InfraNestInfraNest
API · OAuth · Webhooks

Automate your DNS, monitoring and servers with one API

One REST API for everything you manage in InfraNest, across every registrar, DNS host and cloud. Change DNS from a script, open a maintenance window from CI, and get a signed webhook when something happens. Try every call in a free sandbox first.

Read the developer docs →Start free

Free sandbox · API tokens from Pro · Your first call in five minutes

api.infranest.io
200 OK · dry run
# See what a DNS change would do, before you make it
curl -X POST "https://api.infranest.io/api/organizations/42/dns-zones/7/dns-records?dry_run=1" \
  -H "Authorization: Bearer $INFRANEST_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type": "A", "name": "status", "value": "192.0.2.50", "ttl": 3600}'

{
  "dry_run": true,
  "zone": "northwind.com",
  "provider_push": "per_record",
  "changes": [{
    "action": "create", "before": null,
    "after": { "type": "A", "name": "status", "value": "192.0.2.50", "ttl": 3600 }
  }]
}

What you can automate

The everyday jobs, in one API. The same records, monitors and servers you see in the dashboard.

DNS records

Create, change and delete records, apply templates and sync zones. Search every record across all your zones.

POST /dns-zones/{zone}/dns-records

Monitors

Create a monitor when you deploy, pause it while you work, and read its results and uptime.

POST /monitoring-checks

Maintenance and incidents

Open a maintenance window from your pipeline and post incident updates to your status page.

POST /maintenance-windows

Domains

Every domain with its expiry date, auto-renew and nameservers. Track new ones, add notes and labels.

GET /domains

Servers

Servers across every cloud, with their latest metrics and what needs attention.

GET /cloud-servers/metrics-overview

Audit log and reports

Copy the audit log into your SIEM and pull the monthly uptime report.

GET /audit-logs

Built to be safe to automate

Scripts break, networks time out and AI agents make mistakes. The API is made for that.

Dry-run every DNS change

Add ?dry_run=1 and see exactly which records would change. Nothing is saved or sent to your provider.

A free sandbox

Sample zones, monitors and a server, where nothing reaches a provider or the internet. Test tokens work only there.

Retries that never double up

Send an Idempotency-Key and a retried request happens once. No duplicate records or monitors.

Errors you can code against

Every error has a stable code and a hint that says what to do. Codes never change.

Tokens with exactly the access they need

Give each script its own token, with read or write per area. If one leaks, it can do very little, and you revoke it in one click.

  • Read or write, per area: DNS, domains, servers, monitoring and more
  • One organization by default, all of them only if you choose
  • Expires after 30 to 365 days, with an email a week before
  • Lock a token to your CI runner’s IP address
  • Buying domains, deleting servers or zones and managing members stay with a person in the app

Building an integration? Use OAuth

Add a “Connect with InfraNest” button to your app. People sign in, pick an organization and approve what your app may do. Nobody copies a token, and they can remove your app at any time.

  • OAuth 2.1 with PKCE and refresh tokens
  • The same scopes and limits as API tokens
  • An app can never do more than the person who approved it
  • Listed under Authorized apps, removable in one click

Webhooks for the events you care about

InfraNest posts JSON to your URL when something happens: a domain about to expire, a monitor going down, DNS records changing. Every request is signed, so you can check it really came from us. A failed delivery is retried five times over about ten hours.

22 events

domain.expiringdomain.status_changeddomain.dnssec_brokenserver.status_changedmonitor.alertdns.records_changeddns.live_mismatchcertificate.expiringcertificate.expiredcertificate.changedcertificate.weakcertificate.unexpectedcertificate.revokeddynamic_ip.changedwatched_domain.dropping_soonwatched_domain.availablewatched_domain.registeredwatched_domain.failedwatched_domain.in_auctionwatched_domain.releasedwatched_domain.renewedwatched_domain.funding_short
POSTyour-app.example/webhooks/infranest
X-InfraNest-Event: monitor.alert
X-InfraNest-Delivery: 9f6c2e1a-…
X-InfraNest-Timestamp: 1793030400
X-InfraNest-Signature-V2: sha256=5d41ab…

{
  "event": "monitor.alert",
  "created_at": "2026-10-26T09:30:00Z",
  "data": { "check_name": "Checkout flow", "status": "down", "monitor_type": "http" }
}

Ask your AI assistant, or let it write the code

Connect Claude or ChatGPT to the MCP server and ask about your account in plain words, free on every plan. Coding agents like Claude Code and Cursor get docs made for them: llms.txt, a Markdown version of every page and the OpenAPI description.

See how the MCP server works →

Ready-made code

Open source on GitHub. Copy it, change it, run it.

Examples

Dynamic DNS, Let’s Encrypt DNS-01, a maintenance window around a deploy and more, in shell, Python, Node.js and PowerShell.

GitHub Action

Silence alerts while a workflow deploys, and turn them back on afterwards.

Postman, Bruno and Insomnia

Every endpoint, ready to import, with an environment for your token.

OpenAPI description

Generate a client, or watch the repository to hear about new endpoints.

API questions

Which plans include the API?

API tokens are included from Pro, for reads and writes alike. On every plan, Free included, you can try the API in a free sandbox with test tokens, and connect Claude or ChatGPT through the MCP server.

Can I try it without touching real infrastructure?

Yes. Create a sandbox under My account → Developer. It comes with sample DNS zones, monitors, domains and a server. Writes work there, and nothing ever reaches a provider or the internet.

Do writes work straight away?

While the API rolls out, writes are switched on per organization. Reading works straight away; ask us and we switch your organization on. In your sandbox, writes already work.

What are the rate limits?

Each token gets 300 requests and 60 changes per minute, and 1,000 changes per hour. Every response says how much is left. Over a limit, the API answers 429 with the number of seconds to wait.

What can a token never do?

Anything that buys, destroys or changes who gets in: registering or renewing domains, ordering or deleting servers, deleting zones, changing nameservers, members, provider credentials and your own account. Those stay with a person signed in to the app.

How do I check a webhook really came from InfraNest?

Every request carries X-InfraNest-Signature-V2: an HMAC-SHA256 of the timestamp and the body, made with your endpoint’s secret. Recompute it, compare the two, and refuse a timestamp more than five minutes off. The docs have ready-made code.

Will the API change under me?

New fields and endpoints are added without notice. Removing or renaming anything gets six months’ notice in the changelog, which you can follow as RSS. Error codes never change.

API token or OAuth?

An API token is for your own scripts, CI and tools. OAuth is for an app that other people connect to their own InfraNest account. Both use the same scopes and limits.

Make your first call in five minutes

The docs take you from no token to a working request, with a free sandbox to try it in.

Open the developer docs Start free

Free sandbox · API tokens from Pro