# Tools

Part of AppEngine API Documentation. Full index: https://appengine.appmint.io/documentation.md
## POST /tools/tailwind-css/{siteName}/{pageName}

**Generate Tailwind CSS for a page**

`operationId: ToolsController_tailwindCss`

Builds the Tailwind stylesheet a page actually needs from its markup — the compile step behind a published page.

#### Signature

```http
POST /tools/tailwind-css/{siteName}/{pageName} (siteName: string, pageName: string, body) -> The generated CSS
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/tailwind-map/{siteName}/{pageName}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `siteName` | path | string | yes | Site name. |
| `pageName` | path | string | yes | Page name. |

### Request body

The page markup or build options.

```json
{
  "html": "<div class=\"p-4 text-lg\">…</div>"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The generated CSS |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/tailwind-map/{siteName}/{pageName}

**Generate a Tailwind class map for a page**

`operationId: ToolsController_tailwindMap`

Returns the class-to-rule map for a page, for tooling that needs to know which utilities resolved to what.

#### Signature

```http
POST /tools/tailwind-map/{siteName}/{pageName} (siteName: string, pageName: string, body) -> The class map
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/tailwind-css/{siteName}/{pageName}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `siteName` | path | string | yes | Site name. |
| `pageName` | path | string | yes | Page name. |

### Request body

The page markup or build options.

```json
{
  "html": "<div class=\"p-4\">…</div>"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The class map |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/default-templates

**List default templates**

`operationId: ToolsController_listDefaultTemplates`

The built-in site templates, optionally filtered by delivery type.

#### Signature

```http
GET /tools/default-templates (deliveryType?: string) -> Templates
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/default-templates/{name}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `deliveryType` | query | string | — |  |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Templates |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/default-templates/{name}

**Get a default template**

`operationId: ToolsController_getDefaultTemplate`

One built-in template by name.

#### Signature

```http
GET /tools/default-templates/{name} (name: string) -> The template
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/default-templates`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `name` | path | string | yes | Template name. |
| `variant` | query | string | yes |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The template |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/index-site/{siteName}

**Index a site**

`operationId: ToolsController_indexSite`

Rebuilds the search index for a site. Worth running after a bulk content change; on a large site it is not cheap.

#### Signature

```http
POST /tools/index-site/{siteName} (siteName: string) -> The indexing result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/create-page-image/{siteName}/{pageName}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `siteName` | path | string | yes | Site name. |

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The indexing result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/create-page-image/{siteName}/{pageName}

**Generate a page image**

`operationId: ToolsController_generatePageImage`

Renders a page to an image — the preview or social card for it. Rendering a page is slow, so treat this as a background job rather than a request-path call.

#### Signature

```http
POST /tools/create-page-image/{siteName}/{pageName} (siteName: string, pageName: string, body) -> The generated image
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/create-site-favicon/{siteName}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `siteName` | path | string | yes | Site name. |
| `pageName` | path | string | yes | Page name. |

### Request body

Rendering options.

```json
{
  "width": 1200,
  "height": 630
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The generated image |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/web-visit-direct

**Record a direct web visit**

`operationId: ToolsController_webVisitDirect`

Records a page view measured from this request: the caller's IP, user agent and forwarding headers are read here and merged with `data`. `data.url` must be the full page URL — a missing or relative URL, or one on the API's own host, is ignored. Answers `true` when recorded (or already recorded), `false` when ignored.

Visits from bots, crawlers, scanners and uptime probes, requests for files or probe paths (assets, `.env`, `wp-*`, `_next`, `static/chunks`), local development hosts, internal IPs, and any IP past 60 visits a minute are dropped without error — the call answers `false`. An identical visit within 30 seconds is recorded once. Location is looked up from the IP before the row is written.

#### Signature

