Domains

All domain endpoints need a key with Full Access; a restricted key gets 403 whatever its scopes. A domain is found by name in any case, and one that isn’t on the account is 404. When the registrar refuses a change or a lookup, the call fails with 400 and the registrar’s message.

Contacts

A domain’s contacts are never typed in for that domain: each role the registry wants (registrant always, and admin, tech or billing for the ccTLDs that ask for them) is a contact from the account’s address book, which List Contacts returns by uuid. A contact can hold domains once its email is verified and its address is complete. A new domain takes the account’s default domain contact in every role; Update Contacts gives it others. Contacts are added and edited in the client portal, and an edit there reaches every domain the contact holds.

On accounts with High-Profile Protection, existing domains can’t be changed through the API, since a key can’t pass the portal’s two-factor check. These calls get 403 before anything else is checked: Update Nameservers, Lock Domain, Unlock Domain, Get EPP Code, Update Contacts, Set ID Protection, Set Auto-Renew, and DNS Create, Update and Delete Record, DDNS and Import. Reads (apart from the EPP code), registrations, transfers and renewals stay open.

{
  "success": false,
  "error": "This account has enhanced protection: domain modification via the API is disabled. Use the client portal, which requires two-factor confirmation.",
  "code": 403
}