DnsDiffResult

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/inboxguard-io/json-schema/inboxguard-io-dns-diff-result-schema.json",
  "title": "DnsDiffResult",
  "description": "The DNS fix plan returned by GET /domains/{id}/dns-diff. When `connected` is false, or no connected registrar manages the apex, `ops`/`manualReview` are empty and `reason` explains why.",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/inboxguard-io-openapi.json#/components/schemas/DnsDiffResult",
  "type": "object",
  "properties": {
    "connected": {
      "type": "boolean",
      "description": "Whether the org has any registrar connection (false = none configured)."
    },
    "connectionId": {
      "type": [
        "string",
        "null"
      ],
      "format": "uuid",
      "description": "The connection whose zone covers the apex — pass to POST /dns-apply. Null when no connection matches."
    },
    "provider": {
      "type": [
        "string",
        "null"
      ],
      "enum": [
        "cloudflare",
        "route53",
        "godaddy",
        "namecheap",
        null
      ],
      "description": "The matched registrar provider id."
    },
    "identity": {
      "type": [
        "string",
        "null"
      ],
      "description": "Human-readable identity of the matched connection (e.g. account/email)."
    },
    "apex": {
      "type": "string",
      "description": "The apex domain the diff was computed for."
    },
    "scan": {
      "type": "object",
      "description": "The scan the diff was derived from.",
      "properties": {
        "id": {
          "type": "string",
          "format": "uuid"
        },
        "runAt": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "ops": {
      "type": "array",
      "description": "The record changes to apply. Pass verbatim to POST /dns-apply.",
      "items": {
        "$ref": "#/$defs/DnsOp"
      }
    },
    "manualReview": {
      "type": "array",
      "description": "Fixes that need a human decision and can't be auto-applied (SPF sender list, DKIM keys, BIMI logo).",
      "items": {
        "type": "object",
        "additionalProperties": true
      }
    },
    "reason": {
      "type": "string",
      "description": "Present when ops is empty — why no auto-fix is available (no connection, or no connected registrar manages this zone)."
    }
  },
  "required": [
    "connected",
    "ops",
    "manualReview"
  ],
  "$defs": {
    "DnsOp": {
      "type": "object",
      "description": "One change in a DNS fix plan. `noop` ops describe records already correct and are skipped on apply.",
      "properties": {
        "kind": {
          "type": "string",
          "enum": [
            "create",
            "update",
            "delete",
            "noop"
          ]
        },
        "reason": {
          "type": "string",
          "maxLength": 500,
          "description": "Human-readable explanation of the change."
        },
        "before": {
          "anyOf": [
            {
              "$ref": "#/$defs/DnsRecord"
            },
            {
              "type": "null"
            }
          ],
          "description": "The record being replaced/deleted (null for create)."
        },
        "after": {
          "anyOf": [
            {
              "$ref": "#/$defs/DnsRecord"
            },
            {
              "type": "null"
            }
          ],
          "description": "The record being created/updated (null for delete)."
        }
      },
      "required": [
        "kind",
        "before",
        "after"
      ]
    },
    "DnsRecord": {
      "type": "object",
      "description": "A single DNS record in a fix-plan op.",
      "properties": {
        "id": {
          "type": "string",
          "description": "Provider-side record id (present on existing records; needed for update/delete)."
        },
        "name": {
          "type": "string",
          "minLength": 1,
          "maxLength": 253,
          "description": "Fully-qualified record name, e.g. _dmarc.example.com."
        },
        "type": {
          "type": "string",
          "enum": [
            "TXT",
            "CNAME",
            "A",
            "AAAA",
            "MX"
          ]
        },
        "value": {
          "type": "string",
          "minLength": 1,
          "maxLength": 4096
        },
        "ttl": {
          "type": [
            "integer",
            "null"
          ]
        },
        "priority": {
          "type": [
            "integer",
            "null"
          ],
          "description": "MX priority (null for non-MX)."
        }
      },
      "required": [
        "name",
        "type",
        "value"
      ]
    }
  }
}