run.domani/domani

Manually add an address to your suppression list so future sends skip it. Hard bounces and complaints are added automatically - use this for addresses you want to stop emailing. API: POST /api/suppressions.

Browse domains for sale on the Domani marketplace. Returns all active listings with prices. Use buy_domain to purchase a listed domain.

Buy a taken domain that's listed for sale on an aftermarket (Afternic/Sedo) at its buy-now price, natively - no external site. Use when search shows a domain with for_sale.buyable = true. Always confirm the price with the user first. Pass max_price to cap it. If the listing is make-offer only (not buyable), use acquire_domain (broker) to negotiate instead. Crypto/USDC works like buy_domain (402 -> pay -> retry with payment_tx).

Purchase one or more domains. Always confirm with the user before calling. Accepts a single domain or an array of up to 10 (card only for bulk). If the user wants to pay with crypto/USDC: call with payment_method: 'usdc' - you'll get a 402 with a wallet address and amount. Tell the user to send that amount in USDC, then once they give you the tx hash, retry with payment_tx and payment_chain. Don't explain protocol details to the user - just tell them the address, amount, and chain.

Stop watching a domain by cancelling a backorder. Only backorders in the 'watching' state can be cancelled.

Cancel an active domain acquisition request. Requires deals:write scope.

Cancel the user's Pro subscription. The subscription remains active until the end of the current billing period, then reverts to the free plan. Returns the cancellation date.

Check email DNS health for a domain: MX records, SPF, DMARC, DKIM. Auto-detects the email provider from MX records.

Run the same deliverability and abuse-safety checks used by send_email, without sending or consuming quota. Use this before authentication, payment, onboarding, or high-volume messages. API: POST /api/emails/{address}/deliverability-check.

Pre-check whether a domain can be transferred. Returns transfer price, eligibility status, and any blockers (unsupported TLD, ICANN waiting period, domain locked, etc.). Always call this before transfer_domain to verify eligibility and show the user the price.

Check the status of an inbound domain transfer. Returns detailed status (pending_owner, pending_admin, pending_registry, completed, cancelled) with actionable hints.

Give your agent a free identity at <handle>.domani.run - a live profile page, no domain purchase, instantly. The frictionless way to start; upgrade to your own real domain later. Optional name/bio/emoji/email/links.

Remove the catch-all on a domain. Email to unmatched addresses will be dropped again. API: DELETE /api/domains/{domain}/email/catch-all.

Copy the DNS setup of one domain you own onto another (e.g. brand.com → brand.dev with the same A/CNAME/MX). Merges by default (source wins on collisions, keeps the target's other records); set replace=true for an exact mirror.

Connect a domain to a hosting or email provider. Auto-detects provider from target, or accepts explicit provider name. For domains bought through the platform, DNS records are set automatically (status: dns_set). For imported domains (external registrar), returns the records as instructions to add manually (status: manual_setup_required). If the connect would REPLACE existing MX records pointing at another provider, it fails with MX_REPLACEMENT_REQUIRES_CONFIRMATION - preview with dry_run, confirm with the user, then retry with confirm_replace_mx. The response includes a next_steps array with provider-specific actions. Supported hosting: vercel, netlify, cloudflare-pages, github-pages, railway, fly. Email: google-workspace, fastmail, proton.

Place a backorder on a domain that is currently registered to someone else. We watch it and automatically register it for the user when it becomes available (drops) - availability is polled every few minutes. The user is charged only if the catch succeeds - no upfront fee. Requires a card on file or payment_method 'balance'. Confirm the domain with the user first. Best-effort: a contested drop may be taken by a specialized drop-catcher first.

Create a real IMAP/SMTP mailbox on a domain you own (connect Apple Mail, Thunderbird, or any mail client), instead of an API mailbox. Pass workspace_id to create it in a workspace you own and atomically adopt the domain boundary. Provisions the mailbox on our mail server, publishes DNS when we manage it, and returns the DNS records, mail client settings, and a one-time app password. API: POST /api/emails with kind=hosted.

Create an email address. Specify slug (required) and optionally domain. Pass workspace_id to create it inside a workspace you own; custom-domain creation atomically adopts the domain and all unscoped sibling mailboxes so a domain is never split. For custom domains: email DNS is auto-configured on first use. For imported domains (external registrar): returns DNS records to add manually at your registrar. For domani.run: omit domain. Max 5 mailboxes per account, 1 free @domani.run per user. Pass force=true to override existing email provider (Google Workspace, etc.). API: POST /api/emails with {address}.

Create an app password for a hosted mailbox, used as the password in a mail client. The secret is returned once - store it. API: POST /api/emails/{address}/credentials.

