Let your own tools do the routine work, safely
Your scripts and pipelines can do what you now do by hand, across every registrar, DNS host and cloud. Preview a DNS change, announce maintenance from a deploy, and hear about it when something breaks. Try every call in a free sandbox first.
Free sandbox · API tokens from Pro · Your first call in five minutes
# See what a DNS change would do, before you make it
curl -X POST "https://api.infranest.io/api/organizations/42/dns-zones/7/dns-records?dry_run=1" \
-H "Authorization: Bearer $INFRANEST_TOKEN" \
-H "Content-Type: application/json" \
-d '{"type": "A", "name": "status", "value": "192.0.2.50", "ttl": 3600}'
{
"dry_run": true,
"zone": "northwyndr.com",
"provider_push": "per_record",
"changes": [{
"action": "create", "before": null,
"after": { "type": "A", "name": "status", "value": "192.0.2.50", "ttl": 3600 }
}]
}What the REST API takes off your hands
Everyday jobs, done by your own tools. They work on the same records, monitors and servers you see in the app.
Change DNS without the worry
Preview a change, make it, and undo it if you need to. Search every record across all your zones.
POST /dns-zones/{zone}/dns-records?dry_run=1Announce planned work
Open a maintenance window from your pipeline. Add a notice, and your status page and its subscribers see it.
POST /maintenance-windowsAdd a monitor with every release
Create a monitor when a new service goes live, so nothing reaches production unwatched.
POST /monitoring-checksGet the story of an incident
Read what caused it, what it touched and how it unfolded. Pull the drafted summary into your own report.
GET /incidents/{id}/storyAsk what needs fixing
Read the app’s own advice: setup checks for each server, domain and zone, and whether a server could be a size smaller.
GET /cloud-servers/{id}/advisorKeep your own records
Copy the audit log into your SIEM and pull the monthly uptime report.
GET /audit-logsLet your pipeline check its own work
After a production deploy, InfraNest checks the deploy’s monitors more often for an hour. Then it compares that hour with the hour before. Your pipeline reads one verdict: better, unchanged or worse. You find a bad deploy before your customers report it.
- Same verdict in the app and the API
- Per monitor and per location
- Says so when there is too little data
GET /deploy-events/{id}e61f7d2 to production: p95 up to 30% slower from every location, failed checks unchanged
| Location | p95 before → after | Result |
|---|---|---|
| Asia-Pacific | 391 ms → 502 ms | Worse |
| Europe | 182 ms → 236 ms | Worse |
| North America | 268 ms → 342 ms | Worse |
The hour after the deploy, compared with the hour before it for every location: the slowest 5% of response times (p95) and the share of failed checks. Each side needs at least 10 checks.
Safe to automate, even when a script goes wrong
Scripts break, networks time out and agents make mistakes. The API is made for that.
Dry-run every DNS change
Add ?dry_run=1 and see exactly which records would change. Nothing is saved or sent to your provider.
A free sandbox
Sample zones, monitors, servers and an open incident. Nothing reaches a provider or the internet, and no alert goes out.
Retries that never double up
Send an Idempotency-Key and a retried request happens once. No duplicate records or monitors.
Errors you can code against
Every error has a stable code and a hint that says what to do. Codes never change.
A token for each job, with only the access it needs
Give each script its own token and tick what it may change. If one leaks, it can do little, and you revoke it in one click. A sudden flood of changes from a token is flagged to your workspace owners.
- Read or write per area, in one workspace
- Expires in 30 to 365 days, and can be tied to one address
- Buying, deleting servers and managing members stay in the app
What you do with a token is done in your name, and it can cause costs at your providers.
Building an integration? Use OAuth
Add a “Connect with InfraNest” button to your app. People sign in, pick a workspace and approve what your app may do. Nobody copies a token, and they can remove your app at any time.
- OAuth 2.1 with PKCE and refresh tokens
- The same scopes and limits as API tokens
- An app never does more than the person who approved it
Published at claude.ai. When you answer, you go back to claude.ai.
Verified by InfraNest
It works only in the workspace you pick. For another one, connect the app again.