```http
POST /tools/web-visit-direct (body) -> `true` recorded, `false` ignored
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/web-visit-indirect`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The visit.

```json
{
  "data": {
    "url": "https://shop.example.com/pricing?utm_source=facebook",
    "referrer": "https://www.facebook.com/",
    "pageTitle": "Pricing",
    "deviceId": "dev_7Kq2M9"
  }
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | `true` recorded, `false` ignored |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/web-visit-indirect

**Record a page view from the browser**

`operationId: ToolsController_webVisitIndirect`

The page-view beacon — base-app's browser tracker sends one per view (pageview, unload, click and chat events alike, by `data.type`), and it is the only place a page view is recorded. A browser cannot see its own IP, so when base-app's proxy forwards `x-client-info` its IP, user agent and site fill whatever `data` left out; what the page sent wins. The site (`configSite` / `host`) must belong to the org, except for `source: "chat-client"` events. Answers `true` when recorded (or already recorded in the last 30 seconds), `false` when ignored.

Visits from bots, crawlers, scanners and uptime probes, requests for files or probe paths (assets, `.env`, `wp-*`, `_next`, `static/chunks`), local development hosts, internal IPs, and any IP past 60 visits a minute are dropped without error — the call answers `false`. An identical visit within 30 seconds is recorded once. Location is looked up from the IP before the row is written.

#### Signature

```http
POST /tools/web-visit-indirect (body) -> `true` recorded, `false` ignored
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Self-reported data on a public route — figures can be inflated by anyone; the filters above only stop the obvious.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | SITE_NOT_FOUND | Site not found: acme-shop shop.example.com  in org acme | The site named by `configSite` / `host` does not belong to the org (not checked for `source: "chat-client"`). | — |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/web-visit-direct`
- `GET /analytics/live-view`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `x-client-info` | header | string | — | JSON client context from base-app's proxy (real IP, user agent, host). Fills gaps in `data`. |

### Request body

The visit.

```json
{
  "data": {
    "url": "https://shop.example.com/news/summer-gala",
    "host": "shop.example.com",
    "configSite": "acme-shop",
    "type": "pageview",
    "deviceId": "dev_7Kq2M9",
    "sessionId": "ses_41"
  }
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | `true` recorded, `false` ignored |
| `404` | Site not found: acme-shop shop.example.com  in org acme — The site named by `configSite` / `host` does not belong to the org (not checked for `source: "chat-client"`). |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/web-activity

**Record web activity**

`operationId: ToolsController_webActivity`

Stores the body as a record in the org, after checking that `siteName` or `domain` names one of the org's sites. The body is written as sent — it is a full record, including its `datatype`.

#### Signature

```http
POST /tools/web-activity (body) -> Nothing (empty body)
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Public, and the body decides what is written — treat as unsafe until it is restricted to activity records.

#### Errors

| Status | Code | Message | When | What to do |
| --- | --- | --- | --- | --- |
| `404` | SITE_NOT_FOUND | Site not found: acme-shop in org acme | Neither `siteName` nor `domain` matches a site of the org. | — |

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/web-visit-indirect`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The record to store, with the site it belongs to.

```json
{
  "siteName": "acme-shop",
  "datatype": "web_visit",
  "data": {
    "type": "click",
    "url": "https://shop.example.com/pricing"
  }
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | Nothing (empty body) |
| `404` | Site not found: acme-shop in org acme — Neither `siteName` nor `domain` matches a site of the org. |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/create-site-favicon/{siteName}

**Generate a site favicon**

`operationId: ToolsController_createSiteFavicon`

Produces a favicon for a site from its branding.

#### Signature

```http
POST /tools/create-site-favicon/{siteName} (siteName: string, body) -> The favicon
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/create-page-image/{siteName}/{pageName}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `siteName` | path | string | yes | Site name. |

### Request body

Options.

```json
{}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The favicon |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/fake-generate

**Generate fake data**

`operationId: ToolsController_generateFakeData`

Produces synthetic records for a data type — for populating a demo or testing a UI.

It writes real records into the org, so pointing it at production creates data that has to be cleaned up afterwards.

#### Signature

```http
POST /tools/fake-generate (body) -> What was generated
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Writes records into the org.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/default-templates`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

What to generate.

```json
{
  "datatype": "customer",
  "count": 25
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | What was generated |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/search/{domainName}/{tld}

**Search for a domain**

`operationId: ToolsController_domainSearch`

Checks a domain's availability with the registrar, optionally returning suggestions. `tld` is an optional second segment; `provider` selects the registrar when more than one is configured.

#### Signature

```http
GET /tools/domain/search/{domainName}/{tld} (domainName: string, tld: string, suggest?: boolean, provider?: string) -> Availability and suggestions
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/search/advanced`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domainName` | path | string | yes | Name to check, without the TLD. |
| `tld` | path | string | yes | TLD. Optional. |
| `suggest` | query | boolean | — | Include alternative suggestions. |
| `provider` | query | string | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Availability and suggestions |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/search/advanced

**Search domains across TLDs**

`operationId: ToolsController_domainSearchAdvanced`

Checks several keywords against several TLDs in one call, with suggestions capped by `maxSuggestions` (default 50). Each keyword × TLD is a registrar lookup, so a wide search is a slow one.

