> ## Documentation Index > Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt > Use this file to discover all available pages before exploring further. # Get record geo routing > Return the record's answer variants and the default answer its own values provide. ## OpenAPI ````yaml /api-reference/specs/dns.yaml get /v1/zones/{zone_id}/records/{record_id}/geo-routing openapi: 3.0.3 info: title: Basaltic DNS API version: 1.0.0 description: | Authoritative hosted zones and their records, signed with DNSSEC. A zone is only served once its ownership is verified; associating a zone with a VPC makes it resolvable privately inside that network. contact: name: Basaltic Support email: ping@basaltic.sh license: name: Proprietary url: https://basaltic.sh/terms servers: - url: https://dns.basaltic.sh description: Global API endpoint security: - SignatureAuth: [] paths: /v1/zones/{zone_id}/records/{record_id}/geo-routing: get: tags: - DNS summary: Get record geo routing description: >- Return the record's answer variants and the default answer its own values provide. operationId: getRecordGeoRouting parameters: - $ref: '#/components/parameters/ZoneId' - $ref: '#/components/parameters/RecordId' responses: '200': description: Geo routing details content: application/json: schema: $ref: '#/components/schemas/RecordGeoRoutingResponse' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '500': $ref: '#/components/responses/InternalServerError' security: - SignatureAuth: [] components: parameters: ZoneId: name: zone_id in: path description: DNS Zone ID required: true schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 RecordId: name: record_id in: path description: DNS Record ID required: true schema: type: string format: uuid example: 550e8400-e29b-41d4-a716-446655440000 schemas: RecordGeoRoutingResponse: type: object properties: geo_routing: $ref: '#/components/schemas/RecordGeoRouting' RecordGeoRouting: type: object properties: default: type: array readOnly: true items: type: string description: >- The record's own values — what a query matching no prefix is answered with. Reported rather than left implicit: it is the answer most of the internet actually gets. example: - 192.0.2.10 answers: type: array items: $ref: '#/components/schemas/RecordGeoAnswer' Error: type: object required: - error properties: error: type: object required: - code - message - request_id properties: code: type: string description: Error code identifying the type of error example: INVALID_INPUT message: type: string description: Human-readable error message example: Invalid request parameters request_id: type: string format: uuid description: Request ID for debugging example: 550e8400-e29b-41d4-a716-446655440000 RecordGeoAnswer: type: object description: >- One named answer variant and the client prefixes it answers for. The record's own `values` stay the default answer — what a query matching no prefix gets — so this list describes overrides, never the fallback. required: - label - values - prefixes properties: label: type: string pattern: ^[a-z0-9][a-z0-9_-]{0,30}$ description: >- Name for the variant, unique within the record. `default` is reserved: it is what the record's own values are called. example: eu values: type: array minItems: 1 items: type: string description: >- Answer for clients in `prefixes`, valid rdata for the record's type. A CNAME variant takes exactly one value — a variant is still a CNAME RRset. example: - 198.51.100.10 prefixes: type: array minItems: 1 items: type: string description: >- Client prefixes in CIDR form, written as the network address (`185.0.0.0/8`, not `185.1.2.3/8`). Selection is longest-prefix match, so overlapping prefixes of different lengths are meaningful rather than a conflict; the same prefix on two variants is rejected. No longer than /24 (IPv4) or /56 (IPv6). example: - 185.0.0.0/8 responses: Unauthorized: description: Authentication required or token invalid content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: UNAUTHORIZED message: Authentication required request_id: 550e8400-e29b-41d4-a716-446655440000 Forbidden: description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ACCESS_DENIED message: You don't have permission to perform this action request_id: 550e8400-e29b-41d4-a716-446655440000 NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: NOT_FOUND message: Resource not found request_id: 550e8400-e29b-41d4-a716-446655440000 InternalServerError: description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: INTERNAL_ERROR message: An internal error occurred request_id: 550e8400-e29b-41d4-a716-446655440000 securitySchemes: SignatureAuth: type: apiKey in: header name: Authorization description: > Request signing with an access key issued to a service account. An HMAC-SHA256 over a canonical form of the request, close to AWS SigV4. The `basaltic` CLI signs for you. Send `Authorization`, `X-Date` (UTC, `YYYYMMDDTHHMMSSZ`) and `X-Nonce` (random per request); add `X-Content-Sha256` to bind a body, and `X-Amz-Security-Token` when using temporary credentials. ``` Authorization: BASALTIC-HMAC-SHA256 Credential=///basaltic/basaltic_request, SignedHeaders=host;x-date;x-nonce, Signature= ``` `` is the region code you are calling, or `global` for the global services. A signature is valid for 5 minutes from `X-Date`, and mutating requests are replay-guarded on the nonce. **Full signing procedure, including a working implementation:** https://docs.basaltic.sh/authentication ## Rate limits There is no global request budget. A limit applies only where an operation documents a `429`, and that operation says what it counts. Those responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset` and, on a `429`, `Retry-After` — read them rather than hard-coding a number. Retrying before `Retry-After` is refused and extends the window. Everything else is bounded by quota, not by request rate. ````