Skip to content

nsindocs Search the docs⌘K

API

Check the SSL delegation record now

posthttps://api.nsin.ir/domains/{domain}/ssl/delegation/check

Auth: Authorization: Bearer nsin_… or X-Api-Key: nsin_… — see API keys.

Runs a live check of the ssl_delegation CNAME of an external-DNS domain — the record that lets NSIN issue and renew its certificate automatically — and records the result on the domain. A passing check on a domain still awaiting verification also activates it: the record proves control of the domain's DNS exactly as the TXT record does.

The check queries TXT _acme-challenge.{domain} through public resolvers and looks for this domain's own canary value, so it tests what a certificate authority will see end to end. Rate limited to once a minute per domain, shared with verify. The outcome is also stored as the dv entry of GET /domains/{domain}/checks. Requires ssl.manage.

Path parameters

domainstringrequiredpath

The domain name (for example example.com) — not a numeric id.

Responses

200The delegation is in place. Issuance proceeds automatically.

Content type: application/json

okboolean
errorstring

Present when ok is false.
next_check_atstring (date-time)
ssl_delegationSslDelegation

An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
Fields
- hoststring
  
  Name to create the CNAME at, e.g. _acme-challenge.example.com.
- typestring
  
  One of: "CNAME"
- valuestring
  
  The CNAME target, unique to this domain.
- okboolean
  
  Whether the last live check found this domain's delegation in place.
- checked_atstring (date-time)
  
  When the last check ran.
- ok_atstring (date-time)
  
  When the delegation last passed.
- errorstring
  
  Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
- next_manual_check_atstring (date-time)
- auto_check_secondsinteger
  
  How often NSIN re-checks the record on its own.
domainDomainDetail

A domain and its edge configuration.
Fields
- idinteger
- namestring
- statusstring
  - pending — waiting to be activated: a managed domain for its nameservers to point at NSIN (disabled after 28 days without that), an external-DNS domain for its verification record (3-day window).
  - failed — an external-DNS domain whose 3-day verification window ran out. Start a new window with POST /domains/{domain}/verify/retry.
  - active — serving.
  - moved — was active, but the delegation (managed) or the verification record (external) is gone. The domain keeps serving for a 3-day grace window, then is disabled; putting it back reactivates it at the next check.
  - disabled — not serving: zone removed, records un-proxied, cache purged. Re-enable with POST /domains/{domain}/enable.
  - banned — administratively blocked.
  One of: "pending" "failed" "active" "moved" "disabled" "banned"
- dns_modestring
  
  managed — NSIN hosts the DNS zone. external — you host DNS elsewhere and prove ownership with a TXT record.
  
  One of: "managed" "external"
- user_idinteger
  
  Id of the owning user.
- verification_started_atstring (date-time)
  
  External-DNS domains: when the current 3-day verification window opened (at creation, on a switch to external, on re-enable and on verify/retry).
- cache_l2_max_gbinteger
  
  Per-domain cap on disk (L2) cache size, in GB.
- cache_l2_ttl_daysinteger
  
  How long a disk-cache entry may live, in days. Maximum 7.
- cache_cap_mbinteger
  
  Largest response body NSIN will buffer and cache, in MB. Bigger responses stream straight from origin and are never cached. The selectable ceiling depends on the domain's plan.
  
  One of: 128 256 512 2048 4096
- developer_mode_untilstring (date-time)
  
  While set and in the future, the edge bypasses cache reads and writes for this domain and passes the origin's own error responses through (see POST /domains/{domain}/developer-mode). Absent when developer mode is off.
- pending_sincestring (date-time)
  
  When the domain last entered pending.
- moved_sincestring (date-time)
  
  When the domain went moved; the 3-day grace window counts from here.
- next_check_atstring (date-time)
  
  When the background nameserver checker will next look at this domain.
- last_manual_ns_check_atstring (date-time)
  
  Last user-triggered nameserver check; these are limited to one per hour.
- last_manual_verify_atstring (date-time)
  
  Last user-triggered verification check (POST /domains/{domain}/verify); limited to one per minute.
- under_attackboolean
  
  Under Attack Mode is switched on (see GET /domains/{domain}/under-attack).
- under_attack_bypass_pathsarray | null
  
  Under Attack Mode's bypass paths.
- under_attack_sincestring | null (date-time)
  
  When Under Attack Mode was switched on.
- under_attack_untilstring | null (date-time)
  
  When Under Attack Mode switches itself off; null = no timer.
- shield_dismissed_atstring (date-time)
  
  Set when the default "NSIN Shield" WAF rule was deleted from this domain. While set, the rule is not re-created automatically; POST /domains/{domain}/rules/waf/shield/restore brings it back and clears this.
- sec_no_sniffboolean
  
  Send X-Content-Type-Options: nosniff. Off by default — it can break an origin that mislabels asset MIME types.
- sec_referrer_policyboolean
  
  Send Referrer-Policy: strict-origin-when-cross-origin.
- sec_strip_headersboolean
  
  Strip origin fingerprint headers from responses.
- hsts_enabledboolean
  
  Send Strict-Transport-Security, telling browsers to use HTTPS only for this domain. Off by default.
  
  This one cannot be undone. A browser that has seen the header refuses plain HTTP for the whole hsts_max_age_sec even after the header stops being sent; switching it off only stops new visitors from being pinned. Enable it only when every path on the domain works over HTTPS. The edge's value replaces an origin's own Strict-Transport-Security header (a browser reads only the first one it receives).
- hsts_max_age_secinteger
  
  How long browsers keep enforcing HTTPS, in seconds. 0 is "never set". Only the listed values are accepted, and this API raises it one step at a time — from 0 the only allowed next value is 300, then 3600, and so on. Lowering it is always allowed and is the way back out. The edge treats anything under 300 as off. Turning hsts_enabled on while this is 0 sets it to 300.
  
  One of: 0 300 3600 86400 604800 2592000 31536000
- hsts_include_subdomainsboolean
  
  Add includeSubDomains, applying the rule to every subdomain, including ones created later. A subdomain not served over HTTPS becomes unreachable for visitors who have seen the header.
- hsts_preloadboolean
  
  Add the preload directive, the prerequisite for submitting the domain at hstspreload.org. Requires hsts_enabled, hsts_include_subdomains and hsts_max_age_sec of 31536000.
  
  Effectively permanent: getting off the browser preload list means asking hstspreload.org to delist the domain and waiting for people to update their browsers. If a precondition is later removed, this flag is cleared with it.
- min_tls_versionstring
  
  Lowest TLS version a visitor may connect with. 1.2 (default) accepts TLS 1.2 and 1.3; 1.3 refuses TLS 1.2 handshakes. Nothing below 1.2 is offered on any domain. It is enforced during the TLS handshake from the SNI, so a client below the minimum gets a connection error rather than an HTTP response. HTTP/3 is TLS 1.3 by definition and is unaffected.
  
  One of: "1.2" "1.3"
- markdown_for_agentsboolean
  
  Serve a Markdown rendering of eligible HTML pages to clients sending Accept: text/markdown. Requires an active plan.
- analytics_tagstring
  
  The NsinNabz <script> tag the edge inserts into this domain's HTML pages; empty when there is none. Set and removed through /domains/{domain}/analytics-tag, not through this object.
- analytics_tag_updated_atstring (date-time)
  
  When analytics_tag last changed. Absent when there is no tag.
- origin_protocolstring
  
  HTTP version the edge speaks to this domain's origins on the direct path. Default http1, and deliberately so: over HTTP/2 an upload is limited by the origin's per-stream window (64 KB on nginx), which caps each upload near 4 MB/s at a 16 ms edge-to-origin round trip. http3 falls back to TCP per origin when the QUIC dial fails. The tunnel path from Iranian edges to foreign origins is always HTTP/1.1. Probe what your origin supports with GET /domains/{domain}/origin-protocols.
  
