Cloudflare DNSSEC API

openapi: 3.2.0
info:
  title: Cloudflare DNSSEC API
  version: '1.0'
  description: 'Operations tagged DNSSEC across 2 of this provider''s published API definitions: cloudflare-dns-openapi.yml, cloudflare-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.cloudflare.com/client/v4
  description: Cloudflare API v4 Production Server
tags:
- name: DNSSEC
  description: Manage DNSSEC settings for a zone to protect against DNS spoofing.
paths:
  /zones/{zone_id}/dnssec:
    get:
      operationId: getDnssecSettings
      summary: Cloudflare Get Dnssec Settings
      description: Retrieve the current DNSSEC settings for the zone including status, algorithm, digest, and DS record details.
      tags:
      - DNSSEC
      parameters:
      - $ref: '#/components/parameters/ZoneId'
      responses:
        '200':
          description: DNSSEC settings retrieved successfully.
        '401':
          description: Unauthorized.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - bearerAuth: []
    patch:
      operationId: updateDnssecSettings
      summary: Cloudflare Update Dnssec Settings
      description: Update DNSSEC configuration for the zone such as enabling or disabling DNSSEC.
      tags:
      - DNSSEC
      parameters:
      - $ref: '#/components/parameters/ZoneId'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                status:
                  type: string
                  enum:
                  - active
                  - disabled
                  description: Desired DNSSEC status.
            examples:
              UpdatednssecsettingsRequestExample:
                summary: Default updateDnssecSettings request
                x-microcks-default: true
                value:
                  status: active
      responses:
        '200':
          description: DNSSEC settings updated successfully.
        '401':
          description: Unauthorized.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - bearerAuth: []
    delete:
      operationId: deleteDnssecSettings
      summary: Cloudflare Delete Dnssec Settings
      description: Remove DNSSEC configuration from the zone.
      tags:
      - DNSSEC
      parameters:
      - $ref: '#/components/parameters/ZoneId'
      responses:
        '200':
          description: DNSSEC settings deleted successfully.
        '401':
          description: Unauthorized.
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - bearerAuth: []
    servers:
    - url: https://api.cloudflare.com/client/v4
      description: Cloudflare API v4 Production Server
  /zones/{zone_id}/dnssec/zsk:
    get:
      operationId: dnssec-list-dnssec-zsks
      summary: List DNSSEC ZSKs
      description: List the Zone Signing Keys (ZSKs) that DNSSEC uses for the zone.
      parameters:
      - name: zone_id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/dnssec_identifier'
      responses:
        '200':
          description: List DNSSEC ZSKs response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dnssec_dnssec_zsk_response_collection'
        4XX:
          description: List DNSSEC ZSKs response failure.
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/dnssec_dnssec_zsk_response_collection'
                - $ref: '#/components/schemas/dnssec_api-response-common-failure'
      security:
      - api_token: []
      - api_email: []
        api_key: []
      tags:
      - DNSSEC
      x-api-token-group:
      - DNS Read
      - DNS Write
      x-cfPlanAvailability:
        business: true
        enterprise: true
        free: true
        pro: true
      x-fern-availability: generally-available
      x-fern-sdk-group-name: dns.dnssec.list
      x-fern-sdk-method-name: zsks
    servers:
    - description: Client API
      url: https://api.cloudflare.com/client/v4
components:
  parameters:
    ZoneId:
      name: zone_id
      in: path
      required: true
      description: The unique identifier of the zone.
      schema:
        type: string
  schemas:
    dnssec_modified_on:
      description: When DNSSEC was last modified.
      type:
      - string
      - 'null'
      format: date-time
      example: '2014-01-01T05:20:00Z'
      readOnly: true
      x-auditable: true
    dnssec_delete_dnssec_response_single:
      allOf:
      - $ref: '#/components/schemas/dnssec_api-response-single'
      - properties:
          result:
            type: string
            example: ''
        type: object
    dnssec_dnskey_record_header:
      type: object
      properties:
        Class:
          type:
          - integer
          - 'null'
          example: 1
          readOnly: true
        Name:
          type:
          - string
          - 'null'
          example: example.com.
          readOnly: true
        Rdlength:
          type:
          - integer
          - 'null'
          example: 0
          readOnly: true
        Rrtype:
          type:
          - integer
          - 'null'
          example: 48
          readOnly: true
        Ttl:
          type:
          - integer
          - 'null'
          example: 3600
          readOnly: true
    dnssec_dnssec:
      type: object
      properties:
        algorithm:
          $ref: '#/components/schemas/dnssec_algorithm'
        digest:
          $ref: '#/components/schemas/dnssec_digest'
        digest_algorithm:
          $ref: '#/components/schemas/dnssec_digest_algorithm'
        digest_type:
          $ref: '#/components/schemas/dnssec_digest_type'
        dnssec_multi_signer:
          $ref: '#/components/schemas/dnssec_dnssec_multi_signer'
        dnssec_presigned:
          $ref: '#/components/schemas/dnssec_dnssec_presigned'
        dnssec_use_nsec3:
          $ref: '#/components/schemas/dnssec_dnssec_use_nsec3'
        ds:
          $ref: '#/components/schemas/dnssec_ds'
        flags:
          $ref: '#/components/schemas/dnssec_flags'
        key_tag:
          $ref: '#/components/schemas/dnssec_key_tag'
        key_type:
          $ref: '#/components/schemas/dnssec_key_type'
        modified_on:
          $ref: '#/components/schemas/dnssec_modified_on'
        public_key:
          $ref: '#/components/schemas/dnssec_public_key'
        status:
          $ref: '#/components/schemas/dnssec_status'
    dnssec_dnskey_record:
      type: object
      properties:
        Algorithm:
          type:
          - integer
          - 'null'
          example: 13
          readOnly: true
        Flags:
          type:
          - integer
          - 'null'
          example: 256
          readOnly: true
        Hdr:
          $ref: '#/components/schemas/dnssec_dnskey_record_header'
        Protocol:
          type:
          - integer
          - 'null'
          example: 3
          readOnly: true
        PublicKey:
          type:
          - string
          - 'null'
          example: oXiGYrSTO+LSCJ3mohc8EP+CzF9KxBj8/ydXJ22pKuZP3VAC3/Md/k7xZfz470CoRyZJ6gV6vml07IC3d8xqhA==
          readOnly: true
    dnssec_digest_algorithm:
      description: Type of digest algorithm.
      type:
      - string
      - 'null'
      example: SHA256
      readOnly: true
      x-auditable: true
    dnssec_flags:
      description: Flag for DNSSEC record.
      type:
      - number
      - 'null'
      example: 257
      readOnly: true
      x-auditable: true
    dnssec_dnssec_multi_signer:
      description: 'If true, multi-signer DNSSEC is enabled on the zone, allowing multiple