Create a new API token with optional scoped permissions and spend caps. The full key is returned only once - save it immediately. A token can only grant scopes it already has (scope attenuation) and spend caps at or below its own. Scopes: domains:read (GET /api/domains, GET /api/domains/{domain}, GET /api/domains/{domain}/dns, /dnssec, /status, /email/check, /auth-code, /transfer-away, /transfer-status, /analytics), domains:write (PUT /api/domains/{domain}/dns, POST/DELETE /api/domains/{domain}/dnssec, POST /connect, POST /verify, PUT /settings, PUT /parking, PUT/DELETE /api/domains/{domain}/for-sale, POST /api/domains/import, POST /import/verify), domains:transfer (POST /api/domains/buy, POST /transfer, POST /renew (involves payment, includes marketplace purchases)), tokens:read (GET /api/tokens), tokens:write (POST /api/tokens, DELETE /api/tokens/{id}), webhooks:read (GET /api/webhooks, GET /api/webhooks/{id}/deliveries), webhooks:write (POST /api/webhooks, PATCH /api/webhooks/{id}, DELETE /api/webhooks/{id}), email:read (GET /api/emails, /api/emails/{address}, /api/emails/{address}/messages, /api/emails/{address}/aliases, /api/domains/{domain}/email/status, /api/domains/{domain}/email/deliverability, /api/suppressions), email:write (POST /api/emails, POST /api/emails/{address}/send, POST /api/domains/{domain}/email/setup, aliases + catch-all, POST/DELETE /api/suppressions), email:delete (Permanently delete messages already in Trash. Moving messages to Trash only requires email:write. Grant this scope only to agents allowed to irreversibly erase email content), email:auth_secrets (Read messages classified as authentication mail (OTP / verification codes, password resets, magic links). Without it, email:read still lists them but subject and body come back redacted - so a stolen agent token can't harvest 2FA codes. Grant it only to agents that genuinely need to complete logins), account:read (GET /api/me, GET /api/agents/identity), account:write (DELETE /api/me, POST /api/billing/setup, POST /api/billing/subscribe, POST /api/billing/cancel, POST /api/me/resend-verification, POST/PATCH/DELETE /api/agents/identity), billing:read (GET /api/billing/invoices), search (GET /api/domains/search, /suggest, /whois, /dns-check, GET /api/tlds), deals:read (GET /api/deals, GET /api/deals/{id}), deals:write (POST /api/domains/sell, PATCH /api/deals/{id}), notifications:read (GET /api/notifications, GET /api/notifications/count), backorders:read (GET /api/backorders, GET /api/backorders/{id}), backorders:write (POST /api/backorders, DELETE /api/backorders/{id}). Use ['*'] for full access (default). When minting a token for a sub-agent that can buy, ALWAYS set max_per_tx/max_per_month.

Register a new webhook endpoint to receive event notifications. The URL must use HTTPS. Choose which events to subscribe to (e.g. domain.purchased, transfer.completed). The webhook secret is returned only once - save it to verify incoming payloads with HMAC-SHA256.

Remove a DNSSEC delegation-signer (DS) record at the registry by its key tag. Removing all DS records disables DNSSEC.

Delete a mailbox and all its messages (including attachments). Requires confirm=true. Call without confirm first to see what will be deleted. API: DELETE /api/emails/{address}.

Move an email message to Trash. This is reversible with update_email_messages action=restore. API: DELETE /api/emails/{address}/messages/{id}.

Move multiple messages to Trash. This is reversible with update_email_messages action=restore. API: POST /api/emails/{address}/messages/delete.

Delete a webhook endpoint. All pending deliveries will be cancelled. This action cannot be undone.

Fast DNS-based domain existence check. Tests if a name is taken across many TLDs at once (faster than search, no pricing). Returns 'taken' (definitely registered) and 'candidates' (potentially available). Use this to narrow down before calling search for pricing. Use preset: 'extended' to check 30+ creative/exotic TLDs when basic ones are all taken.

Check domain health: DNS propagation, SSL status, email (MX) configuration, and expiry date

As the buyer, pay the agreed price to create the escrow deal and start the transfer. Same payment methods as a purchase (card, USDC, x402). Requires domains:transfer scope. For a broker-sourced acquisition, if the agreed price is above the max_budget you set, this returns BUDGET_EXCEEDED - retry with confirm_over_budget: true to proceed anyway.

Forward an email message to another address. Includes the original message context (sender, date, subject, body). Optionally prepend a note. Subject is auto-prefixed with 'Fwd:'. API: POST /api/emails/{address}/messages/{id}/forward.