  One of: "http1" "http2" "http3"
- default_static_cacheboolean
  
  Cache static files (CSS, JavaScript, images, fonts, media, downloads) at the edge automatically, even with no cache rule — the way Cloudflare does for every proxied hostname. On by default. HTML is never cached by this; your own cache rules always take precedence, and any path you exclude in a rule is never cached by the default. Freshness follows your origin's Cache-Control; with none, 5 minutes.
- bot_cache_enabledboolean
  
  Bot cache: keep an edge copy of every HTML page for verified search-engine crawlers (Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot) and serve them from it, regardless of the origin's Cache-Control. Human visitors are unaffected. A crawler must pass the operator's own verification (published IP ranges / reverse DNS); a spoofed User-Agent never gets the copy. Requires a plan with bot_cache_enabled; the edge switches it off automatically while the plan lacks it.
- bot_cache_fresh_secinteger
  
  Bot cache: seconds a copy is served without asking the origin (300–86400, default 3600). Older copies are still served and refreshed in the background with a conditional request.
- bot_cache_max_age_secinteger
  
  Bot cache: seconds after which a copy is no longer served and is fetched again (300–86400, default 86400).
- bot_cache_kindsarray of string
  
  Crawlers the bot cache serves. A domain that never set it (empty) serves all of them; an update must list at least one.
  
  One of: "googlebot" "bingbot" "applebot" "duckduckbot" "yandexbot"
- bot_cache_path_excludesarray of string
  
  Wildcard path patterns (/api/*) never served from the bot cache.
- proxy_ipsarray of string
  
  Edge addresses every proxied record of this domain is pinned to, instead of the platform default set. Set by NSIN support only (for example for a dedicated address); absent in the normal case.
- gateway_requests_30dinteger (int64)
  
  Requests served by this domain's gateway hostnames in the rolling 30-day window, as of gateway_quota_counted_at.
- gateway_bytes_30dinteger (int64)
  
  Egress bytes of the gateway hostnames over the same window. A meter for the gateway allowance, not a second charge — the bytes are already billed as the domain's ordinary traffic.
- gateway_quota_exceededboolean
  
  The plan's gateway allowance (requests or bytes) is spent, so the gateway hostnames answer 429 until enough traffic ages out of the window. The rest of the domain is unaffected.
- gateway_quota_counted_atstring (date-time)
  
  When the gateway usage above was last recomputed. Absent before the first count.
- gateway_quota_reasonstring
  
  Which gateway cap tripped. Absent while nothing has.
  
  One of: "requests" "bytes"
- gateway_terms_accepted_atstring (date-time)
  
  When this domain's gateway terms of use were accepted (see POST /domains/{domain}/gateways/terms/accept). Absent until then; switching a gateway on is refused without it.
- gateway_terms_accepted_byinteger
  
  User id of whoever accepted the gateway terms.
- billing_user_idinteger
  
  The member nominated to pay for this domain. Absent when the owner pays (the normal case). Only the owner can set it, in the panel — API keys cannot change who pays.
- billing_user_set_byinteger
  
  User id of whoever made the current billing nomination.
- billing_user_set_atstring (date-time)
  
  When the current billing nomination took effect. Charges for a billing window that started earlier stay with the previous payer.
- outage_alertsboolean
  
  Notify the owner when a subdomain suffers a sustained origin outage.
- uptime_threshold_pctinteger
  
  Per-minute origin-error percentage that counts as "down".
- uptime_window_mininteger
  
  Minutes the domain must stay down before an incident opens.
- uptime_min_requestsinteger
  
  Minimum origin-eligible requests in the window — the traffic floor below which no incident opens.
- uptime_min_active_mininteger
  
  Minimum populated one-minute buckets required in the window.
- uptime_recover_mininteger
  
  Consecutive clear minutes before an incident resolves.
- uptime_host_match_typestring
  
  How the host filter — host_pattern, host_includes and host_excludes — is matched. One strategy covers all three, exactly as one path_match_type covers both path lists.
  
  The empty string means "no host filter", and is the only valid value when the pattern and both lists are empty. Set a list without a match type and the API defaults it to wildcard.
  
  A wildcard entry matches subdomains, not the label itself: *.example.com covers shop.example.com but not example.com — the same reading as the DNS wildcard. Add the bare name as its own entry to include it.
  
  One of: "" "exact" "wildcard" "regex"
- uptime_host_includesarray of string
  
  Subdomains the default whole-host uptime watch covers. Absent or empty means every subdomain. Change with PUT /uptime/settings.
- uptime_host_excludesarray of string
  
  Subdomains the default uptime watch skips; an exclude always beats an include.
- suspendedboolean
  
  Paused for billing. The edge refuses the domain's TLS handshake, so visitors get a connection error. Clears automatically once the wallet is no longer negative.
- suspended_atstring (date-time)
- created_atstring (date-time)
- updated_atstring (date-time)
- deleted_atstring | null (date-time)
  
  Always null — deleted domains are never returned.
- verificationDomainVerification
  
  The legacy TXT record that proves ownership of an external-DNS domain. Still accepted, but new domains verify with the CNAME in ssl_delegation, which also keeps their certificate renewing — prefer that one.
  Fields
  - hoststring
    
    Name to create the TXT record at.
  - typestring
    
    One of: "TXT"
  - valuestring
    
    Exact TXT value to publish.
  - verifiedboolean
    
    Whether the domain has passed verification: false only while it is pending or failed.
  - expires_atstring (date-time)
    
    End of the current 3-day verification window. Absent once verified.
  - seconds_remaininginteger
    
    Seconds left in the verification window.
  - next_manual_check_atstring (date-time)
    
    When POST /domains/{domain}/verify may be called again (once a minute). Absent once verified, or if it never ran.
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own, in seconds (300).
- ssl_delegationSslDelegation
  
  An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
  Fields
  - hoststring
    
    Name to create the CNAME at, e.g. _acme-challenge.example.com.
  - typestring
    
    One of: "CNAME"
  - valuestring
    
    The CNAME target, unique to this domain.
  - okboolean
    
    Whether the last live check found this domain's delegation in place.
  - checked_atstring (date-time)
    
    When the last check ran.
  - ok_atstring (date-time)
    
    When the delegation last passed.
  - errorstring
    
    Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
  - next_manual_check_atstring (date-time)
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own.
- nsin_nsarray of string
  
  The canonical (first) accepted nameserver set.
- nsin_ns_setsarray of array of string
  
  Every accepted nameserver set. The delegation must name every NSIN nameserver node, through any set's hostname for it, and nothing else; see GET /domains/ns-sets.
- current_nsarray of string
  
  The nameservers currently observed in the parent zone.
- my_rolestring
  
  Your role on a domain. owner is implicit for the domain's creator and for global admins; the other three are grantable via sharing.
  
