{"openapi":"3.1.0","info":{"title":"deSEC (BYOK) API","version":"0.1.0","description":"deSEC (BYOK) lets an AI assistant read your own deSEC data through the deSEC API with a key you supply (deSEC API token). Read-only: 6 tools (list_domains, find_responsible_domain, get_domain, list_rrsets, get_rrset, get_account). The BYOK key travels with each request, is used for that one call only and is never stored, logged or cached; it is only ever sent to desec.io. Unofficial connector by...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-desec.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-desec/docs"},"termsOfService":"https://connectorbay.com/byok-desec/terms"},"servers":[{"url":"https://byok-desec.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-desec/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_domains":{"post":{"operationId":"list_domains","summary":"List the DNS zones in the account, newest first, with creation, last publish time and minimum TTL (up to 500; DNSSEC key","description":"List the DNS zones in the account, newest first, with creation, last publish time and minimum TTL (up to 500; DNSSEC keys are omitted from the list). Use for \"Which domains do I host at deSEC\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"list_domainsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/find_responsible_domain":{"post":{"operationId":"find_responsible_domain","summary":"Find which of your zones is authoritative for a DNS name, useful when zones are nested. Returns an empty list when none ","description":"Find which of your zones is authoritative for a DNS name, useful when zones are nested. Returns an empty list when none matches. Use for \"Which of my deSEC zones is responsible for www.shop.example.com\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"owns_qname":{"description":"DNS name to look up, for example 'www.shop.example.com'.","maxLength":200,"title":"Owns Qname","type":"string"}},"required":["owns_qname"],"title":"find_responsible_domainArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_domain":{"post":{"operationId":"get_domain","summary":"Get one zone including its DNSSEC keys (DNSKEY and DS record values to publish at the registrar). Use for \"What DS recor","description":"Get one zone including its DNSSEC keys (DNSKEY and DS record values to publish at the registrar). Use for \"What DS records do I need to publish for example.com at deSEC\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"domain":{"description":"Domain (zone) name that the account hosts at deSEC, for example 'example.com'.","maxLength":200,"title":"Domain","type":"string"}},"required":["domain"],"title":"get_domainArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_rrsets":{"post":{"operationId":"list_rrsets","summary":"List the DNS record sets (RRsets) of a zone, newest first, optionally filtered by record type and/or subname. Returns at","description":"List the DNS record sets (RRsets) of a zone, newest first, optionally filtered by record type and/or subname. Returns at most 500; larger zones need narrower filters. Use for \"What A records does example.com have at deSEC\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"domain":{"description":"Domain (zone) name that the account hosts at deSEC, for example 'example.com'.","maxLength":200,"title":"Domain","type":"string"},"type":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Record type in capitals to filter by, for example 'A', 'MX' or 'TXT'.","title":"Type"},"subname":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Only record sets with this subname, for example 'www'. Use '.' for the zone apex.","title":"Subname"}},"required":["domain"],"title":"list_rrsetsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_rrset":{"post":{"operationId":"get_rrset","summary":"Get the record set of one subname and type, with its TTL and record values. Use for \"What are the MX records at the apex","description":"Get the record set of one subname and type, with its TTL and record values. Use for \"What are the MX records at the apex of example.com\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"domain":{"description":"Domain (zone) name that the account hosts at deSEC, for example 'example.com'.","maxLength":200,"title":"Domain","type":"string"},"subname":{"description":"Subname such as 'www' or '_443._tcp'; use '@' for the zone apex.","maxLength":178,"title":"Subname","type":"string"},"rtype":{"description":"Record type in capitals, for example 'A', 'AAAA', 'MX', 'TXT' or 'CNAME'.","maxLength":20,"title":"Rtype","type":"string"}},"required":["domain","subname","rtype"],"title":"get_rrsetArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_account":{"post":{"operationId":"get_account","summary":"Show the account's domain count, domain limit and number of DNSSEC-secured domains (needs a token with the manage-tokens","description":"Show the account's domain count, domain limit and number of DNSSEC-secured domains (needs a token with the manage-tokens permission). Use for \"How many more domains can I add at deSEC\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{},"title":"get_accountArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}