doDomain

Pre-flight a domain before connecting it. Input: domain (e.g. "shop.acme.com"). Returns which DNS provider manages the domain, the registrable zone, the connect tier/method the domain's provider supports (1 oauth one-click, 2 domain-connect, 3 guided manual), whether one-click is actually available there (oneClickAvailable: tier 2 alone only means the provider speaks Domain Connect; one-click needs a Pro or Scale session either way), detection confidence, nameservers, and a provider-specific manual-setup guide. Read-only and creates nothing — use it to set expectations before create_connect_session. teamId is optional and only decides which team's rate limit the check counts against; a teamId this connection cannot use is refused with TEAM_NOT_FOUND.

check_domain

Start a domain-connect session so an end user can point their domain at the integrator's product. Input: appId (REQUIRED for OAuth-token callers — pick one via list_apps, or create one with create_app; API-key callers may omit it), teamId (the team that owns that app — needed only when this connection can use more than one team; see list_teams), domain (the customer's domain, e.g. app.customer.com), records (the DNS records to apply: type/host/value, MX needs priority — required, a recipe id does not substitute for them), plus optional returnUrl (http/https). Returns id, sessionToken, expiry, a connectUrl, and records with the composed fqdn each one will be verified at (hosts compose under the session domain, so host '@' means the domain itself) plus any warnings about the request. Hand the connectUrl to the end user to complete DNS setup in their browser (one-click on Pro and Scale where the provider supports it; Free-plan sessions use guided manual setup); the records also come back via get_connect_session for manual setup. Each call creates a NEW session. Creating a session does NOT consume monthly connection quota — that is charged once, when the domain is first verified. It IS refused here with quota_exceeded once the team's monthly cap is reached, on every plan. On Free that cap is shared by the Free teams owned by any of this team's owners, and creation is also refused once the team's unfinished sessions reach what the month has left plus 10 — wait for sessions to finish or expire (24h) rather than retrying. A rate_limited answer means too many sessions were being created at once: retry after its Retry-After.

create_connect_session

Run DNS-provider detection for a session and persist the detected tier (what the hosted flow does when it opens). Returns the provider, tier and the zone that owns the records. Safe to repeat; a verified session is never downgraded.

detect_connect_session

Click-ready links for the connect flows that finish in a browser. Input: provider (cloudflare, domain_connect or vercel; omit for every one that applies) and sessionToken (from create_connect_session; needed for cloudflare and domain_connect). cloudflare and domain_connect open the one-click DNS apply for that session. vercel opens the integration install for the signed-in person. Each link is single-use and expires in 15 minutes (expires_in). available false carries the reason.

get_connect_links

Fetch the current state of one domain-connect session by its sessionToken (the token returned by create_connect_session). Returns the session's domain, the DNS records it wants applied, status (pending/detected/authorizing/writing/verifying/verified/failed/expired), tier, detected provider, and expiry. Poll it after handing the user a connectUrl to see whether they finished; a 410 means the session expired — create a new one.

get_connect_session

Read one connection by id (from list_connections or a connection.* webhook): domain, recordFqdns, status (active or broken), verifiedAt, lastCheckedAt, brokenAt and disconnectedAt. Use it to see the result of reverify_connection once the check has finished.

get_connection

List the apps in one team. Input: teamId (optional — needed only when this connection can use more than one team; see list_teams). Returns each app's id, name, public (widget) key, sandbox flag, and creation time — never secret keys. Use it to find the appId that list_connections filters by and that create_connect_session requires from OAuth-token callers: pick one via list_apps, or create one with create_app.

list_apps

List verified domain connections and their live DNS health, in one team. teamId (optional) names the team — needed only when this connection can use more than one; see list_teams. Optional filters: appId (one app only), domain (exact match), limit (1-100, default 50), cursor (pass back the previous page's nextCursor to page onward), includeDisconnected (default false). Returns per connection: id, appId, sessionId, domain, recordFqdns (the fully-qualified names actually monitored, one per record of the session), fqdn (legacy: the session domain again, NOT a record name — prefer recordFqdns), status (active = DNS records verified in place, broken = drift observed), verifiedAt/lastCheckedAt/brokenAt, disconnectedAt (non-null = the integrator disconnected it and DNS monitoring has stopped), createdAt; plus nextCursor (null on the last page). Use it to answer "is this customer's domain still connected?" — pair with reverify_connection to force a fresh check on a broken-looking one.

list_connections

The team's connect sessions, newest first (50 per page; pass nextCursor back as cursor). Filters: status (repeatable), tier, provider, app (app id, repeatable), period (7d, 30d or 90d). Each row: id, domain, derived status, app, DNS provider label, connectionId once verified, createdAt, expiresAt. Use get_connect_session with a session token for records.

list_sessions

The team's Vercel connections: which app each belongs to, the Vercel account, and the linked projects.

list_vercel_connections