#### Signature

```http
POST /tools/domain/search/advanced (body) -> Availability and suggestions
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/buy`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The search.

```json
{
  "keywords": [
    "acme",
    "acmeshop"
  ],
  "tlds": [
    "com",
    "io"
  ],
  "maxSuggestions": 20
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | Availability and suggestions |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/dns/add

**Add a DNS record**

`operationId: ToolsController_addDNSRecord`

Adds a record to a domain's zone. Live DNS: a wrong record can send traffic somewhere else or break mail delivery, and propagation means the mistake outlives the fix by the record's TTL.

#### Signature

```http
POST /tools/domain/dns/add (body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Changes live DNS.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/dns/modify`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The record.

```json
{
  "domain": "example.com",
  "type": "A",
  "name": "www",
  "values": [
    "203.0.113.10"
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/dns/modify

**Modify a DNS record**

`operationId: ToolsController_modifyDNSRecord`

Changes an existing DNS record. Same caution as adding one — this is live resolution, and MX or A record mistakes are outages.

#### Signature

```http
POST /tools/domain/dns/modify (body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Changes live DNS.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/dns/delete`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The record change.

```json
{
  "domain": "example.com",
  "type": "A",
  "name": "www",
  "values": [
    "203.0.113.11"
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/dns/delete

**Delete a DNS record**

`operationId: ToolsController_deleteDNSRecord`

Removes a DNS record. Deleting an A or MX record takes a site or its mail off the internet immediately — read the zone first.

#### Signature

```http
POST /tools/domain/dns/delete (body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Removes live DNS resolution.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/dns/{domainName}/{type}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Which record.

```json
{
  "domain": "example.com",
  "type": "A",
  "name": "www"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/dns/{domainName}/{type}

**Get DNS records**

`operationId: ToolsController_getDNSRecords`

The DNS records for a domain, optionally narrowed to one record type.

#### Signature

```http
GET /tools/domain/dns/{domainName}/{type} (domainName: string, type: string, provider?: string) -> DNS records
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/dns/add`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domainName` | path | string | yes | Domain name. |
| `type` | path | string | yes | Record type — `A`, `CNAME`, `MX`. Optional. |
| `provider` | query | string | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | DNS records |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/buy

**Buy a domain**

`operationId: ToolsController_domainBuy`

Registers a domain with the registrar. **This spends money** and the registration is generally non-refundable — a typo in the domain name buys the typo.

On a public route, so treat access to this endpoint as the only control preventing arbitrary registrations against the account.

#### Signature

```http
POST /tools/domain/buy (body) -> The registration order
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Spends money; non-refundable.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/list/{domainName}/{orderId}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

What to register.

```json
{
  "domain": "acme.com",
  "years": 1,
  "provider": "namecheap"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The registration order |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/list/{domainName}/{orderId}

**List domains or get an order**

`operationId: ToolsController_domainList`

Lists registered domains; both path segments are optional, narrowing to one domain or one registration order.

#### Signature

```http
GET /tools/domain/list/{domainName}/{orderId} (domainName: string, orderId: string, provider?: string) -> Domains or the order
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/manage`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domainName` | path | string | yes | Optional domain filter. |
| `orderId` | path | string | yes | Optional order filter. |
| `provider` | query | string | — |  |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Domains or the order |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/manage

**Manage a domain**

`operationId: ToolsController_domainManage`

Registrar-side management — locks, auto-renew, contacts, nameservers. Changing nameservers moves where the domain resolves, which takes effect globally as caches expire.

#### Signature

```http
POST /tools/domain/manage (body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Nameserver changes affect live resolution.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/dns/{domainName}/{type}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The management action.

```json
{
  "domain": "example.com",
  "action": "setNameservers",
  "nameservers": [
    "ns1.example.net",
    "ns2.example.net"
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/presentation/to-pdf

**Convert a page to PDF**

`operationId: ToolsController_pageToPdf`

Renders a page to PDF. Rendering is slow — expect seconds, not milliseconds.