Claude can see your domains, DNS, servers, monitoring, drop catches, members and teams, billing, audit log and data exports and imports. It can’t change anything.
Also let Claude act on incidents and monitors
Acknowledge an incident, leave the team a note, silence a monitor for a while, and start or end a maintenance window. It asks you before each one, and these are the only changes it can make through its InfraNest tools.
It keeps this access until you remove it in My account → Authorized apps.
Hear about it the moment it happens
InfraNest posts JSON to your URL when something happens: a domain about to expire, a monitor going down, DNS records changing. Every request is signed, so you can check it really came from us. A failed delivery is retried five times over about ten hours. Webhooks are included from Pro.
22 events
X-InfraNest-Event: monitor.alert
X-InfraNest-Delivery: 9f6c2e1a-…
X-InfraNest-Timestamp: 1793030400
X-InfraNest-Signature-V2: sha256=5d41ab…
{
"event": "monitor.alert",
"created_at": "2026-10-26T09:30:00Z",
"data": { "check_name": "Checkout flow", "status": "down", "monitor_type": "http" }
}Let your assistant do the on-call chores
Connect Claude or ChatGPT to the MCP server and ask what is down, on every plan. With your OK it can acknowledge an incident, silence a monitor or start maintenance. Coding agents like Claude Code and Cursor get docs made for them: llms.txt, a Markdown version of every page and the OpenAPI description.
I’m on Checkout flow. Acknowledge it and tell the team we’re rolling back.
acknowledge_incidentAcknowledged. Repeat alerts have stopped, and the team can see you’re on it.
add_incident_note · Checkout returning 503Rolling back the last storefront deploy.
For the team only. Never shown on a status page.
Ready-made code
Open source on GitHub. Copy it, change it, run it.
Examples
Dynamic DNS, Let’s Encrypt DNS-01, a monitor per deploy and more, in shell, Python, Node.js and PowerShell.
GitHub Action
Silence alerts while a workflow deploys, and turn them back on afterwards.
Postman, Bruno and Insomnia
Every endpoint, ready to import, with an environment for your token.
OpenAPI description
Generate a client, or watch the repository to hear about new endpoints.
REST API questions
Which plans include the API?
API tokens and webhooks are included from Pro, for reads and writes alike. On every plan, Free included, you can try the API in a free sandbox with test tokens, and connect Claude or ChatGPT through the MCP server.
Can I try the API without touching real infrastructure?
Yes. Create a sandbox under My account → Developer. It comes with sample DNS zones, monitors, domains, two servers and an open incident. Writes work there, and nothing ever reaches a provider or the internet.
Can I see what a DNS change will do before I make it?
Yes. Add ?dry_run=1 to a DNS write and the answer lists each record that would change, before and after. Nothing is saved, and sending the same request without it makes exactly that change.
Do writes work straight away?
While the API rolls out, writes are switched on per workspace. Reading works straight away; ask us and we switch yours on. In your sandbox, writes already work.
What are the API rate limits?
Each token gets 300 requests and 60 changes per minute, and 1,000 changes per hour. Every response says how much is left. Over a limit, the API answers 429 with the number of seconds to wait.
What can a token never do?
Anything that buys, destroys or changes who gets in: registering or renewing domains, ordering or deleting servers, deleting zones, changing nameservers, members, provider credentials, webhooks and your own account. Those stay with a person signed in to the app.
How do I check a webhook really came from InfraNest?
Every request carries X-InfraNest-Signature-V2: an HMAC-SHA256 of the timestamp and the body, made with your endpoint’s secret. Recompute it, compare the two, and refuse a timestamp more than five minutes off. The docs have ready-made code.
Will the API change under me?
New fields and endpoints are added without notice. Removing or renaming anything gets six months’ notice in the changelog, which you can follow as RSS. Error codes never change.
API token or OAuth?
An API token is for your own scripts, CI and tools. OAuth is for an app that other people connect to their own InfraNest account. Both use the same scopes and limits.
Make your first call in five minutes
Create a free sandbox, make a test token and preview your first DNS change. Nothing real is touched.
Free sandbox · API tokens from Pro