  One of: "owner" "admin" "editor" "viewer"
- my_permissionsarray of string
- ns_check_interval_secondsinteger
  
  How often the background checker re-checks the delegation.
- billing_memberobject
  
  Whose wallet this domain's charges come out of. Always present — it falls back to the owner — so a client can name the payer without a second request. Only the owner can change it, in the panel — API keys cannot.
  Fields
  - user_idinteger
  - namestring
  - emailstring
  - set_byinteger
    
    Who made the nomination. Absent when the owner pays.
  - set_atstring (date-time)
  - is_ownerboolean
    
    True when no nomination is in force and the domain owner pays. The owner being named explicitly is stored as no nomination, so this never disagrees with ownership.

json

{
  "ok": true,
  "error": "string",
  "next_check_at": "2026-01-01T00:00:00Z",
  "ssl_delegation": {
    "host": "string",
    "type": "CNAME",
    "value": "string",
    "ok": true,
    "checked_at": "2026-01-01T00:00:00Z",
    "ok_at": "2026-01-01T00:00:00Z",
    "error": "string",
    "next_manual_check_at": "2026-01-01T00:00:00Z",
    "auto_check_seconds": 0
  },
  "domain": {
    "id": 0,
    "name": "example.com",
    "status": "pending",
    "dns_mode": "managed",
    "user_id": 0,
    "verification_started_at": "2026-01-01T00:00:00Z",
    "cache_l2_max_gb": 0,
    "cache_l2_ttl_days": 0,
    "cache_cap_mb": 128,
    "developer_mode_until": "2026-01-01T00:00:00Z",
    "pending_since": "2026-01-01T00:00:00Z",
    "moved_since": "2026-01-01T00:00:00Z",
    "next_check_at": "2026-01-01T00:00:00Z",
    "last_manual_ns_check_at": "2026-01-01T00:00:00Z",
    "last_manual_verify_at": "2026-01-01T00:00:00Z",
    "under_attack": true,
    "under_attack_bypass_paths": [
      "string"
    ],
    "under_attack_since": "2026-01-01T00:00:00Z",
    "under_attack_until": "2026-01-01T00:00:00Z",
    "shield_dismissed_at": "2026-01-01T00:00:00Z",
    "sec_no_sniff": true,
    "sec_referrer_policy": true,
    "sec_strip_headers": true,
    "hsts_enabled": true,
    "hsts_max_age_sec": 0,
    "hsts_include_subdomains": true,
    "hsts_preload": true,
    "min_tls_version": "1.2",
    "markdown_for_agents": true,
    "analytics_tag": "string",
    "analytics_tag_updated_at": "2026-01-01T00:00:00Z",
    "origin_protocol": "http1",
    "default_static_cache": true,
    "bot_cache_enabled": true,
    "bot_cache_fresh_sec": 0,
    "bot_cache_max_age_sec": 0,
    "bot_cache_kinds": [
      "googlebot"
    ],
    "bot_cache_path_excludes": [
      "string"
    ],
    "proxy_ips": [
      "string"
    ],
    "gateway_requests_30d": 0,
    "gateway_bytes_30d": 0,
    "gateway_quota_exceeded": true,
    "gateway_quota_counted_at": "2026-01-01T00:00:00Z",
    "gateway_quota_reason": "requests",
    "gateway_terms_accepted_at": "2026-01-01T00:00:00Z",
    "gateway_terms_accepted_by": 0,
    "billing_user_id": 0,
    "billing_user_set_by": 0,
    "billing_user_set_at": "2026-01-01T00:00:00Z",
    "outage_alerts": true,
    "uptime_threshold_pct": 0,
    "uptime_window_min": 0,
    "uptime_min_requests": 0,
    "uptime_min_active_min": 0,
    "uptime_recover_min": 0,
    "uptime_host_match_type": "",
    "uptime_host_includes": [
      "string"
    ],
    "uptime_host_excludes": [
      "string"
    ],
    "suspended": true,
    "suspended_at": "2026-01-01T00:00:00Z",
    "created_at": "2026-01-01T00:00:00Z",
    "updated_at": "2026-01-01T00:00:00Z",
    "deleted_at": "2026-01-01T00:00:00Z",
    "verification": {
      "host": "string",
      "type": "TXT",
      "value": "string",
      "verified": true,
      "expires_at": "2026-01-01T00:00:00Z",
      "seconds_remaining": 0,
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "ssl_delegation": {
      "host": "string",
      "type": "CNAME",
      "value": "string",
      "ok": true,
      "checked_at": "2026-01-01T00:00:00Z",
      "ok_at": "2026-01-01T00:00:00Z",
      "error": "string",
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "nsin_ns": [
      "string"
    ],
    "nsin_ns_sets": [
      [
        "string"
      ]
    ],
    "current_ns": [
      "string"
    ],
    "my_role": "owner",
    "my_permissions": [
      "domain.view"
    ],
    "ns_check_interval_seconds": 0,
    "billing_member": {
      "user_id": 0,
      "name": "string",
      "email": "string",
      "set_by": 0,
      "set_at": "2026-01-01T00:00:00Z",
      "is_owner": true
    }
  }
}

202Returned instead of the inline verdict to callers that are not API keys (the panel, an NSIN SSO access token): the check keeps running in the background — it can take up to a minute — and its result is read from GET /domains/{domain}/checks. A second call while one is running returns the running job. The body may carry the endpoint's own extra fields (for example next_check_at).

Content type: application/json

checkingboolean

One of: true
checkManualCheck

One manual check and its last outcome.
Fields
- kindstring
  
  Which check: ns delegation, txt verification, dv SSL delegation, edge proxied-record reachability, email_dns Email Routing records.
  
  One of: "ns" "txt" "dv" "edge" "email_dns"
- statestring
  
  running — the check is in flight; poll again. done — it completed and ok carries the verdict. error — it could not reach an answer (a resolver was unreachable). An error is never a verdict about the domain's DNS.
  
  One of: "running" "done" "error"
- okboolean
  
  The verdict of a done check.
- messagestring
  
  What to show the user.
- started_atstring (date-time)
  
  When the check started.
- finished_atstring (date-time)
  
  When it finished. Absent while running.
messagestring

What to show the user while the check runs.

json

{
  "checking": true,
  "check": {
    "kind": "ns",
    "state": "running",
    "ok": true,
    "message": "string",
    "started_at": "2026-01-01T00:00:00Z",
    "finished_at": "2026-01-01T00:00:00Z"
  },
  "message": "string"
}

400Not an external-DNS domain, or the domain is disabled or banned.

Content type: application/json

errorstringrequired

Human-readable description of what went wrong.

json

{
  "error": "read-only API key"
}

401Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Content type: application/json

errorstringrequired

Human-readable description of what went wrong.

json

{
  "error": "invalid API key"
}

403The key is read-only, your role on the domain lacks the required permission, or the domain's plan does not include the feature.

Content type: application/json

errorstringrequired

Human-readable description of what went wrong.

json

{
  "error": "read-only API key"
}

404No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Content type: application/json

errorstringrequired

Human-readable description of what went wrong.

json

{
  "error": "read-only API key"
}

422The record was not found, has not propagated, or points at a delegation that does not belong to this domain. ok is false and error says what was seen.