#### Signature

```http
POST /tools/presentation/to-pdf (body) -> The PDF result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/presentation/to-pptx`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

What to convert.

```json
{
  "siteName": "acme-shop",
  "pageName": "deck"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The PDF result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/presentation/to-pptx

**Convert a page to PowerPoint**

`operationId: ToolsController_pageToPptx`

Renders a page to a PPTX deck.

#### Signature

```http
POST /tools/presentation/to-pptx (body) -> The PPTX result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/presentation/to-pdf`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

What to convert.

```json
{
  "siteName": "acme-shop",
  "pageName": "deck"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The PPTX result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/presentation/publish

**Publish an HTML presentation**

`operationId: ToolsController_hostHtmlPresentation`

Hosts an HTML presentation at a shareable URL. **The published page is publicly reachable** by anyone with the link — do not publish anything confidential.

#### Signature

```http
POST /tools/presentation/publish (body) -> The hosted presentation and its URL
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Publishes to a public URL.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/presentation/unpublish`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The presentation.

```json
{
  "name": "q3-review",
  "html": "<html>…</html>"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The hosted presentation and its URL |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/presentation/unpublish

**Unpublish a hosted presentation**

`operationId: ToolsController_removeHostedPresentation`

Removes a hosted presentation, so its URL stops resolving. Anyone who already downloaded it keeps their copy.

#### Signature

```http
POST /tools/presentation/unpublish (body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/presentation/publish`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Which presentation.

```json
{
  "name": "q3-review"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/email-templates

**List default email templates**

`operationId: ToolsController_listEmailTemplates`

The platform's built-in email templates — the registry an org customises from, not the org's own overrides.

#### Signature

```http
GET /tools/email-templates () -> Templates
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/email-templates/{name}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Templates |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/email-templates/{name}

**Get a default email template**

`operationId: ToolsController_getEmailTemplate`

One built-in email template by name, with its body.

#### Signature

```http
GET /tools/email-templates/{name} (name: string) -> The template
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/email-templates`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `name` | path | string | yes | Template name. |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The template |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/remove-background

**Remove an image background by URL**

`operationId: ToolsController_removeBackground`

Fetches an image by URL and returns it with the background removed.

The server fetches whatever URL it is given, which on a public route makes this usable to probe hosts the server can reach — treat the URL as untrusted input.

#### Signature

```http
POST /tools/remove-background (body) -> The processed image
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Server-side fetch of a caller-supplied URL.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/remove-background-file`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The image URL.

```json
{
  "url": "https://cdn.example.com/product.jpg"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The processed image |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/remove-background-file

**Remove an image background from an upload**

`operationId: ToolsController_removeBackgroundFromFile`

Takes an uploaded image as `multipart/form-data` under the field name `file` and returns it with the background removed. The safer of the two forms, since nothing is fetched by the server.

#### Signature

```http
POST /tools/remove-background-file (body) -> The processed image
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/remove-background`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

Multipart form with a `file` field.

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The processed image |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/cloudflare/zone/create

**Create a Cloudflare zone**

`operationId: ToolsController_createCloudflareZone`

Creates a zone in Cloudflare for a domain. The zone is not live until the domain's nameservers point at the ones Cloudflare issues.

#### Signature

```http
POST /tools/domain/cloudflare/zone/create (body) -> The zone, with its nameservers
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/cloudflare/zone/{domain}/nameservers`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The domain.

```json
{
  "domain": "example.com"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The zone, with its nameservers |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/cloudflare/zone/{domain}

**Get a Cloudflare zone**

`operationId: ToolsController_getCloudflareZone`

The zone record for a domain.

#### Signature

```http
GET /tools/domain/cloudflare/zone/{domain} (domain: string) -> The zone
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/cloudflare/zone/{domain}/activation`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The zone |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/cloudflare/zone/{domain}/activation

**Check Cloudflare zone activation**

`operationId: ToolsController_checkCloudflareActivation`

Whether Cloudflare has seen the domain's nameservers change and activated the zone. Activation is what makes proxying and SSL start working, and it is not instant.