Get your account details, payment status, contact info status (has_contact), and referral code. Contact info must be set before purchasing domains.

Get the EPP/auth code needed to transfer a domain to another registrar. Automatically unlocks the domain if it's locked. Give this code to the new registrar to initiate the transfer.

Owner-agent read path: poll the current, anonymized state of a broker inquiry with your token before acting. Returns the domain, the buyer's offer on the table, whose move it is, and the actions available now. Never exposes the buyer's identity or budget.

Get a role-aware receipt/statement for a marketplace deal. Buyers see what they paid; sellers see the sale, the platform commission line, and the net payout. Works for every payment method. Requires deals:read scope.

Get DNS records for a domain you own. Returns each record with a stable id, plus a zone_version token - pass it to set_dns to detect concurrent zone changes.

List the DNSSEC delegation-signer (DS) records for a domain you own, and whether DNSSEC is enabled. Pair with TLSA records (via set_dns) for DANE.

Check if email is enabled on a domain and whether DNS records are verified. Returns record status and mailbox count.

Get detailed information about a domain you own, including auto-renew status, security lock, WHOIS privacy, and provider data.

Get website preview metadata (title, description, image, favicon) for any domain. Useful for understanding what a taken domain is currently used for. Data is cached for 7 days.

Get an owner-scoped email health report for a domain. Separates deterministic DNS readiness, 30-day bounce and complaint outcomes, account safety state, and measured inbox placement. A readiness score is not an Inbox probability. API: GET /api/domains/{domain}/email/deliverability.

Get IMAP/SMTP settings for a hosted mailbox to configure a mail client (Apple Mail, Thunderbird). Username is the full address; password is an app password. API: GET /api/emails/{address}/client-settings.

Get a single message by ID with full content, headers, delivery events, and attachment download URLs. API: GET /api/emails/{address}/messages/{id}.

Get the authoritative nameservers configured for a domain you own. If empty, DNS operations (parking, email, connect) will fail.

Get visitor analytics for a parked domain - page views, inquiries, conversion rate, 30-day daily breakdown, and the 5 most recent inquiries. Use this to check how much traffic a parked domain gets and whether it's converting into buyer inquiries.

Check the status of an outbound domain transfer. Use after getting an auth code and initiating the transfer at the new registrar.

Import an external domain you already own (registered at GoDaddy, Namecheap, Cloudflare, etc.) to manage through domani.run. Free, no transfer needed. Returns a TXT record to add at your DNS provider for ownership verification.

The account's security audit trail, newest first: token lifecycle (created/revoked/escalation attempts), spend-cap and max_price denials, charges, payout requests. Use it to review what the account's tokens have been doing.

List the user's backorders (watching, caught, failed, cancelled, expired). Optionally filter by status.

List your domain acquisition requests and their status (sourcing/contacted/negotiating/agreed/no_contact/declined). Requires deals:read scope.

List all domains you own

List canonical mailbox folders, virtual views, server-derived total/unread counts, and backend capabilities. API: GET /api/emails/{address}/folders.

List messages in a system folder or virtual view. Defaults to Inbox. Supports pagination, direction and search filters. API: GET /api/emails/{address}/messages.

List the free agent identities (<handle>.domani.run) you've claimed.

List the user's payment invoices. Returns invoice number, amount, date, and links to view/download the PDF. Each invoice is generated by Stripe when a domain is purchased, renewed, or transferred.

List a mailbox's inbound filtering rules, in the priority order they are applied. API: GET /api/emails/{address}/rules.

List all alias addresses that deliver into a mailbox. API: GET /api/emails/{address}/aliases.

List the app passwords for a hosted mailbox (labels + metadata; secrets are shown only once at creation). API: GET /api/emails/{address}/credentials.

List all your email addresses. Optionally filter by domain. API: GET /api/emails (or GET /api/email).

List your active and past price negotiations (as buyer or seller). Counterparties are anonymized. Requires deals:read scope.

List all supported hosting and email providers with their connection methods, target requirements, and setup notes

List all supported services for domain verification (Stripe, Google Search Console, etc.)

List addresses on your suppression list - hard bounces and complaints (added automatically) plus manual entries. Sends to these addresses are skipped. API: GET /api/suppressions.

List all available TLDs with registration and renewal pricing

List all API tokens for your account. Shows token name, masked key, creation date, last used, and expiration status. Expired tokens are marked.

Get recent delivery attempts for a webhook - shows event type, HTTP status, number of attempts, and any errors. Useful for debugging webhook issues.

List all webhook endpoints configured for the user's account. Returns URL, subscribed events, and active status for each webhook.

