Verify the Porkbun API connection and credentials. Returns the caller's public IP and whether the API key is valid. Use this as a first sanity check before making other calls.

Check whether a single domain is available for registration and what it costs. Returns availability (avail: yes|no), registration price, renewal price, transfer price, and (for premium domains) extended pricing details. Pricing is in USD. Use this BEFORE register_domain to confirm cost — Porkbun rejects registrations whose cost doesn't match the current quote.

Get current Porkbun pricing for all supported TLDs. Returns registration, renewal, and transfer prices per TLD in USD. No authentication required. Useful when an agent needs to compare TLD costs before registering. Note: this returns standard pricing only — premium domains have their own per-domain pricing reported by check_domain.

Browse domains for sale on the Porkbun marketplace (aftermarket — domains owned by other users, not new registrations). Returns each listing's domain, TLD, SLD length, price (in USD), and listing date.

Filters (all optional, server-side, mirroring the porkbun.com/marketplace UI):

• query: SLD substring match. Multi-word queries: prefix a word with - to exclude it (e.g. "ai -test" matches SLDs containing 'ai' but not 'test').

• tlds: limit to a list of TLDs (without the leading dot).

• sld_length_min, sld_length_max: SLD character length bounds.

• sort_name: domain | tld | price | sld_length.

• sort_direction: asc | desc.

When any filter is set, server returns up to 1000 matching listings. With no filters, supports raw pagination via start / limit (max 5000).

List domains in the authenticated Porkbun account. Returns one page (up to 1000) with metadata: expire date, auto-renew, security lock, WHOIS privacy, API access opt-in, and notLocal flag.

Filters (all optional):

• domain: exact match. Returns 0 or 1.

• name_contains: substring search on domain name.

• tlds: limit to these TLDs (no leading dot).

• expiring_within_days: only domains expiring within N days. Useful for renewal automation.

• auto_renew: 'yes' or 'no'.

• api_access: 'yes' or 'no'. Filter to domains an API key can actually operate on — eliminates API_ACCESS_DISABLED errors downstream.

• sort_name: 'domain' | 'tld' | 'create_date' | 'expire_date'. Default expire_date.

• sort_direction: 'asc' | 'desc'. Default asc.

For a single domain by name, use get_domain instead — cleaner shape and 404-on-not-found semantics.

Get the metadata for a single domain in the authenticated account: status, TLD, create date, expire date, security lock, WHOIS privacy, auto-renew, API access opt-in, and (optionally) labels. Returns an error with code DOMAIN_NOT_FOUND if the domain isn't in the account.

Get the available account credit balance for the authenticated Porkbun account. Returns the balance in cents (integer) and a human-readable display string (e.g. $12.34). Use this to check spend headroom before initiating registrations or renewals.

Get the authenticated account's API spend control configuration: monthly spend limit, low-balance alert threshold, auto top-up settings, and current month's API spend total. All amounts are in cents. Useful for an agent to check budget headroom before initiating expensive operations — register_domain will be hard-blocked if it would push monthly spend over the configured limit.

Get the current nameservers configured for a domain in the authenticated account. Returns an array of nameserver hostnames. Read-only complement to update_nameservers.

List all DNS records for a domain in the authenticated account. Returns each record's id, type (A, AAAA, CNAME, MX, TXT, etc.), name (subdomain or empty for apex), content, ttl, and priority (where applicable). The id field is required when editing or deleting a specific record.

List the DNSSEC DS records currently submitted to the registry for a domain. Returns key tag, algorithm, digest type, and digest. Use this to verify DNSSEC chain-of-trust setup. Empty array = DNSSEC not configured.

List all URL forwarding rules configured for a domain. Each entry includes its id (used by delete_url_forward), the source subdomain, the destination URL, the redirect type (permanent/temporary), and whether the request path and wildcards are forwarded.

List glue records for a domain. Glue records associate a host (e.g. ns1.example.com) with one or more IP addresses at the registry, used when running your own nameservers on the same domain they serve. Returns the host, IPv4 addresses, and IPv6 addresses for each glue record.

List all in-progress and recent inbound domain transfers for the authenticated account. Returns each transfer's domain, status (NEW, PENDINGAUTH, PENDINGSUBMIT, PENDINGTRANSFER, DONE, CANCELED, etc.), and create date. Use this to monitor transfers initiated by transfer_domain.

