Export the zone as a zone file

curl --request GET \
  --url https://dns.basaltic.sh/v1/zones/{zone_id}/export \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://dns.basaltic.sh/v1/zones/{zone_id}/export', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://dns.basaltic.sh/v1/zones/{zone_id}/export",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://dns.basaltic.sh/v1/zones/{zone_id}/export"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://dns.basaltic.sh/v1/zones/{zone_id}/export")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

"; Zone file for example.com\n; Exported from Basaltic DNS. Serial 42.\n;\n; THIS FILE DOES NOT DESCRIBE THE WHOLE ZONE. A zone file can carry\n; records and nothing else, so these are NOT in it:\n;\n;   - health checks and failover priorities\n;   - geo routing variants and their prefixes\n;   - private-zone VPC associations\n;\nexample.com.\t3600\tIN\tSOA\t028t5cy4tqkff.triton.dns.basaltic.cloud. hostmaster.basaltic.sh. 42 10800 3600 604800 3600\nexample.com.\t300\tIN\tA\t203.0.113.10\nwww.example.com.\t300\tIN\tCNAME\texample.com.\n"

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "ACCESS_DENIED",
    "message": "You don't have permission to perform this action",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "An internal error occurred",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Zones

Export the zone as a zone file

Returns the zone as an RFC 1035 master file — the BIND format every provider reads. The inverse of /import.

Worth keeping before a bulk change: the import merges and never deletes, so without a file taken beforehand there is no way back to the previous state.

The records carry the values you CONFIGURED, not the subset a health check is currently answering with. A backup that captured a live failover state would silently drop your primary when restored.

The file cannot describe the whole zone, and says so in its own header: health checks, failover priorities, geo routing variants and private-zone VPC associations have no zone-file representation. Re-importing restores the records; those have to be set up again.

The DNSSEC records are omitted — they sign keys held by this platform and mean nothing elsewhere. The SOA and apex NS are included, as in any zone file; an importer replaces them with its own.

GET

zones

{zone_id}

export

Export the zone as a zone file

curl --request GET \
  --url https://dns.basaltic.sh/v1/zones/{zone_id}/export \
  --header 'Authorization: <api-key>'

const options = {method: 'GET', headers: {Authorization: '<api-key>'}};

fetch('https://dns.basaltic.sh/v1/zones/{zone_id}/export', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://dns.basaltic.sh/v1/zones/{zone_id}/export",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://dns.basaltic.sh/v1/zones/{zone_id}/export"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "<api-key>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://dns.basaltic.sh/v1/zones/{zone_id}/export")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = '<api-key>'

response = http.request(request)
puts response.read_body

"; Zone file for example.com\n; Exported from Basaltic DNS. Serial 42.\n;\n; THIS FILE DOES NOT DESCRIBE THE WHOLE ZONE. A zone file can carry\n; records and nothing else, so these are NOT in it:\n;\n;   - health checks and failover priorities\n;   - geo routing variants and their prefixes\n;   - private-zone VPC associations\n;\nexample.com.\t3600\tIN\tSOA\t028t5cy4tqkff.triton.dns.basaltic.cloud. hostmaster.basaltic.sh. 42 10800 3600 604800 3600\nexample.com.\t300\tIN\tA\t203.0.113.10\nwww.example.com.\t300\tIN\tCNAME\texample.com.\n"

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "ACCESS_DENIED",
    "message": "You don't have permission to perform this action",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "INTERNAL_ERROR",
    "message": "An internal error occurred",
    "request_id": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Authorizations

Authorization

string

header

required

Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The basaltic CLI signs for you.

Send Authorization, X-Date (UTC, YYYYMMDDTHHMMSSZ) and X-Nonce (random per request); add X-Content-Sha256 to bind a body, and X-Amz-Security-Token when using temporary credentials.

Authorization: BASALTIC-HMAC-SHA256 Credential=<access_key_id>/<date>/<region>/basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature=<hex>

<region> is the region code you are calling, or global for the global services. A signature is valid for 5 minutes from X-Date, and mutating requests are replay-guarded on the nonce.

Full signing procedure, including a working implementation: https://docs.basaltic.sh/authentication

Rate limits

There is no global request budget. A limit applies only where an operation documents a 429, and that operation says what it counts. Those responses carry X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and, on a 429, Retry-After — read them rather than hard-coding a number. Retrying before Retry-After is refused and extends the window. Everything else is bounded by quota, not by request rate.

Path Parameters

zone_id

string<uuid>

required

DNS Zone ID

Response

The zone file

The response is of type string.

Overview

Audit

Billing

Certificate

Compute

Database

DNS

Identity and account

KMS

Load balancer

Network

Quota

Secrets

Storage

Telemetry

Export the zone as a zone file

Authorizations

Rate limits

Path Parameters

Response