        providers to serve a DNSSEC-signed zone at the same time.

        This is required for DNSKEY records (except those automatically

        generated by Cloudflare) to be added to the zone.


        See [Multi-signer DNSSEC](https://developers.cloudflare.com/dns/dnssec/multi-signer-dnssec/) for details.'
      type: boolean
      example: false
      x-auditable: true
    dnssec_api-response-single:
      type: object
      allOf:
      - $ref: '#/components/schemas/dnssec_api-response-common'
    dnssec_dnskey_signing_key:
      type: object
      properties:
        kek:
          description: Key encryption key name used to encrypt the private key.
          type:
          - string
          - 'null'
          example: edge_kek_default
          readOnly: true
        privkey:
          description: Encrypted private key material for the signing key.
          type:
          - string
          - 'null'
          format: byte
          example: U3ZlbidzIHZlcnkgc2VjcmV0IGtleQ==
          readOnly: true
        pubkey:
          description: Public key content associated with the signing key.
          type:
          - string
          - 'null'
          example: 256 3 13 oXiGYrSTO+LSCJ3mohc8EP+CzF9KxBj8/ydXJ22pKuZP3VAC3/Md/k7xZfz470CoRyZJ6gV6vml07IC3d8xqhA==
          readOnly: true
    dnssec_algorithm:
      description: Algorithm key code.
      type:
      - string
      - 'null'
      example: '13'
      readOnly: true
      x-auditable: true
    dnssec_public_key:
      description: Public key for DS record.
      type:
      - string
      - 'null'
      example: oXiGYrSTO+LSCJ3mohc8EP+CzF9KxBj8/ydXJ22pKuZP3VAC3/Md/k7xZfz470CoRyZJ6gV6vml07IC3d8xqhA==
      readOnly: true
      x-auditable: true
    dnssec_dnssec_use_nsec3:
      description: 'If true, enables the use of NSEC3 together with DNSSEC on the zone.

        Combined with setting dnssec_presigned to true, this enables the use of

        NSEC3 records when transferring in from an external provider.

        If dnssec_presigned is instead set to false (default), NSEC3 records will be

        generated and signed at request time.


        See [DNSSEC with NSEC3](https://developers.cloudflare.com/dns/dnssec/enable-nsec3/) for details.'
      type: boolean
      example: false
      x-auditable: true
    dnssec_digest_type:
      description: Coded type for digest algorithm.
      type:
      - string
      - 'null'
      example: '2'
      readOnly: true
      x-auditable: true
    dnssec_digest:
      description: Digest hash.
      type:
      - string
      - 'null'
      example: 48E939042E82C22542CB377B580DFDC52A361CEFDC72E7F9107E2B6BD9306A45
      readOnly: true
      x-auditable: true
    dnssec_dnssec_presigned:
      description: 'If true, allows Cloudflare to transfer in a DNSSEC-signed zone

        including signatures from an external provider, without requiring

        Cloudflare to sign any records on the fly.