Open an anonymous price negotiation on a listed domain with an initial offer (below or at the asking price). The seller can counter, accept, or decline. Neither side sees the other's identity. Requires deals:write scope.

Mark one or more messages as read or unread. Useful for tracking which messages have been processed by your agent. API: PATCH /api/emails/{address}/messages/read.

Read-only planner for an existing domain. Inspects registrar, nameservers, DNS provider, DNSSEC, account state, transfer eligibility, and price. Returns safe next actions. Call this before asking for an EPP code. Connecting is free and leaves registrar and DNS unchanged. Transferring preserves nameservers and never migrates DNS implicitly.

Give an AI agent a complete internet identity in one call: buy a domain, set up email, create a mailbox, and (optionally) register a webhook for inbound email. Use this when someone wants to 'give my agent a domain and email' or 'set up an agent from scratch'. Confirm the domain and price with the user first (it charges for the domain). The domain purchase is the only step that can fail the call; mailbox/webhook are best-effort and report warnings.

Release a free identity handle so it's available again.

Remove an inbound filtering rule from a mailbox. API: DELETE /api/emails/{address}/rules/{ruleId}.

Remove an alias address from a mailbox. Email to that address stops being delivered. API: DELETE /api/emails/{address}/aliases/{alias}.

Remove an address from your suppression list so you can email it again (e.g. after the recipient fixed their mailbox). API: DELETE /api/suppressions/{address}.

Renew a domain you own for additional years. Always confirm with the user before calling this.

Reply to an email message. Automatically sets To (from Reply-To or sender), Subject (Re: prefix), In-Reply-To and References headers for proper threading. Use all=true for reply-all (auto-populates CC from original recipients, excluding your own address). API: POST /api/emails/{address}/messages/{id}/reply.

Resend a verification email for your WHOIS contact email. If the contact email matches your login email, it's already verified. Rate limited to once per 15 minutes.

Owner-agent path: respond to a broker's acquisition inquiry using the token from the outreach email in your inbox - fully autonomous, no email round-trip, no magic-link. offer/counter names a price and opens/advances an anonymous negotiation; accept agrees to the buyer's current offer on the table; decline/opt_out ends it. Token-authorized (no scope needed).

Counter, accept, or decline the current offer in a negotiation when it's your turn. 'accept' locks the price at the amount on the table; the buyer then finalizes payment. Requires deals:write scope.

Restore DNS records from the server-side backup (created by snapshot_dns or during transfers). Uses diff to avoid duplicates. Call snapshot_dns first to create a backup. Pass dry_run to preview what would be applied without writing.

Revoke an app password on a hosted mailbox. Any mail client using it stops connecting. API: DELETE /api/emails/{address}/credentials/{id}.

Revoke an API token immediately. The token will stop working. Use list_tokens to find token IDs.

Regenerate the HMAC signing secret for a mailbox webhook. The old secret is immediately invalidated. API: POST /api/emails/{address}/webhook/rotate.

Check availability and price for one or more domains. Pass full domain names (e.g. mysite.com). For bulk TLD search, pass an array like ["myapp.com", "myapp.io", "myapp.dev"]. Uses RDAP + retail pricing.

List a domain you own for sale on the Domani marketplace. Buyers can purchase it directly via the API. The domain must be active and not already listed. Requires domains:write scope.

Send an email from one of your mailboxes. Specify domain and slug to identify the sender mailbox. Supports text and/or HTML body, CC/BCC, attachments (base64), and threading via In-Reply-To/References. Rate limited to 100 sends per hour per mailbox. API: POST /api/emails/{address}/send.

Enable or disable auto-renew for a domain you own. When enabled, the domain will be renewed automatically before expiry.

Route any email sent to an unmatched address on a domain into a designated mailbox. Anything that does not match a mailbox, subaddress, or alias lands in the catch-all. The mailbox must already exist on the domain. API: PUT /api/domains/{domain}/email/catch-all.

Set your WHOIS contact information (recommended for ICANN compliance, required before transfers). You can purchase domains without setting contact info first - a default contact is used until you set your own.

Upsert DNS records for a domain you own, at the rrset level: records at a (type, name) you send replace that rrset; rrsets you don't mention are preserved (NS never touched). An automatic zone backup is taken before every write. Best practice: call get_dns first and pass its zone_version so a concurrent change fails with DNS_VERSION_CONFLICT instead of being clobbered. Common patterns: Vercel (A @ 76.76.21.21), GitHub Pages (CNAME @ user.github.io), Cloudflare Pages (CNAME @ project.pages.dev)

Forward a domain you own to another URL (e.g. brand.com -> brand.dev). The domain must point at domani's nameservers/parking IP. Permanent (308) by default, or temporary (307). Send an empty url to stop forwarding.

