CustomDomain Meta API

openapi: 3.2.0
info:
  title: Customdomain Ai Meta API
  version: '1.0'
  license:
    name: Apache-2.0
    identifier: Apache-2.0
  description: 'Operations tagged Meta across 2 of this provider''s published API definitions: customdomain-ai-openapi-original.json, customdomain-ai-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.customdomain.ai/v1
  description: Hosted control-plane
- url: http://localhost:8080/v1
  description: Local control-plane
security:
- apiKey: []
tags:
- name: Meta
  description: Public service discovery and capability advertisement.
paths:
  /openapi.json:
    get:
      operationId: getOpenAPISpec
      summary: This OpenAPI document
      tags:
      - Meta
      security: []
      description: Returns this specification as JSON. Public and unauthenticated, cached for 5 minutes. It is the same document published at `apps/app/openapi-v1.yaml`, converted to JSON at build time and embedded in the binary, so the served copy can never drift from the source.
      responses:
        '200':
          description: The OpenAPI 3.1 document.
          content:
            application/json:
              schema:
                type: object
    servers:
    - url: https://api.customdomain.ai/v1
      description: Hosted control-plane
    - url: http://localhost:8080/v1
      description: Local control-plane
  /config:
    get:
      operationId: getConfig
      summary: Public service discovery (advertised products and version)
      tags:
      - Meta
      security: []
      responses:
        '200':
          description: Service capabilities
          content:
            application/json:
              schema:
                type: object
                properties:
                  service:
                    type: string
                  env:
                    $ref: '#/components/schemas/Environment'
                  version:
                    type: string
                  api_version:
                    type: string
                    examples:
                    - v1
                  products:
                    type: array
                    description: The products THIS deployment actually serves, not the full catalog. "connect" and "mcp" are always present; "secure" appears only when SECURE_ENABLED is set, "power" only when POWER_ENABLED is set, "sell" only when a registrar is configured, and "monitor" only when a DNS resolver is wired. Absent products answer 503 not-configured on every route. Per-tenant plan entitlements are not reflected here; this endpoint is unauthenticated.
                    items:
                      type: string
                    examples:
                    - - connect
                      - secure
                      - sell
                      - power
                      - monitor
                      - mcp
    servers:
    - url: https://api.customdomain.ai/v1
      description: Hosted control-plane
    - url: http://localhost:8080/v1
      description: Local control-plane
components:
  schemas:
    Environment:
      type: string
      enum:
      - production
      - staging
      - development
  securitySchemes:
    managementKey:
      type: http
      scheme: bearer
      description: Operator management key. Gates provisioning + reads across tenants.
    provisionSecret:
      type: apiKey
      in: header
      name: X-Provision-Secret
      description: Narrow secret held by the customer console's server, for signup provisioning and its other server to server calls (also accepted as a Bearer token, except on POST /audit, where a Bearer is always a tenant credential).
    apiKey:
      type: http
      scheme: bearer
      description: Long-lived tenant API key, cd_live_… (production) or cd_test_… (staging, development), stored hashed. Keys created before the switch to cd_ start with sk_live_… / sk_test_… and are still accepted. Scoped to the owning application's tenant.
    widgetJWT:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Short-lived widget JWT minted server-side via POST /v1/tokens. Scoped to one application (and optionally one domain).
    browserSession:
      type: http
      scheme: bearer
      description: The session token of one cloud browser sign in, returned by `POST /browser-sessions:redeem`. It binds one session, one connection and one workspace, lives at most as long as the session, and stops working the moment the session ends. It lives in the popup's memory only.
    agentToken:
      type: oauth2
      description: 'A delegated agent access token: an ES256 JWT that lives 15 minutes, sent as a bearer token. A person approves an agent in the console and the agent exchanges its authorization code (with PKCE) at the token endpoint. The token carries the workspace, the one application the grant is bound to, the grant, the approved scopes and its audience, and is verified against `/.well-known/jwks.json`. A route that accepts it lists the scope it needs; a token without the scope is refused with `403`, and a connection or order of another application answers `404`.'
      flows:
        authorizationCode:
          authorizationUrl: https://api.customdomain.ai/oauth/agent/authorize
          tokenUrl: https://api.customdomain.ai/oauth/agent/token
          refreshUrl: https://api.customdomain.ai/oauth/agent/token
          scopes:
            domains:read: Look at availability, connections, records, certificates, diagnoses, orders and the billing standing.
            domains:connect: Connect a domain, recheck it, reapply its records and start a one click setup.
            domains:disconnect: Remove a connected domain. The call must name the domain.
            domains:purchase: Buy a domain, up to the grant's monthly spend cap.
x-refined-from:
- customdomain-ai-openapi-original.json
- customdomain-ai-openapi.yml