1. Who can use the API
Any account in good standing can turn on API access. If you register or manage domains for other people, Registration Agreement §12 applies to you. We may refuse, limit, or withdraw API access for abuse, non-payment, or a breach of these terms.
2. Keys and access
Keep your API keys secret. You're responsible for every request made with your key. Restrict access to the IP addresses you use (IPv4 and IPv6 supported) and tell us straight away if a key may be compromised - we'll revoke it. Resetting a key stops anything still using the old one.
3. Fair use
- Stay within any rate limits we set.
- No drop-catching, no bulk availability scraping, and no load or security testing against production.
- Don't use the API to register domains in bulk for abuse, or to evade a suspension. We monitor registration volume and patterns and may pause or review unusual activity.
4. Billing
API orders are paid from your account balance at the prices in force when the order is placed, including any volume discount your account has reached. Domain purchases are final and non-refundable, as set out in Registration Agreement §3. Account funds are non-refundable, and transaction fees may apply when you add funds (Terms of Service §4.2).
5. Registering for others
If you submit a registration for someone else, they must have accepted our Domain Registration Agreement (and any TLD-specific terms that apply, such as the RoTLD contract for .ro) before you submit it. Any "terms accepted" value or attestation you send us through the API is your promise that the person really did accept or attest. Keep a record of it (Registration Agreement §12.2).
6. Transfers and data
- Your integration must let domain owners get their transfer authorization code, through the API or by sending them to us. Never block or delay a transfer request. Owners can always ask us to email the code to the registrant address on file.
- Submit accurate registrant data in the name of the domain's actual owner. Some changes to the registrant's name, organization, or email are a Change of Registrant under ICANN's Transfer Policy and trigger notices (and, where it applies, a 60-day transfer lock unless the registrant opts out). An email change also triggers re-verification.
- Pass eligibility and attestation data through unchanged.
7. Abuse
API use is subject to our Acceptable Use Policy and Registration Agreement §12. We may throttle or suspend a key, or act on any domain, to stop abuse.
8. Changes to the API
We may change the API. We'll give reasonable notice of breaking changes, except where a change is needed for security, legal, or registry reasons.
9. No warranty, liability, and ending access
The API is provided "as is." Our liability is limited as set out in Terms of Service §10. You can stop using the API at any time; we may suspend or end your access under these terms. If your access ends, we may contact and continue to serve anyone whose domains you managed (Registration Agreement §12.7).