HTTP API¶

Bindizr exposes zones, records, snapshots, TSIG keys, and tokens over an HTTP API served on api.listen_addr:api.listen_port (127.0.0.1:3000 by default).

Open the full API reference

The reference is generated from the OpenAPI spec, which is also served directly at openapi.yaml if you want to feed it to a client generator.

Authentication¶

Create a token with the CLI:

$ bindizr token create --description "API access for monitoring"

Then include it in the Authorization header:

$ curl -H "Authorization: Bearer YOUR_TOKEN" http://localhost:3000/zones

Setting api.require_authentication = false disables the check entirely — only sensible when Bindizr is bound to a loopback address or an otherwise trusted network.

Unauthenticated endpoints¶

GET /health and GET /metrics are always unauthenticated, and neither exposes zone data. /health is part of the OpenAPI spec; /metrics is not. See Prometheus Metrics.