# Return domain's DS records

This function fetches a domain's Delegation of Signing (DS) records.

Important:

When you disable the DNS role, the system disables this function.

Endpoint: GET /DNSSEC/fetch_ds_records
Version: 11.136.0.4
Security: BasicAuth

## Query parameters:

  - `domain` (string, required)
    The domain from which to fetch DS records.

Note:

 To enable DNSSEC on multiple domains, increment the parameter name. For example: domain-0, domain-1, domain-2.

## Response 200 fields (application/json):

  - `apiversion` (integer)
    The version of the API.
    Example: 3

  - `func` (string)
    The name of the method called.
    Example: "fetch_ds_records"

  - `module` (string)
    The name of the module called.
    Example: "DNSSEC"

  - `result` (object)

  - `result.data` (object)
    Example: {"example.com":{"keys":{"33930":{"active":1,"algo_desc":"RSA/SHA-256","algo_num":"8","algo_tag":"RSASHA256","bits":1024,"created":"1590002705","flags":256,"key_id":2,"key_tag":33930,"key_type":"ZSK","privatekey":"Private-key-format: v1.2\nAlgorithm: 8 (RSASHA256)\nModulus: wcZl882v587qKmt3M7+y6u+kzSgCvfgyiSGQHE2EulDcAnfEmz/ryanXMveHGBsO4L/GynYYUUsGvD2jHK1ITh8CeISiqmbUmPolf9HLQgwcT5pVcvwJ0Wmzpw5Ukmx67N7TTX+yieI5OyflP23GnJYQ5EQUzBu/DhdxhL90hYU=\nPublicExponent: AQAB\nPrivateExponent: EnoBdKrTMA5Jw7u1hQitXbt2Al3jTQvifbLmk9xMYJufLtkOtSL2L6dzLpftmL3TwFho8xspnG7D+KUD7ZMURrwxnLlqTttaL2PeaYJdQ184ezuflExppkDkdTEOqcIUuSylfAbyIdeGkVFuWr0cdjM9OFKMAkoYaVeAUP0SYU0=\nPrime1: 4eslxBBwyvXzmFqKx5TTiHfU7EHIAxUru3ykOMqD2tVMHbRAq5AMKZL6ZhuTXk8mnGppEfC6qqNKnf3VT5jLxw==\nPrime2: 25OUAsWWAJrQ4uLytsXoSbjHsVyh61DgZ4S4n2Mv7RsSHt0Q/VcuyvHXuAKb8Y0XCYczZBtEW+ZoPte/HHnsUw==\nExponent1: Xkb4AqLtvvT2i8y0/2avA9MmCtXEtuydzGbOTVjNv4OlePvgxPee67aHQhcd34xeS4XohPEVpOHx4I6t9sKHvw==\nExponent2: ulZDBRcodNrs6Z4u22yX8/gbfyhdQJUh2reG9bv2sAB/wEJaaKPT0eXqav3L2PKfCjbyJcH+AP9G+A2e4UuWgQ==\nCoefficient: mynNLSgStpQMktIEdysefyOg5jpXE3VeDZF6fbEOUg+E2ZnLBkLu4KPrriCwfl+cLagwgzx2M6wV/1QWkm8vPQ=="},"nsec_details":{"nsec3_hash_algo_desc":"SHA-1","nsec3_hash_algo_num":"1","nsec3_iterations":"3","nsec3_narrow":1,"nsec3_opt_out":"0","nsec3_salt":"fa1ac2c1rd7fbab4","nsec_version":"NSEC3"}}}}

  - `result.data.additionalProperties` (object)
    An object containing the domain's DS record information.

Note:

The return's name is the domain's name.

  - `result.data.additionalProperties.keys` (object)
    The DS keys on the requested domain.

  - `result.data.additionalProperties.keys.additionalProperties` (object)
    The information related to the domain's DNSSEC record.

Note:

The return's name is the key_tag return's integer value.

  - `result.data.additionalProperties.keys.additionalProperties.active` (integer)
    Whether the DS key is active.

* 1 - Active.
* 0 - Inactive.
    Enum: 0, 1

  - `result.data.additionalProperties.keys.additionalProperties.algo_desc` (string)
    A description of the algorithm
that the DS key uses.
    Example: "RSA/SHA-256"

  - `result.data.additionalProperties.keys.additionalProperties.algo_num` (integer)
    The algorithm the system generated for the security key.

* 5 - RSA/SHA-1
* 6 - DSA-NSEC3-SHA1
* 7 - RSASHA1-NSEC3-SHA1
* 8 - RSA/SHA-256
* 10 - RSA/SHA-512
* 13 - ECDSA Curve P-256 with SHA-256
* 14 - ECDSA Curve P-384 with SHA-384
    Enum: 5, 6, 7, 8, 10, 13, 14

  - `result.data.additionalProperties.keys.additionalProperties.algo_tag` (string)
    The short-form reference to the algorithm.
    Example: "RSASHA256"

  - `result.data.additionalProperties.keys.additionalProperties.bits` (integer)
    The DS key's size, in bits.
    Example: 2048

  - `result.data.additionalProperties.keys.additionalProperties.created` (integer)
    The key's creation time.
    Example: 1590002705

  - `result.data.additionalProperties.keys.additionalProperties.digests` (array)
    The information that
 the registrar uses to populate the DS records.

  - `result.data.additionalProperties.keys.additionalProperties.digests.algo_desc` (string)
    A description of the algorithm
 that the DS key uses.
    Example: "SHA-256"

  - `result.data.additionalProperties.keys.additionalProperties.digests.algo_num` (integer)
    A IETF-recognized DNSSEC Algorithm Number.
    Example: 2

  - `result.data.additionalProperties.keys.additionalProperties.digests.digest` (string)
    The actual digest in the DS record.
    Example: "4de3e58f1238fb7fc7caa84389ef6fa27d42572c35f1152c7f2ea3b899400019"

  - `result.data.additionalProperties.keys.additionalProperties.flags` (integer)
    An integer that determines the key_type value.

