curl --request GET \
--url https://dns.basaltic.sh/v1/zones/{zone_id}/records \
--header 'Authorization: Bearer <token>'import requests
url = "https://dns.basaltic.sh/v1/zones/{zone_id}/records"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://dns.basaltic.sh/v1/zones/{zone_id}/records', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://dns.basaltic.sh/v1/zones/{zone_id}/records",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://dns.basaltic.sh/v1/zones/{zone_id}/records"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://dns.basaltic.sh/v1/zones/{zone_id}/records")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://dns.basaltic.sh/v1/zones/{zone_id}/records")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"records": [
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"crn": "crn:dns::my-account:zone/example.com/record/550e8400-e29b-41d4-a716-446655440000",
"name": "www.example.com",
"type": "A",
"ttl": 300,
"values": [
{
"content": "203.0.113.10",
"disabled": false
},
{
"content": "203.0.113.11",
"disabled": false
}
],
"managed": false
}
],
"meta": {
"total": 150,
"limit": 20,
"marker": "550e8400-e29b-41d4-a716-446655440000",
"has_more": true
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}List records
List records in a DNS zone, newest-RRset-first. Supports
filtering by type and an exact match on name. Keyset-
paginated by record id (UUIDv7) — pass the last id from the
previous page as marker.
Returns your records only. The rows the platform stamps for
itself — the SOA, the apex NS, and the DNSSEC set (DNSKEY, DS,
NSEC/NSEC3, NSEC3PARAM, RRSIG, CDS, CDNSKEY) — are left
out unless you ask for them. On a signed zone they outnumber
customer records, none of them can be edited or deleted, and the
DNSSEC material you might actually want is on the zone itself under
dnssec.
Pass include_managed=true to get the zone exactly as it is
served, which is what a zone-diffing tool wants.
curl --request GET \
--url https://dns.basaltic.sh/v1/zones/{zone_id}/records \
--header 'Authorization: Bearer <token>'import requests
url = "https://dns.basaltic.sh/v1/zones/{zone_id}/records"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://dns.basaltic.sh/v1/zones/{zone_id}/records', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://dns.basaltic.sh/v1/zones/{zone_id}/records",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://dns.basaltic.sh/v1/zones/{zone_id}/records"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://dns.basaltic.sh/v1/zones/{zone_id}/records")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://dns.basaltic.sh/v1/zones/{zone_id}/records")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"records": [
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"crn": "crn:dns::my-account:zone/example.com/record/550e8400-e29b-41d4-a716-446655440000",
"name": "www.example.com",
"type": "A",
"ttl": 300,
"values": [
{
"content": "203.0.113.10",
"disabled": false
},
{
"content": "203.0.113.11",
"disabled": false
}
],
"managed": false
}
],
"meta": {
"total": 150,
"limit": 20,
"marker": "550e8400-e29b-41d4-a716-446655440000",
"has_more": true
}
}{
"error": {
"code": "UNAUTHORIZED",
"message": "Authentication required",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "ACCESS_DENIED",
"message": "You don't have permission to perform this action",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "NOT_FOUND",
"message": "Resource not found",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}{
"error": {
"code": "INTERNAL_ERROR",
"message": "An internal error occurred",
"request_id": "550e8400-e29b-41d4-a716-446655440000"
}
}dns:ListRecords. See DNS permissions for the full list, what each one covers, and an example policy.Authorizations
An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>.
This is the recommended way to authenticate.
Get one by exchanging a service account's access key pair at
POST /v1/oauth/token with grant_type=client_credentials. It is the
standard client-credentials grant, so any OAuth-aware library will
obtain and refresh it for you.
curl -s -u "$KEY_ID:$SECRET" -d grant_type=client_credentials \ https://iam.basaltic.sh/v1/oauth/token
Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.
Path Parameters
DNS Zone ID
Query Parameters
Exact record type to filter by (e.g. A, MX).
"A"
Exact record name, lowercased with an optional trailing dot removed.
"www.example.com"
Exact nested record CRN. Foreign or mismatched CRNs return an empty page; combined with name before pagination.
Include the platform-stamped rows (SOA, apex NS, and the DNSSEC set) alongside your own. Off by default — they cannot be edited or deleted, and on a signed zone there are more of them than there are of yours.
false
1 <= x <= 50050
Resume token — the last record id from the previous page.
"550e8400-e29b-41d4-a716-446655440000"