Content type: application/json

okboolean
errorstring

Present when ok is false.
next_check_atstring (date-time)
ssl_delegationSslDelegation

An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
Fields
- hoststring
  
  Name to create the CNAME at, e.g. _acme-challenge.example.com.
- typestring
  
  One of: "CNAME"
- valuestring
  
  The CNAME target, unique to this domain.
- okboolean
  
  Whether the last live check found this domain's delegation in place.
- checked_atstring (date-time)
  
  When the last check ran.
- ok_atstring (date-time)
  
  When the delegation last passed.
- errorstring
  
  Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
- next_manual_check_atstring (date-time)
- auto_check_secondsinteger
  
  How often NSIN re-checks the record on its own.
domainDomainDetail

A domain and its edge configuration.
Fields
- idinteger
- namestring
- statusstring
  - pending — waiting to be activated: a managed domain for its nameservers to point at NSIN (disabled after 28 days without that), an external-DNS domain for its verification record (3-day window).
  - failed — an external-DNS domain whose 3-day verification window ran out. Start a new window with POST /domains/{domain}/verify/retry.
  - active — serving.
  - moved — was active, but the delegation (managed) or the verification record (external) is gone. The domain keeps serving for a 3-day grace window, then is disabled; putting it back reactivates it at the next check.
  - disabled — not serving: zone removed, records un-proxied, cache purged. Re-enable with POST /domains/{domain}/enable.
  - banned — administratively blocked.
  One of: "pending" "failed" "active" "moved" "disabled" "banned"
- dns_modestring
  
  managed — NSIN hosts the DNS zone. external — you host DNS elsewhere and prove ownership with a TXT record.
  
  One of: "managed" "external"
- user_idinteger
  
  Id of the owning user.
- verification_started_atstring (date-time)
  
  External-DNS domains: when the current 3-day verification window opened (at creation, on a switch to external, on re-enable and on verify/retry).
- cache_l2_max_gbinteger
  
  Per-domain cap on disk (L2) cache size, in GB.
- cache_l2_ttl_daysinteger
  
  How long a disk-cache entry may live, in days. Maximum 7.
- cache_cap_mbinteger
  
  Largest response body NSIN will buffer and cache, in MB. Bigger responses stream straight from origin and are never cached. The selectable ceiling depends on the domain's plan.
  
  One of: 128 256 512 2048 4096
- developer_mode_untilstring (date-time)
  
  While set and in the future, the edge bypasses cache reads and writes for this domain and passes the origin's own error responses through (see POST /domains/{domain}/developer-mode). Absent when developer mode is off.
- pending_sincestring (date-time)
  
  When the domain last entered pending.
- moved_sincestring (date-time)
  
  When the domain went moved; the 3-day grace window counts from here.
- next_check_atstring (date-time)
  
  When the background nameserver checker will next look at this domain.
- last_manual_ns_check_atstring (date-time)
  
  Last user-triggered nameserver check; these are limited to one per hour.
- last_manual_verify_atstring (date-time)
  
  Last user-triggered verification check (POST /domains/{domain}/verify); limited to one per minute.
- under_attackboolean
  
  Under Attack Mode is switched on (see GET /domains/{domain}/under-attack).
- under_attack_bypass_pathsarray | null
  
  Under Attack Mode's bypass paths.
- under_attack_sincestring | null (date-time)
  
  When Under Attack Mode was switched on.
- under_attack_untilstring | null (date-time)
  
  When Under Attack Mode switches itself off; null = no timer.
- shield_dismissed_atstring (date-time)
  
  Set when the default "NSIN Shield" WAF rule was deleted from this domain. While set, the rule is not re-created automatically; POST /domains/{domain}/rules/waf/shield/restore brings it back and clears this.
- sec_no_sniffboolean
  
  Send X-Content-Type-Options: nosniff. Off by default — it can break an origin that mislabels asset MIME types.
- sec_referrer_policyboolean
  
  Send Referrer-Policy: strict-origin-when-cross-origin.
- sec_strip_headersboolean
  
  Strip origin fingerprint headers from responses.
- hsts_enabledboolean
  
  Send Strict-Transport-Security, telling browsers to use HTTPS only for this domain. Off by default.
  
  This one cannot be undone. A browser that has seen the header refuses plain HTTP for the whole hsts_max_age_sec even after the header stops being sent; switching it off only stops new visitors from being pinned. Enable it only when every path on the domain works over HTTPS. The edge's value replaces an origin's own Strict-Transport-Security header (a browser reads only the first one it receives).
- hsts_max_age_secinteger
  
  How long browsers keep enforcing HTTPS, in seconds. 0 is "never set". Only the listed values are accepted, and this API raises it one step at a time — from 0 the only allowed next value is 300, then 3600, and so on. Lowering it is always allowed and is the way back out. The edge treats anything under 300 as off. Turning hsts_enabled on while this is 0 sets it to 300.
  
  One of: 0 300 3600 86400 604800 2592000 31536000
- hsts_include_subdomainsboolean
  
  Add includeSubDomains, applying the rule to every subdomain, including ones created later. A subdomain not served over HTTPS becomes unreachable for visitors who have seen the header.
- hsts_preloadboolean
  
  Add the preload directive, the prerequisite for submitting the domain at hstspreload.org. Requires hsts_enabled, hsts_include_subdomains and hsts_max_age_sec of 31536000.
  
  Effectively permanent: getting off the browser preload list means asking hstspreload.org to delist the domain and waiting for people to update their browsers. If a precondition is later removed, this flag is cleared with it.
- min_tls_versionstring
  
  Lowest TLS version a visitor may connect with. 1.2 (default) accepts TLS 1.2 and 1.3; 1.3 refuses TLS 1.2 handshakes. Nothing below 1.2 is offered on any domain. It is enforced during the TLS handshake from the SNI, so a client below the minimum gets a connection error rather than an HTTP response. HTTP/3 is TLS 1.3 by definition and is unaffected.
  
  One of: "1.2" "1.3"
- markdown_for_agentsboolean
  
  Serve a Markdown rendering of eligible HTML pages to clients sending Accept: text/markdown. Requires an active plan.
- analytics_tagstring
  
  The NsinNabz <script> tag the edge inserts into this domain's HTML pages; empty when there is none. Set and removed through /domains/{domain}/analytics-tag, not through this object.
- analytics_tag_updated_atstring (date-time)
  
  When analytics_tag last changed. Absent when there is no tag.
- origin_protocolstring
  
  HTTP version the edge speaks to this domain's origins on the direct path. Default http1, and deliberately so: over HTTP/2 an upload is limited by the origin's per-stream window (64 KB on nginx), which caps each upload near 4 MB/s at a 16 ms edge-to-origin round trip. http3 falls back to TCP per origin when the QUIC dial fails. The tunnel path from Iranian edges to foreign origins is always HTTP/1.1. Probe what your origin supports with GET /domains/{domain}/origin-protocols.
  
  One of: "http1" "http2" "http3"
- default_static_cacheboolean
  
  Cache static files (CSS, JavaScript, images, fonts, media, downloads) at the edge automatically, even with no cache rule — the way Cloudflare does for every proxied hostname. On by default. HTML is never cached by this; your own cache rules always take precedence, and any path you exclude in a rule is never cached by the default. Freshness follows your origin's Cache-Control; with none, 5 minutes.
- bot_cache_enabledboolean
  
  Bot cache: keep an edge copy of every HTML page for verified search-engine crawlers (Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot) and serve them from it, regardless of the origin's Cache-Control. Human visitors are unaffected. A crawler must pass the operator's own verification (published IP ranges / reverse DNS); a spoofed User-Agent never gets the copy. Requires a plan with bot_cache_enabled; the edge switches it off automatically while the plan lacks it.
- bot_cache_fresh_secinteger
  
  Bot cache: seconds a copy is served without asking the origin (300–86400, default 3600). Older copies are still served and refreshed in the background with a conditional request.
- bot_cache_max_age_secinteger
  
  Bot cache: seconds after which a copy is no longer served and is fetched again (300–86400, default 86400).
- bot_cache_kindsarray of string
  
  Crawlers the bot cache serves. A domain that never set it (empty) serves all of them; an update must list at least one.
  