Get the status of a specific inbound transfer for a domain. Useful for polling after transfer_domain to know when the transfer completes (typical window: 5-7 days). Returns the same status values as list_transfers, plus a human-readable description.

Retrieve the free Porkbun-issued SSL certificate bundle for a domain. Returns the certificate chain, private key, and public key (PEM-encoded strings). Porkbun automatically provisions Let's Encrypt certificates for all registered domains using Porkbun nameservers. Use this to install TLS on a server you control.

Spends account credit. Registers a new domain on the authenticated Porkbun account. The cost parameter must exactly match the current registration price returned by check_domain (in cents) — Porkbun rejects mismatched quotes. Workflow: call check_domain first to get availability + price, confirm the spend with the user, then call this. The order is idempotency-safe: retries within 24 hours via the same Idempotency-Key return the original response without re-charging. Premium domains, .uk, and a handful of registry-specific TLDs cannot be registered via API and must be done on the website. The account's email and phone number must be verified, and the account must have at least one prior registration order before this works.

Spends account credit. Renews an existing domain in the authenticated account. The cost parameter must exactly match the current renewal price returned by check_domain (in cents). The domain must be opted in to API access (per-domain or global toggle in account settings). Domains registered within the last 30 days, or already renewed within the last 30 days, cannot be renewed yet — the API returns RENEWAL_TOO_SOON. Premium domain renewals are not supported via API. Idempotency-safe: retries within 24 hours don't double-charge.

Spends account credit. Initiates a transfer of an external domain into Porkbun. Returns immediately with a transferId; the actual registry transfer takes 5-7 days for most TLDs. Use get_transfer_status to poll. Requires the auth/EPP code from the losing registrar. The cost must match the current transfer price from check_domain. .uk domains and a few TLDs do not support inbound API transfers. Idempotency-safe.

Turn auto-renewal on or off for a domain in the authenticated account. When auto-renew is on, Porkbun automatically charges your account credit at expiration. When off, you must manually renew or the domain expires. Idempotent.

Replace the nameservers for a domain in the authenticated account. This is a full replacement, not an append — the supplied list becomes the complete set of nameservers. Most TLDs require 2-13 entries. Setting custom nameservers disables Porkbun's free DNS hosting for the domain. Idempotent: applying the same NS list twice is a no-op.

Create a DNS record on a domain in the authenticated account. Returns the new record's id so it can be referenced by update_dns_record and delete_dns_record. For the name field: omit or pass empty string for the apex/root, otherwise pass the subdomain prefix only (e.g. www, not www.example.com). For MX and SRV records, set prio (priority). Free, doesn't spend account credit.

Update an existing DNS record by its numeric record_id (obtained from list_dns_records). All fields except record_id and domain are optional — pass only the ones you want to change. Idempotent: applying the same update twice is a no-op.

Delete a single DNS record by its numeric record_id (obtained from list_dns_records). Idempotent: deleting an already-deleted record returns success. Free.

Submit a DNSSEC DS record to the registry for a domain. Use when you sign DNS yourself (custom nameservers running BIND/Knot/PowerDNS/etc.) and need to publish the chain-of-trust at the parent zone. Required: keyTag, algorithm, digestType, digest. Optional key-data fields for registries that require full DNSKEY (rare).

Remove a DNSSEC DS record from the registry for a domain, identified by key tag. Use when retiring a key. Idempotent: deleting a non-existent key tag returns success.

Add a URL forwarding rule for a domain. Forwards a subdomain (or apex if subdomain is empty/omitted) to an arbitrary destination URL. Useful for redirects without setting up a web server. Free.

Delete a URL forwarding rule by its id (obtained from list_url_forwards). Idempotent.

Create a glue record for a host on a domain. Used when running your own nameservers on the same domain they serve (e.g. ns1.example.com serving example.com). The subdomain is just the host part (e.g. ns1), not the full FQDN. Provide IPs as an array of IPv4 and/or IPv6 addresses. Idempotent.

Update the IP addresses associated with an existing glue record. Replaces the full IP list — pass all IPs you want set, not just additions. Idempotent.

Delete a glue record by host on a domain. Idempotent: deleting a non-existent glue record returns success.