technitium 0.4.0

# Get Records

## Endpoint

`/api/zones/records/get`

## Method

GET (query parameters)

## Description

Gets all records for a given authoritative zone. Can list all records in the entire zone or only records for a specific domain name.

## Authentication

Required. Session token from `login` or `createToken`.

## Permissions

- Zones: None
- Zone: View

## Common Parameters

| Name | Type | Required | Conditional | Description |
|------|------|----------|-------------|-------------|
| `token` | string | Yes | No | Session token from `login` or `createToken` |
| `domain` | string | Yes | No | The domain name of the zone to get records for |
| `zone` | string | No | No | The authoritative zone name. When unspecified, the closest authoritative zone is used |
| `node` | string | No | No | Node domain name for clustering. Only usable when Clustering is initialized |
| `listZone` | boolean | No | No | When `true`, lists ALL records in the zone. When `false` (default), lists records only for the given `domain` |

## Per-Record-Type Parameters

None. This endpoint does not take record-type-specific parameters. It returns all records matching the query.

## Response Fields

| Field | Type | Description |
|-------|------|-------------|
| `status` | string | `"ok"` on success |
| `response.zone.name` | string | Zone name |
| `response.zone.type` | string | Zone type (e.g., `Primary`) |
| `response.zone.internal` | boolean | Whether the zone is internal |
| `response.zone.dnssecStatus` | string | DNSSEC signing status (e.g., `SignedWithNSEC`, `SignedWithNSEC3`) |
| `response.zone.disabled` | boolean | Whether the zone is disabled |
| `response.records` | array | Array of record objects |

### Record Object Fields

Each record in the `records` array contains:

| Field | Type | Description |
|-------|------|-------------|
| `disabled` | boolean | Whether the record is disabled |
| `name` | string | Fully qualified domain name |
| `type` | string | Record type (A, AAAA, NS, SOA, CNAME, MX, TXT, SRV, DNSKEY, RRSIG, NSEC3, NSEC3PARAM, DS, etc.) |
| `ttl` | integer | TTL in seconds |
| `rData` | object | Record-type-specific data (see below) |
| `dnssecStatus` | string | DNSSEC status (`Unknown`, etc.) |
| `lastUsedOn` | string | Timestamp of last use (may be `0001-01-01T00:00:00` if never used) |

### rData by Record Type

**A / AAAA:**
- `ipAddress` (string): The IP address

**NS:**
- `nameServer` (string): Name server domain name

**SOA:**
- `primaryNameServer` (string)
- `responsiblePerson` (string)
- `serial` (integer)
- `refresh` (integer)
- `retry` (integer)
- `expire` (integer)
- `minimum` (integer)

**CNAME:**
- `cname` (string): CNAME target domain

**MX:**
- `preference` (integer)
- `exchange` (string)

**TXT:**
- `text` (string)

**SRV:**
- `priority` (integer)
- `weight` (integer)
- `port` (integer)
- `target` (string)

**DS:**
- `keyTag` (integer)
- `algorithm` (string)
- `digestType` (string)
- `digest` (string)

**DNSKEY:**
- `flags` (string): e.g., `SecureEntryPoint, ZoneKey` or `ZoneKey`
- `protocol` (integer): Always 3
- `algorithm` (string)
- `publicKey` (string)
- `computedKeyTag` (integer)
- `dnsKeyState` (string): `Ready`, `Active`, `Published`
- `dnsKeyStateReadyBy` (string, optional): Timestamp
- `computedDigests` (array, optional): Array of `{digestType, digest}` objects

**RRSIG:**
- `typeCovered` (string): The record type this signature covers
- `algorithm` (string)
- `labels` (integer)
- `originalTtl` (integer)
- `signatureExpiration` (string): ISO 8601 timestamp
- `signatureInception` (string): ISO 8601 timestamp
- `keyTag` (integer)
- `signersName` (string)
- `signature` (string): Base64 encoded

**NSEC3PARAM:**
- `hashAlgorithm` (string)
- `flags` (string)
- `iterations` (integer)
- `salt` (string)

**NSEC3:**
- `hashAlgorithm` (string)
- `flags` (string)
- `iterations` (integer)
- `salt` (string)
- `nextHashedOwnerName` (string)
- `types` (array of strings)

## Conditional Logic Notes

1. **`listZone=true`** returns ALL records in the zone, including wildcard records (`*.example.com`), delegated subdomains, DNSSEC records (DNSKEY, RRSIG, NSEC3, NSEC3PARAM), and all other types. Without this flag, only records exactly matching the `domain` parameter are returned.
2. **`zone` parameter** is optional but recommended when the domain could belong to multiple zones. Without it, the server picks the closest authoritative zone.
3. **No filtering by record type** is available in this endpoint. All types for the matching domain(s) are returned. Filtering must be done client-side.
4. **DNSSEC-related records** (RRSIG, DNSKEY, NSEC3, NSEC3PARAM, DS) are returned alongside regular records when they exist. These are auto-generated by the server for DNSSEC-signed zones.

## Edge Cases

- Wildcard records (e.g., `*.example.com`) are returned as distinct entries when `listZone=true`.
- DNSSEC-signed zones return a large number of additional records (RRSIG for each covered type, DNSKEY, NSEC3/NSEC3PARAM). The response can be very large.
- The `lastUsedOn` field may be absent from some records or set to the zero date `0001-01-01T00:00:00`.
- Hashed owner names for NSEC3 records appear as subdomains (e.g., `4F3CNT8CU22TNGEC382JJ4GDE4RB47UB.example.com`).
- This is a read-only endpoint. It does not modify any records.
- There is no pagination support. All matching records are returned in a single response.