  One of: "googlebot" "bingbot" "applebot" "duckduckbot" "yandexbot"
- bot_cache_path_excludesarray of string
  
  Wildcard path patterns (/api/*) never served from the bot cache.
- proxy_ipsarray of string
  
  Edge addresses every proxied record of this domain is pinned to, instead of the platform default set. Set by NSIN support only (for example for a dedicated address); absent in the normal case.
- gateway_requests_30dinteger (int64)
  
  Requests served by this domain's gateway hostnames in the rolling 30-day window, as of gateway_quota_counted_at.
- gateway_bytes_30dinteger (int64)
  
  Egress bytes of the gateway hostnames over the same window. A meter for the gateway allowance, not a second charge — the bytes are already billed as the domain's ordinary traffic.
- gateway_quota_exceededboolean
  
  The plan's gateway allowance (requests or bytes) is spent, so the gateway hostnames answer 429 until enough traffic ages out of the window. The rest of the domain is unaffected.
- gateway_quota_counted_atstring (date-time)
  
  When the gateway usage above was last recomputed. Absent before the first count.
- gateway_quota_reasonstring
  
  Which gateway cap tripped. Absent while nothing has.
  
  One of: "requests" "bytes"
- gateway_terms_accepted_atstring (date-time)
  
  When this domain's gateway terms of use were accepted (see POST /domains/{domain}/gateways/terms/accept). Absent until then; switching a gateway on is refused without it.
- gateway_terms_accepted_byinteger
  
  User id of whoever accepted the gateway terms.
- billing_user_idinteger
  
  The member nominated to pay for this domain. Absent when the owner pays (the normal case). Only the owner can set it, in the panel — API keys cannot change who pays.
- billing_user_set_byinteger
  
  User id of whoever made the current billing nomination.
- billing_user_set_atstring (date-time)
  
  When the current billing nomination took effect. Charges for a billing window that started earlier stay with the previous payer.
- outage_alertsboolean
  
  Notify the owner when a subdomain suffers a sustained origin outage.
- uptime_threshold_pctinteger
  
  Per-minute origin-error percentage that counts as "down".
- uptime_window_mininteger
  
  Minutes the domain must stay down before an incident opens.
- uptime_min_requestsinteger
  
  Minimum origin-eligible requests in the window — the traffic floor below which no incident opens.
- uptime_min_active_mininteger
  
  Minimum populated one-minute buckets required in the window.
- uptime_recover_mininteger
  
  Consecutive clear minutes before an incident resolves.
- uptime_host_match_typestring
  
  How the host filter — host_pattern, host_includes and host_excludes — is matched. One strategy covers all three, exactly as one path_match_type covers both path lists.
  
  The empty string means "no host filter", and is the only valid value when the pattern and both lists are empty. Set a list without a match type and the API defaults it to wildcard.
  
  A wildcard entry matches subdomains, not the label itself: *.example.com covers shop.example.com but not example.com — the same reading as the DNS wildcard. Add the bare name as its own entry to include it.
  
  One of: "" "exact" "wildcard" "regex"
- uptime_host_includesarray of string
  
  Subdomains the default whole-host uptime watch covers. Absent or empty means every subdomain. Change with PUT /uptime/settings.
- uptime_host_excludesarray of string
  
  Subdomains the default uptime watch skips; an exclude always beats an include.
- suspendedboolean
  
  Paused for billing. The edge refuses the domain's TLS handshake, so visitors get a connection error. Clears automatically once the wallet is no longer negative.
- suspended_atstring (date-time)
- created_atstring (date-time)
- updated_atstring (date-time)
- deleted_atstring | null (date-time)
  
  Always null — deleted domains are never returned.
- verificationDomainVerification
  
  The legacy TXT record that proves ownership of an external-DNS domain. Still accepted, but new domains verify with the CNAME in ssl_delegation, which also keeps their certificate renewing — prefer that one.
  Fields
  - hoststring
    
    Name to create the TXT record at.
  - typestring
    
    One of: "TXT"
  - valuestring
    
    Exact TXT value to publish.
  - verifiedboolean
    
    Whether the domain has passed verification: false only while it is pending or failed.
  - expires_atstring (date-time)
    
    End of the current 3-day verification window. Absent once verified.
  - seconds_remaininginteger
    
    Seconds left in the verification window.
  - next_manual_check_atstring (date-time)
    
    When POST /domains/{domain}/verify may be called again (once a minute). Absent once verified, or if it never ran.
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own, in seconds (300).
- ssl_delegationSslDelegation
  
  An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
  Fields
  - hoststring
    
    Name to create the CNAME at, e.g. _acme-challenge.example.com.
  - typestring
    
    One of: "CNAME"
  - valuestring
    
    The CNAME target, unique to this domain.
  - okboolean
    
    Whether the last live check found this domain's delegation in place.
  - checked_atstring (date-time)
    
    When the last check ran.
  - ok_atstring (date-time)
    
    When the delegation last passed.
  - errorstring
    
    Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
  - next_manual_check_atstring (date-time)
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own.
- nsin_nsarray of string
  
  The canonical (first) accepted nameserver set.
- nsin_ns_setsarray of array of string
  
  Every accepted nameserver set. The delegation must name every NSIN nameserver node, through any set's hostname for it, and nothing else; see GET /domains/ns-sets.
- current_nsarray of string
  
  The nameservers currently observed in the parent zone.
- my_rolestring
  
  Your role on a domain. owner is implicit for the domain's creator and for global admins; the other three are grantable via sharing.
  
  One of: "owner" "admin" "editor" "viewer"
- my_permissionsarray of string
- ns_check_interval_secondsinteger
  
  How often the background checker re-checks the delegation.
- billing_memberobject
  
  Whose wallet this domain's charges come out of. Always present — it falls back to the owner — so a client can name the payer without a second request. Only the owner can change it, in the panel — API keys cannot.
  Fields
  - user_idinteger
  - namestring
  - emailstring
  - set_byinteger
    
    Who made the nomination. Absent when the owner pays.
  - set_atstring (date-time)
  - is_ownerboolean
    
    True when no nomination is in force and the domain owner pays. The owner being named explicitly is stored as no nomination, so this never disagrees with ownership.

