DNS

DNS endpoints work with a full access key, or a restricted key with a DNS scope for the domain: reads need the scope’s read permission, changes need write. The domain must be on the account (404 otherwise); a key without the permission gets 403. A record that isn’t valid (a bad value, a type that isn’t allowed) is refused with 422 and an error message, e.g. { "error": "Record type 'PTR' is not allowed" }. On accounts with High-Profile Protection every change is refused with 403 (see Domains); reads and Export Zone stay open.

A record’s id comes from its name, type and content, so it changes when the record does: an update returns the record’s new id. Records with the same name and type share one TTL. Other DNS answers:

• 404 with DNS isn't set up for this domain. when the domain has no zone yet (adding a record sets it up).
• 409 when the zone changed while the change was being made. Try again.
• 423 when changes to the domain’s DNS are locked by our team.
• 429 when changes come too fast, with a Retry-After header.
• 503 when DNS is temporarily unavailable.