* 256 - A Zone Signing Key (ZSK).
* 257 - A Combined Signing Key (CSK) or Key Signing Key (KSK).
    Enum: 256, 257

  - `result.data.additionalProperties.keys.additionalProperties.key_id` (integer)
    PowerDNS's internal identifier.
    Example: 1

  - `result.data.additionalProperties.keys.additionalProperties.key_tag` (integer)
    The DS key's identification number.
    Example: 34519

  - `result.data.additionalProperties.keys.additionalProperties.key_type` (string)
    The DS key's signing type.
* CSK - Combined Signing Key.
* KSK - Key Signing Key.
* ZSK - Zone Signing Key.
    Enum: "CSK", "KSK", "ZSK"

  - `result.data.additionalProperties.keys.additionalProperties.privatekey` (string)
    The DS key's private key, in ISC format.
    Example: "Private-key-format: v1.2\nAlgorithm: 8 (RSASHA256)\nModulus: wcZl882v587qKmt3M7+y6u+kzSgCvfgyiSGQHE2EulDcAnfEmz/ryanXMveHGBsO4L/GynYYUUsGvD2jHK1ITh8CeISiqmbUmPolf9HLQgwcT5pVcvwJ0Wmzpw5Ukmx67N7TTX+yieI5OyflP23GnJYQ5EQUzBu/DhdxhL90hYU=\nPublicExponent: AQAB\nPrivateExponent: EnoBdKrTMA5Jw7u1hQitXbt2Al3jTQvifbLmk9xMYJufLtkOtSL2L6dzLpftmL3TwFho8xspnG7D+KUD7ZMURrwxnLlqTttaL2PeaYJdQ184ezuflExppkDkdTEOqcIUuSylfAbyIdeGkVFuWr0cdjM9OFKMAkoYaVeAUP0SYU0=\nPrime1: 4eslxBBwyvXzmFqKx5TTiHfU7EHIAxUru3ykOMqD2tVMHbRAq5AMKZL6ZhuTXk8mnGppEfC6qqNKnf3VT5jLxw==\nPrime2: 25OUAsWWAJrQ4uLytsXoSbjHsVyh61DgZ4S4n2Mv7RsSHt0Q/VcuyvHXuAKb8Y0XCYczZBtEW+ZoPte/HHnsUw==\nExponent1: Xkb4AqLtvvT2i8y0/2avA9MmCtXEtuydzGbOTVjNv4OlePvgxPee67aHQhcd34xeS4XohPEVpOHx4I6t9sKHvw==\nExponent2: ulZDBRcodNrs6Z4u22yX8/gbfyhdQJUh2reG9bv2sAB/wEJaaKPT0eXqav3L2PKfCjbyJcH+AP9G+A2e4UuWgQ==\nCoefficient: mynNLSgStpQMktIEdysefyOg5jpXE3VeDZF6fbEOUg+E2ZnLBkLu4KPrriCwfl+cLagwgzx2M6wV/1QWkm8vPQ=="

  - `result.data.additionalProperties.nsec_details` (object)
    An object containing the [Next Secure Record](https://tools.ietf.org/html/rfc4470) (NSEC) information for the selected domain.

Note:

 If the domain uses NSEC semantics, only the nsec_version return appears in the object.

  - `result.data.additionalProperties.nsec_details.nsec3_hash_algo_desc` (string)
    A description of the NSEC3 key's algorithm.
    Example: "SHA-1"

  - `result.data.additionalProperties.nsec_details.nsec3_hash_algo_num` (integer)
    The DNSSEC Digest Algorithm Number.
    Example: 1

  - `result.data.additionalProperties.nsec_details.nsec3_iterations` (integer)
    The number of times that the system rehashes the first hash operation.
    Example: 12

  - `result.data.additionalProperties.nsec_details.nsec3_narrow` (integer)
    Whether NSEC3 will operate in Narrow or Inclusive mode.

* 1 - Narrow mode.
* 0 - Inclusive mode.

Note:

 For more information about these modes, read [PowerDNS's DNSSEC documentation](https://doc.powerdns.com/authoritative/dnssec/intro.html).
    Enum: 0, 1

  - `result.data.additionalProperties.nsec_details.nsec3_opt_out` (integer)
    Whether NSEC3 will create records for all delegations or only for secure delegations.

* 1 - Create records for all delegations.
* 0 - Create records only for secure delegations.
    Enum: 0, 1

  - `result.data.additionalProperties.nsec_details.nsec3_salt` (string)
    The salt value that PowerDNS uses in the hashes.

Note:

 For more information about the salt value, read [RFC 5155](https://tools.ietf.org/html/rfc5155#section-3.1.5).
    Example: "fa1ac2c1rd7fbab4"

  - `result.data.additionalProperties.nsec_details.nsec_version` (string)
    Whether the domain uses NSEC or [Next Secure Record version 3](https://tools.ietf.org/html/rfc5155) (NSEC3) [Domain Name Security Extensions](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) (DNSSEC) semantics.

* NSEC
* NSEC3
    Enum: "NSEC", "NSEC3"

  - `result.errors` (array,null)
    List of errors if the API failed.

  - `result.messages` (array,null)
    List of messages generated by the API.

  - `result.metadata` (object)

  - `result.status` (integer)
    * 1 - Success
* 0 - Failed: Check the errors field for more details.
    Enum: 0, 1

  - `result.warnings` (array,null)
    List of warnings generated by the API. Warnings describe non-critical failures or other problematic conditions noted while running a API.