json

{
  "ok": true,
  "error": "string",
  "next_check_at": "2026-01-01T00:00:00Z",
  "ssl_delegation": {
    "host": "string",
    "type": "CNAME",
    "value": "string",
    "ok": true,
    "checked_at": "2026-01-01T00:00:00Z",
    "ok_at": "2026-01-01T00:00:00Z",
    "error": "string",
    "next_manual_check_at": "2026-01-01T00:00:00Z",
    "auto_check_seconds": 0
  },
  "domain": {
    "id": 0,
    "name": "example.com",
    "status": "pending",
    "dns_mode": "managed",
    "user_id": 0,
    "verification_started_at": "2026-01-01T00:00:00Z",
    "cache_l2_max_gb": 0,
    "cache_l2_ttl_days": 0,
    "cache_cap_mb": 128,
    "developer_mode_until": "2026-01-01T00:00:00Z",
    "pending_since": "2026-01-01T00:00:00Z",
    "moved_since": "2026-01-01T00:00:00Z",
    "next_check_at": "2026-01-01T00:00:00Z",
    "last_manual_ns_check_at": "2026-01-01T00:00:00Z",
    "last_manual_verify_at": "2026-01-01T00:00:00Z",
    "under_attack": true,
    "under_attack_bypass_paths": [
      "string"
    ],
    "under_attack_since": "2026-01-01T00:00:00Z",
    "under_attack_until": "2026-01-01T00:00:00Z",
    "shield_dismissed_at": "2026-01-01T00:00:00Z",
    "sec_no_sniff": true,
    "sec_referrer_policy": true,
    "sec_strip_headers": true,
    "hsts_enabled": true,
    "hsts_max_age_sec": 0,
    "hsts_include_subdomains": true,
    "hsts_preload": true,
    "min_tls_version": "1.2",
    "markdown_for_agents": true,
    "analytics_tag": "string",
    "analytics_tag_updated_at": "2026-01-01T00:00:00Z",
    "origin_protocol": "http1",
    "default_static_cache": true,
    "bot_cache_enabled": true,
    "bot_cache_fresh_sec": 0,
    "bot_cache_max_age_sec": 0,
    "bot_cache_kinds": [
      "googlebot"
    ],
    "bot_cache_path_excludes": [
      "string"
    ],
    "proxy_ips": [
      "string"
    ],
    "gateway_requests_30d": 0,
    "gateway_bytes_30d": 0,
    "gateway_quota_exceeded": true,
    "gateway_quota_counted_at": "2026-01-01T00:00:00Z",
    "gateway_quota_reason": "requests",
    "gateway_terms_accepted_at": "2026-01-01T00:00:00Z",
    "gateway_terms_accepted_by": 0,
    "billing_user_id": 0,
    "billing_user_set_by": 0,
    "billing_user_set_at": "2026-01-01T00:00:00Z",
    "outage_alerts": true,
    "uptime_threshold_pct": 0,
    "uptime_window_min": 0,
    "uptime_min_requests": 0,
    "uptime_min_active_min": 0,
    "uptime_recover_min": 0,
    "uptime_host_match_type": "",
    "uptime_host_includes": [
      "string"
    ],
    "uptime_host_excludes": [
      "string"
    ],
    "suspended": true,
    "suspended_at": "2026-01-01T00:00:00Z",
    "created_at": "2026-01-01T00:00:00Z",
    "updated_at": "2026-01-01T00:00:00Z",
    "deleted_at": "2026-01-01T00:00:00Z",
    "verification": {
      "host": "string",
      "type": "TXT",
      "value": "string",
      "verified": true,
      "expires_at": "2026-01-01T00:00:00Z",
      "seconds_remaining": 0,
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "ssl_delegation": {
      "host": "string",
      "type": "CNAME",
      "value": "string",
      "ok": true,
      "checked_at": "2026-01-01T00:00:00Z",
      "ok_at": "2026-01-01T00:00:00Z",
      "error": "string",
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "nsin_ns": [
      "string"
    ],
    "nsin_ns_sets": [
      [
        "string"
      ]
    ],
    "current_ns": [
      "string"
    ],
    "my_role": "owner",
    "my_permissions": [
      "domain.view"
    ],
    "ns_check_interval_seconds": 0,
    "billing_member": {
      "user_id": 0,
      "name": "string",
      "email": "string",
      "set_by": 0,
      "set_at": "2026-01-01T00:00:00Z",
      "is_owner": true
    }
  }
}

429A check ran less than a minute ago (next_check_at says when the next is allowed), or the API key rate limit was hit.

Content type: application/json

okboolean
errorstring

Present when ok is false.
next_check_atstring (date-time)
ssl_delegationSslDelegation

An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
Fields
- hoststring
  
  Name to create the CNAME at, e.g. _acme-challenge.example.com.
- typestring
  
  One of: "CNAME"
- valuestring
  
  The CNAME target, unique to this domain.
- okboolean
  
  Whether the last live check found this domain's delegation in place.
- checked_atstring (date-time)
  
  When the last check ran.
- ok_atstring (date-time)
  
  When the delegation last passed.
- errorstring
  
  Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
- next_manual_check_atstring (date-time)
- auto_check_secondsinteger
  
  How often NSIN re-checks the record on its own.
domainDomainDetail

A domain and its edge configuration.
Fields
- idinteger
- namestring
- statusstring
  - pending — waiting to be activated: a managed domain for its nameservers to point at NSIN (disabled after 28 days without that), an external-DNS domain for its verification record (3-day window).
  - failed — an external-DNS domain whose 3-day verification window ran out. Start a new window with POST /domains/{domain}/verify/retry.
  - active — serving.
  - moved — was active, but the delegation (managed) or the verification record (external) is gone. The domain keeps serving for a 3-day grace window, then is disabled; putting it back reactivates it at the next check.
  - disabled — not serving: zone removed, records un-proxied, cache purged. Re-enable with POST /domains/{domain}/enable.
  - banned — administratively blocked.
  One of: "pending" "failed" "active" "moved" "disabled" "banned"
- dns_modestring
  
  managed — NSIN hosts the DNS zone. external — you host DNS elsewhere and prove ownership with a TXT record.
  
  One of: "managed" "external"
- user_idinteger
  
  Id of the owning user.
- verification_started_atstring (date-time)
  
  External-DNS domains: when the current 3-day verification window opened (at creation, on a switch to external, on re-enable and on verify/retry).
- cache_l2_max_gbinteger
  
  Per-domain cap on disk (L2) cache size, in GB.
- cache_l2_ttl_daysinteger
  
  How long a disk-cache entry may live, in days. Maximum 7.
- cache_cap_mbinteger
  
  Largest response body NSIN will buffer and cache, in MB. Bigger responses stream straight from origin and are never cached. The selectable ceiling depends on the domain's plan.
  
  One of: 128 256 512 2048 4096
- developer_mode_untilstring (date-time)
  
  While set and in the future, the edge bypasses cache reads and writes for this domain and passes the origin's own error responses through (see POST /domains/{domain}/developer-mode). Absent when developer mode is off.
- pending_sincestring (date-time)
  
  When the domain last entered pending.
- moved_sincestring (date-time)
  
  When the domain went moved; the 3-day grace window counts from here.
- next_check_atstring (date-time)
  
  When the background nameserver checker will next look at this domain.
- last_manual_ns_check_atstring (date-time)
  
  Last user-triggered nameserver check; these are limited to one per hour.
- last_manual_verify_atstring (date-time)
  
  Last user-triggered verification check (POST /domains/{domain}/verify); limited to one per minute.
- under_attackboolean
  
  Under Attack Mode is switched on (see GET /domains/{domain}/under-attack).
- under_attack_bypass_pathsarray | null
  
  Under Attack Mode's bypass paths.
- under_attack_sincestring | null (date-time)
  
  When Under Attack Mode was switched on.
- under_attack_untilstring | null (date-time)
  
  When Under Attack Mode switches itself off; null = no timer.
- shield_dismissed_atstring (date-time)
  
  Set when the default "NSIN Shield" WAF rule was deleted from this domain. While set, the rule is not re-created automatically; POST /domains/{domain}/rules/waf/shield/restore brings it back and clears this.
- sec_no_sniffboolean
  
  Send X-Content-Type-Options: nosniff. Off by default — it can break an origin that mislabels asset MIME types.
- sec_referrer_policyboolean
  
  Send Referrer-Policy: strict-origin-when-cross-origin.
- sec_strip_headersboolean
  
  Strip origin fingerprint headers from responses.
- hsts_enabledboolean
  
  Send Strict-Transport-Security, telling browsers to use HTTPS only for this domain. Off by default.
  
  This one cannot be undone. A browser that has seen the header refuses plain HTTP for the whole hsts_max_age_sec even after the header stops being sent; switching it off only stops new visitors from being pinned. Enable it only when every path on the domain works over HTTPS. The edge's value replaces an origin's own Strict-Transport-Security header (a browser reads only the first one it receives).
- hsts_max_age_secinteger
  
  How long browsers keep enforcing HTTPS, in seconds. 0 is "never set". Only the listed values are accepted, and this API raises it one step at a time — from 0 the only allowed next value is 300, then 3600, and so on. Lowering it is always allowed and is the way back out. The edge treats anything under 300 as off. Turning hsts_enabled on while this is 0 sets it to 300.
  
