Copy page

API

Scopes

Scopes limit what an access token can do. Choose them when you create an access token. The general scopes guide explains how Chief Tools applies scopes across its APIs.

Each endpoint in the API playground lists its required scope under security.

Available scopes

Full access

Scope	Access
domainchief	Every Domain Chief API endpoint

Broad scopes

Scope	Access
domainchief:read	Read all resources
domainchief:write	Read and update resources, except domain registration, transfer operations, and immediate deletion

Domains

Scope	Access
domainchief:domains	All domain operations
domainchief:domains:read	List and view domains
domainchief:domains:read:availability	Check domain availability
domainchief:domains:write	Update domain settings
domainchief:domains:register	Register domains and manage inbound transfers
domainchief:domains:transfer	View or send authorization codes and manage outbound transfers
domainchief:domains:delete	Delete domains immediately

Contacts

Scope	Access
domainchief:contacts:read	List and view contacts
domainchief:contacts:write	Create, update, and delete contacts

Events

Scope	Access
domainchief:events:read	Read the team's event feed

DNS records

Scope	Access
domainchief:dns:read	List and view DNS records
domainchief:dns:write	Create, update, delete, clear, and reset DNS records

Redirects

Scope	Access
domainchief:redirects_web:read	List and view web redirects
domainchief:redirects_web:write	Create, update, and delete web redirects
domainchief:redirects_mail:read	List and view mail redirects
domainchief:redirects_mail:write	Create, update, and delete mail redirects

TLDs and activity

Scope	Access
domainchief:tlds:read	List and view available TLDs and pricing
domainchief:activity:read	View domain activity logs

Common token setups

Start with the narrowest scopes that cover the integration.

Manage DNS records

Code
domainchief:dns:write

The token can read and change DNS records. It cannot list domains, manage contacts, or run domain lifecycle operations.

Read data for monitoring

Code
domainchief:read

The token can read domains, contacts, events, DNS records, TLDs, and activity. It cannot change them.

Keep a local copy in sync

Code
domainchief:events:read, domainchief:domains:read, domainchief:contacts:read

The token can read the team event feed and retrieve current domain and contact state. It cannot change those resources. The data synchronization guide explains the snapshot and cursor workflow.

Check domain availability

Code
domainchief:domains:read:availability

The token can check availability. It cannot list domains or retrieve an existing domain.

Manage existing domains

Code
domainchief:domains:write, domainchief:dns:write, domainchief:contacts:write

The token can update existing domains, DNS records, and contacts. It cannot register domains, manage transfers, or delete domains immediately.