#### Signature

```http
GET /tools/domain/cloudflare/zone/{domain}/activation (domain: string) -> Activation status
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/cloudflare/zone/{domain}/nameservers`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Activation status |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/cloudflare/zone/{domain}/nameservers

**Get Cloudflare nameservers**

`operationId: ToolsController_getCloudflareNameservers`

The nameservers Cloudflare assigned to the zone — what has to be set at the registrar for the zone to activate.

#### Signature

```http
GET /tools/domain/cloudflare/zone/{domain}/nameservers (domain: string) -> The nameservers
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/manage`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | The nameservers |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/cloudflare/zone/{domain}/nameservers

**Update Cloudflare nameservers**

`operationId: ToolsController_updateCloudflareNameservers`

Points the domain's nameservers at Cloudflare. This is the switch that moves DNS authority; until caches expire, both the old and new answers circulate.

#### Signature

```http
POST /tools/domain/cloudflare/zone/{domain}/nameservers (domain: string, body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Moves DNS authority for the domain.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/cloudflare/zone/{domain}/activation`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Request body

The nameservers.

```json
{}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/cloudflare/transfer

**Transfer a domain to Cloudflare**

`operationId: ToolsController_transferToCloudflare`

Starts a registrar transfer into Cloudflare. Transfers are slow, need an auth code, and are refused inside 60 days of registration — check the status endpoint rather than expecting an immediate result.

#### Signature

```http
POST /tools/domain/cloudflare/transfer (body) -> The transfer
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Registrar transfer — slow and gated by registry rules.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/cloudflare/transfer/{domain}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The transfer.

```json
{
  "domain": "example.com",
  "authCode": "<auth code>"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The transfer |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/cloudflare/transfer/{domain}

**Get Cloudflare transfer status**

`operationId: ToolsController_getCloudflareTransferStatus`

Where a registrar transfer has got to.

#### Signature

```http
GET /tools/domain/cloudflare/transfer/{domain} (domain: string) -> Transfer status
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/cloudflare/transfer`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | Transfer status |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## GET /tools/domain/cloudflare/ssl/{domain}

**Get Cloudflare SSL settings**

`operationId: ToolsController_getCloudflareSSL`

The zone's SSL mode and certificate state.

#### Signature

```http
GET /tools/domain/cloudflare/ssl/{domain} (domain: string) -> SSL settings
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/cloudflare/ssl/{domain}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Responses

| Status | Meaning |
| --- | --- |
| `200` | SSL settings |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/cloudflare/ssl/{domain}

**Update Cloudflare SSL settings**

`operationId: ToolsController_setCloudflareSSL`

Changes the zone's SSL mode. Getting this wrong breaks the site for every visitor at once — `full (strict)` against an origin with no valid certificate returns errors to everyone, and `flexible` in front of an HTTPS origin can loop.

#### Signature

```http
POST /tools/domain/cloudflare/ssl/{domain} (domain: string, body) -> The result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- A wrong mode breaks the site immediately.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `GET /tools/domain/cloudflare/ssl/{domain}`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |
| `domain` | path | string | yes | Domain name. |

### Request body

The SSL setting.

```json
{
  "mode": "full"
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |

## POST /tools/domain/cloudflare/dns/import

**Import DNS records into Cloudflare**

`operationId: ToolsController_importCloudflareDNS`

Bulk-imports records into a zone, typically from an existing provider's export. Import before switching nameservers — importing afterwards leaves a window where records are missing and the domain half-resolves.

#### Signature

```http
POST /tools/domain/cloudflare/dns/import (body) -> The import result
```

#### Access

Public — no credentials required.

#### Notes

- Unauthenticated — the entire `tools` controller is a public route.
- Import before the nameserver switch, not after.

#### Errors

Plus the standard platform errors: `429`, `500`.

#### See also

- `POST /tools/domain/cloudflare/zone/{domain}/nameservers`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgid` | header | string | yes | Organization (tenant) identifier. Every request is scoped to this org; data from other orgs is never visible. Issued with your API credentials. |

### Request body

The records to import.

```json
{
  "domain": "example.com",
  "records": [
    {
      "type": "A",
      "name": "www",
      "content": "203.0.113.10"
    }
  ]
}
```

### Responses

| Status | Meaning |
| --- | --- |
| `201` | The import result |
| `429` | Too Many Requests — More than 100,000 requests from one IP within 5 minutes (configurable per deployment). CORS preflights and requests from inside the platform cluster are not counted. The limiter answers before the error filter, so the body is `{ statusCode, error, message }` with no `path`, `method` or `timeStamp`; the `RateLimit-*` response headers say when the window resets. |
| `500` | An unexpected error occurred. Our team has been notified. — An unhandled server-side failure. |