  One of: 0 300 3600 86400 604800 2592000 31536000
- hsts_include_subdomainsboolean
  
  Add includeSubDomains, applying the rule to every subdomain, including ones created later. A subdomain not served over HTTPS becomes unreachable for visitors who have seen the header.
- hsts_preloadboolean
  
  Add the preload directive, the prerequisite for submitting the domain at hstspreload.org. Requires hsts_enabled, hsts_include_subdomains and hsts_max_age_sec of 31536000.
  
  Effectively permanent: getting off the browser preload list means asking hstspreload.org to delist the domain and waiting for people to update their browsers. If a precondition is later removed, this flag is cleared with it.
- min_tls_versionstring
  
  Lowest TLS version a visitor may connect with. 1.2 (default) accepts TLS 1.2 and 1.3; 1.3 refuses TLS 1.2 handshakes. Nothing below 1.2 is offered on any domain. It is enforced during the TLS handshake from the SNI, so a client below the minimum gets a connection error rather than an HTTP response. HTTP/3 is TLS 1.3 by definition and is unaffected.
  
  One of: "1.2" "1.3"
- markdown_for_agentsboolean
  
  Serve a Markdown rendering of eligible HTML pages to clients sending Accept: text/markdown. Requires an active plan.
- analytics_tagstring
  
  The NsinNabz <script> tag the edge inserts into this domain's HTML pages; empty when there is none. Set and removed through /domains/{domain}/analytics-tag, not through this object.
- analytics_tag_updated_atstring (date-time)
  
  When analytics_tag last changed. Absent when there is no tag.
- origin_protocolstring
  
  HTTP version the edge speaks to this domain's origins on the direct path. Default http1, and deliberately so: over HTTP/2 an upload is limited by the origin's per-stream window (64 KB on nginx), which caps each upload near 4 MB/s at a 16 ms edge-to-origin round trip. http3 falls back to TCP per origin when the QUIC dial fails. The tunnel path from Iranian edges to foreign origins is always HTTP/1.1. Probe what your origin supports with GET /domains/{domain}/origin-protocols.
  
  One of: "http1" "http2" "http3"
- default_static_cacheboolean
  
  Cache static files (CSS, JavaScript, images, fonts, media, downloads) at the edge automatically, even with no cache rule — the way Cloudflare does for every proxied hostname. On by default. HTML is never cached by this; your own cache rules always take precedence, and any path you exclude in a rule is never cached by the default. Freshness follows your origin's Cache-Control; with none, 5 minutes.
- bot_cache_enabledboolean
  
  Bot cache: keep an edge copy of every HTML page for verified search-engine crawlers (Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot) and serve them from it, regardless of the origin's Cache-Control. Human visitors are unaffected. A crawler must pass the operator's own verification (published IP ranges / reverse DNS); a spoofed User-Agent never gets the copy. Requires a plan with bot_cache_enabled; the edge switches it off automatically while the plan lacks it.
- bot_cache_fresh_secinteger
  
  Bot cache: seconds a copy is served without asking the origin (300–86400, default 3600). Older copies are still served and refreshed in the background with a conditional request.
- bot_cache_max_age_secinteger
  
  Bot cache: seconds after which a copy is no longer served and is fetched again (300–86400, default 86400).
- bot_cache_kindsarray of string
  
  Crawlers the bot cache serves. A domain that never set it (empty) serves all of them; an update must list at least one.
  
  One of: "googlebot" "bingbot" "applebot" "duckduckbot" "yandexbot"
- bot_cache_path_excludesarray of string
  
  Wildcard path patterns (/api/*) never served from the bot cache.
- proxy_ipsarray of string
  
  Edge addresses every proxied record of this domain is pinned to, instead of the platform default set. Set by NSIN support only (for example for a dedicated address); absent in the normal case.
- gateway_requests_30dinteger (int64)
  
  Requests served by this domain's gateway hostnames in the rolling 30-day window, as of gateway_quota_counted_at.
- gateway_bytes_30dinteger (int64)
  
  Egress bytes of the gateway hostnames over the same window. A meter for the gateway allowance, not a second charge — the bytes are already billed as the domain's ordinary traffic.
- gateway_quota_exceededboolean
  
  The plan's gateway allowance (requests or bytes) is spent, so the gateway hostnames answer 429 until enough traffic ages out of the window. The rest of the domain is unaffected.
- gateway_quota_counted_atstring (date-time)
  
  When the gateway usage above was last recomputed. Absent before the first count.
- gateway_quota_reasonstring
  
  Which gateway cap tripped. Absent while nothing has.
  
  One of: "requests" "bytes"
- gateway_terms_accepted_atstring (date-time)
  
  When this domain's gateway terms of use were accepted (see POST /domains/{domain}/gateways/terms/accept). Absent until then; switching a gateway on is refused without it.
- gateway_terms_accepted_byinteger
  
  User id of whoever accepted the gateway terms.
- billing_user_idinteger
  
  The member nominated to pay for this domain. Absent when the owner pays (the normal case). Only the owner can set it, in the panel — API keys cannot change who pays.
- billing_user_set_byinteger
  
  User id of whoever made the current billing nomination.
- billing_user_set_atstring (date-time)
  
  When the current billing nomination took effect. Charges for a billing window that started earlier stay with the previous payer.
- outage_alertsboolean
  
  Notify the owner when a subdomain suffers a sustained origin outage.
- uptime_threshold_pctinteger
  
  Per-minute origin-error percentage that counts as "down".
- uptime_window_mininteger
  
  Minutes the domain must stay down before an incident opens.
- uptime_min_requestsinteger
  
  Minimum origin-eligible requests in the window — the traffic floor below which no incident opens.
- uptime_min_active_mininteger
  
  Minimum populated one-minute buckets required in the window.
- uptime_recover_mininteger
  
  Consecutive clear minutes before an incident resolves.
- uptime_host_match_typestring
  
  How the host filter — host_pattern, host_includes and host_excludes — is matched. One strategy covers all three, exactly as one path_match_type covers both path lists.
  
  The empty string means "no host filter", and is the only valid value when the pattern and both lists are empty. Set a list without a match type and the API defaults it to wildcard.
  
  A wildcard entry matches subdomains, not the label itself: *.example.com covers shop.example.com but not example.com — the same reading as the DNS wildcard. Add the bare name as its own entry to include it.
  