        Note that this feature has some limitations.

        See [Cloudflare as Secondary](https://developers.cloudflare.com/dns/zone-setups/zone-transfers/cloudflare-as-secondary/setup/#dnssec) for details.'
      type: boolean
      example: true
      x-auditable: true
    dnssec_key_tag:
      description: Code for key tag.
      type:
      - number
      - 'null'
      example: 42
      readOnly: true
      x-auditable: true
    dnssec_key_storage_location:
      description: Storage backend where the DNSSEC key material is stored.
      type: string
      example: database
      enum:
      - database
      - vault
      x-auditable: true
    dnssec_dnssec_zsk:
      type: object
      properties:
        DNSKEY:
          $ref: '#/components/schemas/dnssec_dnskey_record'
        Location:
          $ref: '#/components/schemas/dnssec_key_storage_location'
        Name:
          description: Internal key name for the ZSK.
          type: string
          example: zsk_default
          readOnly: true
        SigningKey:
          $ref: '#/components/schemas/dnssec_dnskey_signing_key'
        Tag:
          $ref: '#/components/schemas/dnssec_dnssec_key_state'
    dnssec_api-response-common-failure:
      type: object
      properties:
        errors:
          example:
          - code: 7003
            message: No route for the URI
          allOf:
          - $ref: '#/components/schemas/dnssec_messages'
          minLength: 1
        messages:
          example: []
          allOf:
          - $ref: '#/components/schemas/dnssec_messages'
        result:
          type:
          - object
          - 'null'
          enum:
          - null
        success:
          description: Whether the API call was successful.
          type: boolean
          example: false
          enum:
          - false
      required:
      - success
      - errors
      - messages
      - result
    dnssec_key_type:
      description: Algorithm key type.
      type:
      - string
      - 'null'
      example: ECDSAP256SHA256
      readOnly: true
      x-auditable: true
    dnssec_api-response-common:
      type: object
      properties:
        errors:
          $ref: '#/components/schemas/dnssec_messages'
        messages:
          $ref: '#/components/schemas/dnssec_messages'
        success:
          description: Whether the API call was successful.
          type: boolean
          example: true
          enum:
          - true
      required:
      - success
      - errors
      - messages
    dnssec_dnssec_key_state:
      description: Lifecycle state tag attached to the DNSSEC key.
      type: string
      example: active
      enum:
      - active
      - publish
      - external
      - retired
      - revoked
      - removed
      x-auditable: true
    dnssec_dnssec_zsk_response_collection:
      allOf:
      - $ref: '#/components/schemas/dnssec_api-response-single'
      - properties:
          result:
            type: array
            items:
              $ref: '#/components/schemas/dnssec_dnssec_zsk'
        type: object
    dnssec_dnssec_response_single:
      allOf:
      - $ref: '#/components/schemas/dnssec_api-response-single'
      - properties:
          result:
            $ref: '#/components/schemas/dnssec_dnssec'
        type: object
    dnssec_status:
      description: Status of DNSSEC, based on user-desired state and presence of necessary records.
      example: active
      enum:
      - active
      - pending
      - disabled
      - pending-disabled
      - error
      x-auditable: true
    dnssec_identifier:
      description: Identifier.
      type: string
      example: 023e105f4ecef8ad9ca31a8372d0c353
      maxLength: 32
      x-auditable: true
    dnssec_messages:
      type: array
      items:
        properties:
          code:
            type: integer
            minimum: 1000
          documentation_url:
            type: string
          message:
            type: string
          source:
            type: object
            properties:
              pointer:
                type: string
        required:
        - code
        - message
        type: object
        uniqueItems: true
      example: []
    dnssec_ds:
      description: Full DS record.
      type:
      - string
      - 'null'
      example: example.com. 3600 IN DS 16953 13 2 48E939042E82C22542CB377B580DFDC52A361CEFDC72E7F9107E2B6BD9306A45
      readOnly: true
      x-auditable: true
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API token authentication. Generate a token from the Cloudflare dashboard with appropriate permissions.
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-Auth-Key
      description: Global API key paired with X-Auth-Email header for authentication.
    api_email:
      in: header
      name: X-Auth-Email
      type: apiKey
    api_key:
      in: header
      name: X-Auth-Key
      type: apiKey
    api_token:
      scheme: bearer
      type: http
    user_service_key:
      in: header
      name: X-Auth-User-Service-Key
      type: apiKey
x-refined-from:
- cloudflare-dns-openapi.yml
- cloudflare-openapi.json
x-provenance:
  method: harvested
  publisher: Cloudflare
  source: https://developers.cloudflare.com/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)