider. The output is a standard zonefile suitable for diffing against version control.

Call GET /domains/{name}/zonefile/ for each managed domain and write the output to a versioned backup directory.

AI Agent Integration via Jentic

An infrastructure agent can use Jentic to handle DNS changes during deploys, such as cutting over a CNAME or rotating a TXT record. Jentic resolves the deSEC token from the vault and exposes typed schemas for /domains and /auth/tokens operations, so the agent can act without reading the deSEC documentation.

Use Jentic to search for 'create a desec dns rrset', load POST /domains/{name}/rrsets/, and execute it with the desired record.

Key Endpoints

23 endpoints — jentic publishes the only available openapi specification for desec dns api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

DELETE

/domains/{name}/rrsets/{subname}/{type}/

Delete a specific RRset

POST

/auth/tokens/

Create a new API token

POST

/auth/tokens/{id}/policies/rrsets/

Create an RRset policy for a token

POST

/domains/

Create a new domain

GET

/domains/{name}/zonefile/

Export the zonefile for a domain

POST

/domains/{name}/rrsets/

Create an RRset in a zone

PUT

/domains/{name}/rrsets/

Bulk replace RRsets in a zone

PATCH

/domains/{name}/rrsets/{subname}/{type}/

Partially update a specific RRset

DELETE

/domains/{name}/rrsets/{subname}/{type}/

Delete a specific RRset

POST

/auth/tokens/

Create a new API token

POST

/auth/tokens/{id}/policies/rrsets/

Create an RRset policy for a token

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring deSEC by hand means learning its token auth, building the DNSSEC-signed domain and rrset calls, and managing scoped tokens and their rrset policies yourself. Through Jentic you install once, import the deSEC DNS API from the API Directory, store the token once, and your agent calls it.

Permission scoping

deSEC puts the domain name in the URL path (/domains/{name}/rrsets/...), so a rule can pin your agent to one domain: it can read and edit records for that zone and nothing else. You choose the operations it may call, so destructive ones like rrset deletion or token creation are not included unless you add them.

Credential isolation

Your deSEC API token is stored once, encrypted, by your own Jentic One instance and injected into the Authorization header at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a DNS TXT record on deSEC' or 'read a zone file', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without reading the deSEC docs.

FAQs

Specific to using deSEC DNS API through Jentic.

Why is there no official OpenAPI spec for deSEC DNS API?

deSEC does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call deSEC DNS API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the deSEC DNS API use?

The deSEC DNS API uses Token-style Bearer authentication: pass `Authorization: Token <token-value>` on every request. Through Jentic, tokens are stored encrypted in the vault and injected at execution time, so the secret never reaches the agent's context.

Can I add a TXT record with the deSEC DNS API?

Yes. POST /domains/{name}/rrsets/ creates an RRset of any type, including TXT. To delete it later, call DELETE /domains/{name}/rrsets/{subname}/{type}/ with the same subname and type.

How do I scope an API token to specific records?

Create the token with POST /auth/tokens/, then POST a policy to /auth/tokens/{id}/policies/rrsets/ that names the subnames and RRset types the token may modify. Tokens with policies fail any request that falls outside their allowed surface.

Does deSEC sign zones with DNSSEC automatically?

Yes. deSEC signs every hosted zone with DNSSEC by default, so any RRset created or modified through the API is delivered as part of a DNSSEC-signed response. There is no separate signing call to make.

How do I automate the ACME DNS-01 challenge through Jentic?

Run `pip install jentic`, search for 'create a desec dns rrset', execute POST /domains/{name}/rrsets/ to add the _acme-challenge TXT record, wait for issuance, then call DELETE /domains/{name}/rrsets/_acme-challenge/TXT/ to clean up. Jentic uses the stored token for both calls.

Can I limit what my agent is allowed to do with the deSEC DNS API?

Yes. Because you run Jentic One yourself, your own rules decide which deSEC operations and which token the agent may use. Since deSEC puts the domain name in the URL path, such as /domains/{name}/rrsets/, you can pin the agent to a single zone so it only reads and edits that domain's records. You also pick the exact operations it can call, so destructive actions like DELETE on an RRset or POST /auth/tokens/ token creation stay off the table unless you add them.

deSEC DNS API

Name: deSEC DNS API
Brand: deSEC DNS API
Availability: InStock

Agent-ready OpenAPI document · curated by JenticCloud InfrastructureNetworkingbearer23 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Manage deSEC domains and DNSSEC-signed DNS record sets, plus issue and scope per-token RRset policies for automation.

Use for: I want to create a new domain in deSEC, Add a TXT record to an existing zone, Update an A record in deSEC, Bulk patch multiple DNS records at once

Not supported: Does not handle domain registration, CDN, WAF, or load balancing - use for deSEC DNSSEC-signed DNS hosting and token management only.

Jentic publishes the only available OpenAPI specification for deSEC DNS API, keeping it validated and agent-ready. deSEC is a free, open-source, non-profit DNS hosting service that signs all zones with DNSSEC by default. The API exposes 23 endpoints covering domain management, DNS record sets, zonefile export, account tokens, and per-token RRset policies that scope what each token can change. Authentication uses Token-style Bearer auth, making it well suited for automation that needs least-privilege access to specific records.

Jentic One on Github View OpenAPI Document

Connect the deSEC DNS API to your agent

Capabilities

Start building with deSEC DNS API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

deSEC DNS API