  One of: "" "exact" "wildcard" "regex"
- uptime_host_includesarray of string
  
  Subdomains the default whole-host uptime watch covers. Absent or empty means every subdomain. Change with PUT /uptime/settings.
- uptime_host_excludesarray of string
  
  Subdomains the default uptime watch skips; an exclude always beats an include.
- suspendedboolean
  
  Paused for billing. The edge refuses the domain's TLS handshake, so visitors get a connection error. Clears automatically once the wallet is no longer negative.
- suspended_atstring (date-time)
- created_atstring (date-time)
- updated_atstring (date-time)
- deleted_atstring | null (date-time)
  
  Always null — deleted domains are never returned.
- verificationDomainVerification
  
  The legacy TXT record that proves ownership of an external-DNS domain. Still accepted, but new domains verify with the CNAME in ssl_delegation, which also keeps their certificate renewing — prefer that one.
  Fields
  - hoststring
    
    Name to create the TXT record at.
  - typestring
    
    One of: "TXT"
  - valuestring
    
    Exact TXT value to publish.
  - verifiedboolean
    
    Whether the domain has passed verification: false only while it is pending or failed.
  - expires_atstring (date-time)
    
    End of the current 3-day verification window. Absent once verified.
  - seconds_remaininginteger
    
    Seconds left in the verification window.
  - next_manual_check_atstring (date-time)
    
    When POST /domains/{domain}/verify may be called again (once a minute). Absent once verified, or if it never ran.
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own, in seconds (300).
- ssl_delegationSslDelegation
  
  An external-DNS domain's verification record: one CNAME, created once and never rotated. It proves ownership (a pending domain activates when it is found) and stays in place afterwards as the domain's connection to NSIN, which is what lets NSIN issue and renew the certificate for the apex and its wildcard. Once it has passed, removing or changing it marks the domain moved — it keeps serving for a 3-day grace period, then is disabled — exactly as a managed domain whose nameservers leave.
  Fields
  - hoststring
    
    Name to create the CNAME at, e.g. _acme-challenge.example.com.
  - typestring
    
    One of: "CNAME"
  - valuestring
    
    The CNAME target, unique to this domain.
  - okboolean
    
    Whether the last live check found this domain's delegation in place.
  - checked_atstring (date-time)
    
    When the last check ran.
  - ok_atstring (date-time)
    
    When the delegation last passed.
  - errorstring
    
    Why the last check failed — or, with ok true, a CAA policy on the domain that prevents Let's Encrypt from issuing.
  - next_manual_check_atstring (date-time)
  - auto_check_secondsinteger
    
    How often NSIN re-checks the record on its own.
- nsin_nsarray of string
  
  The canonical (first) accepted nameserver set.
- nsin_ns_setsarray of array of string
  
  Every accepted nameserver set. The delegation must name every NSIN nameserver node, through any set's hostname for it, and nothing else; see GET /domains/ns-sets.
- current_nsarray of string
  
  The nameservers currently observed in the parent zone.
- my_rolestring
  
  Your role on a domain. owner is implicit for the domain's creator and for global admins; the other three are grantable via sharing.
  
  One of: "owner" "admin" "editor" "viewer"
- my_permissionsarray of string
- ns_check_interval_secondsinteger
  
  How often the background checker re-checks the delegation.
- billing_memberobject
  
  Whose wallet this domain's charges come out of. Always present — it falls back to the owner — so a client can name the payer without a second request. Only the owner can change it, in the panel — API keys cannot.
  Fields
  - user_idinteger
  - namestring
  - emailstring
  - set_byinteger
    
    Who made the nomination. Absent when the owner pays.
  - set_atstring (date-time)
  - is_ownerboolean
    
    True when no nomination is in force and the domain owner pays. The owner being named explicitly is stored as no nomination, so this never disagrees with ownership.

json

{
  "ok": true,
  "error": "string",
  "next_check_at": "2026-01-01T00:00:00Z",
  "ssl_delegation": {
    "host": "string",
    "type": "CNAME",
    "value": "string",
    "ok": true,
    "checked_at": "2026-01-01T00:00:00Z",
    "ok_at": "2026-01-01T00:00:00Z",
    "error": "string",
    "next_manual_check_at": "2026-01-01T00:00:00Z",
    "auto_check_seconds": 0
  },
  "domain": {
    "id": 0,
    "name": "example.com",
    "status": "pending",
    "dns_mode": "managed",
    "user_id": 0,
    "verification_started_at": "2026-01-01T00:00:00Z",
    "cache_l2_max_gb": 0,
    "cache_l2_ttl_days": 0,
    "cache_cap_mb": 128,
    "developer_mode_until": "2026-01-01T00:00:00Z",
    "pending_since": "2026-01-01T00:00:00Z",
    "moved_since": "2026-01-01T00:00:00Z",
    "next_check_at": "2026-01-01T00:00:00Z",
    "last_manual_ns_check_at": "2026-01-01T00:00:00Z",
    "last_manual_verify_at": "2026-01-01T00:00:00Z",
    "under_attack": true,
    "under_attack_bypass_paths": [
      "string"
    ],
    "under_attack_since": "2026-01-01T00:00:00Z",
    "under_attack_until": "2026-01-01T00:00:00Z",
    "shield_dismissed_at": "2026-01-01T00:00:00Z",
    "sec_no_sniff": true,
    "sec_referrer_policy": true,
    "sec_strip_headers": true,
    "hsts_enabled": true,
    "hsts_max_age_sec": 0,
    "hsts_include_subdomains": true,
    "hsts_preload": true,
    "min_tls_version": "1.2",
    "markdown_for_agents": true,
    "analytics_tag": "string",
    "analytics_tag_updated_at": "2026-01-01T00:00:00Z",
    "origin_protocol": "http1",
    "default_static_cache": true,
    "bot_cache_enabled": true,
    "bot_cache_fresh_sec": 0,
    "bot_cache_max_age_sec": 0,
    "bot_cache_kinds": [
      "googlebot"
    ],
    "bot_cache_path_excludes": [
      "string"
    ],
    "proxy_ips": [
      "string"
    ],
    "gateway_requests_30d": 0,
    "gateway_bytes_30d": 0,
    "gateway_quota_exceeded": true,
    "gateway_quota_counted_at": "2026-01-01T00:00:00Z",
    "gateway_quota_reason": "requests",
    "gateway_terms_accepted_at": "2026-01-01T00:00:00Z",
    "gateway_terms_accepted_by": 0,
    "billing_user_id": 0,
    "billing_user_set_by": 0,
    "billing_user_set_at": "2026-01-01T00:00:00Z",
    "outage_alerts": true,
    "uptime_threshold_pct": 0,
    "uptime_window_min": 0,
    "uptime_min_requests": 0,
    "uptime_min_active_min": 0,
    "uptime_recover_min": 0,
    "uptime_host_match_type": "",
    "uptime_host_includes": [
      "string"
    ],
    "uptime_host_excludes": [
      "string"
    ],
    "suspended": true,
    "suspended_at": "2026-01-01T00:00:00Z",
    "created_at": "2026-01-01T00:00:00Z",
    "updated_at": "2026-01-01T00:00:00Z",
    "deleted_at": "2026-01-01T00:00:00Z",
    "verification": {
      "host": "string",
      "type": "TXT",
      "value": "string",
      "verified": true,
      "expires_at": "2026-01-01T00:00:00Z",
      "seconds_remaining": 0,
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "ssl_delegation": {
      "host": "string",
      "type": "CNAME",
      "value": "string",
      "ok": true,
      "checked_at": "2026-01-01T00:00:00Z",
      "ok_at": "2026-01-01T00:00:00Z",
      "error": "string",
      "next_manual_check_at": "2026-01-01T00:00:00Z",
      "auto_check_seconds": 0
    },
    "nsin_ns": [
      "string"
    ],
    "nsin_ns_sets": [
      [
        "string"
      ]
    ],
    "current_ns": [
      "string"
    ],
    "my_role": "owner",
    "my_permissions": [
      "domain.view"
    ],
    "ns_check_interval_seconds": 0,
    "billing_member": {
      "user_id": 0,
      "name": "string",
      "email": "string",
      "set_by": 0,
      "set_at": "2026-01-01T00:00:00Z",
      "is_owner": true
    }
  }
}

Example request

bash

curl -X POST "https://api.nsin.ir/domains/example.com/ssl/delegation/check" \
  -H "Authorization: Bearer $NSIN_API_KEY"