Configure inbound handling for a mailbox: forward incoming emails to another address (in addition to storing) and/or drop spam-flagged messages. Set forward_to to null to remove forwarding. API: PATCH /api/emails/{address}.

Set or remove the inbound webhook URL for a mailbox. When set, incoming emails are POSTed to this URL in real-time with HMAC-SHA256 signing. Must be HTTPS. Set to null to remove. API: PUT /api/emails/{address}/webhook or DELETE /api/emails/{address}/webhook.

Set a 'For Sale' price on a parked domain, or remove the listing. When a price is set and parking is enabled, visitors see a 'For Sale' page with the price and a contact form to reach the domain owner. Set price to null to remove the listing.

Replace the nameservers for a domain you own. Requires 2–13 valid hostnames. Common values: OpenSRS DNS (ns1.systemdns.com, ns2.systemdns.com, ns3.systemdns.com), Cloudflare (assigned per account), custom NS.

Enable or disable the parking page for a domain you own. When enabled, visitors to the domain see a default parking page (or a 'For Sale' page if a listing price is set). Parking is enabled by default for newly purchased domains. IMPORTANT: If the domain has existing DNS records, the response will include requires_confirmation=true and show the records that will be overwritten. You MUST inform the user and get their approval before calling again with confirm=true.

Lock or unlock a domain's transfer lock (clientTransferProhibited). When locked, transfer requests are rejected. Unlock before transferring to another registrar.

Enable or disable WHOIS privacy for a domain you own. When enabled, your personal contact information is hidden from public WHOIS lookups.

Get a checkout URL for the user to add a payment card. Returns a URL - tell the user to open it in their browser. After they complete the form, call get_account to verify has_payment_method is true. Only needed for card payments - agents with crypto wallets can skip this and pay with USDC on Base via x402 protocol.

Pre-configure email DNS on a domain (optional). This is called automatically by create_mailbox when needed. Use this only to pre-configure DNS before creating mailboxes. Pass force=true to override existing email provider (Google Workspace, Fastmail, Proton).

Capture all DNS records for a domain via public DNS lookups. Discovers subdomains from CT logs, SPF, and common names. Stores a server-side backup. Use before migrations or transfers.

AI-powered domain suggestions. Given a project description, generates full domain names with creative TLDs (e.g. codebuddy.dev, wavify.fm), checks availability, and returns only available domains with pricing.

Send a signed test payload to the mailbox webhook URL. Returns HTTP status and success/failure. API: POST /api/emails/{address}/webhook/test.

Initiate a domain transfer from another provider. PAID. The transfer includes 1 year of renewal, preserves current nameservers, and does not migrate DNS. Call plan_domain_adoption first, show the exact price and continuity plan, then get explicit confirmation before calling this. Requires the authorization/EPP code from the current provider.

Remove an active for-sale listing for a domain you own. The domain stays in your account but is no longer purchasable on the marketplace. Requires domains:write scope.

Apply a reversible mailbox lifecycle action to up to 100 messages, or permanently delete messages already in Trash with email:delete. API: POST /api/emails/{address}/messages/actions.

Update a free identity's name/bio/emoji/email/links.

Update the price and/or description of an active marketplace listing. Requires domains:write scope.

Update an existing webhook's URL, subscribed events, or active status. Use list_webhooks to get the webhook ID first.

Get a Stripe checkout URL to upgrade the user to the Pro plan ($9/month). Returns a URL. Tell the user to open it in their browser to complete the upgrade. Pro includes 10,000 emails/month, unlimited mailboxes on custom domains, API/MCP/CLI access, webhooks, and forwarding. Use this when the user hits the free plan monthly send limit (MONTHLY_LIMIT_EXCEEDED error).

Verify that a provider connection is working by checking DNS propagation. Use after connect_domain to confirm records are live.

Verify DNS TXT record and complete domain import. Call after adding the TXT record from import_domain.

Add DNS records to verify domain ownership for a third-party service (Stripe, Google Search Console, AWS SES, Postmark, Resend, Facebook, HubSpot, Microsoft 365). Unknown services fall back to a generic TXT record.

Watch a domain and get notified (email + webhook) when it becomes eligible for transfer. Uses RDAP to check ICANN lock periods and EPP status codes. If the domain is already eligible, returns immediately without creating a watch. If not eligible but has a known date, creates a watch and notifies you when it's ready.

Look up domain registration data via RDAP (modern WHOIS). Returns registrar, dates, status, nameservers, DNSSEC, and contact information (registrant, admin, tech, billing - often redacted for privacy). Works for any domain - no ownership required.