Changelog

​

Added

• TLD Pricing Response Enhancement: The TLD Price List endpoint now includes retail pricing information in addition to account-level pricing, which applies to registration, renewal, domain restoration, and transfer purchase types. Each pricing entry now provides three price tiers:
  • Account-level price (includes account discounts)
  • Retail price (includes rebates/promotions/sales, but no account discounts)
  • Original/MSRP price (before any discounts)

​

Changed

• Contact Schema Validation: Contact schemas have been refactored to separate validation requirements between request and response operations:
  • GET Operations (Responses): The Contact and RegistrantContact schemas used in API responses now allow nullable fields to accommodate legacy data that may contain null or empty values. This ensures GET operations can successfully return domains with legacy contact information without validation errors.
  • POST/PUT Operations (Requests): The ContactRequest and RegistrantContactRequest schemas used for creating and updating contacts enforce all validation requirements including:
    • Required fields (firstName, lastName, address1, city, state, zip, country, email, phone)
    • Minimum length constraints (minLength: 1)
    • Format validation (email format, phone/fax E.164 pattern, country code pattern)
  • This separation ensures that while GET operations can handle legacy data gracefully, all contact creation and update operations continue to enforce proper data validation and formatting requirements.

​

Fixed

• Get Domain Pricing: Fixed validation order in getPricingForDomain endpoint to check TLD support before year validation. Unsupported TLDs now return 422 Unprocessable Entity with the message “TLD not supported” instead of 400 Bad Request with a misleading “Invalid value for years for this domain” message.
• Create Domain: Added TLD privacy support check before adding WhoIs Privacy to orders. Privacy is only added when the TLD supports it, preventing failed order items for unsupported TLDs.
• Purchase Privacy: Added TLD privacy support validation. Returns 422 Unprocessable Entity with message “TLD does not support WhoIs Privacy” when attempting to purchase privacy for unsupported TLDs.

​

Changed

• Cancel Transfer endpoint now returns a 409 conflict if an existing transfer is in a state that cannot be canceled.

​

Fixed

• A handful of new contact schemas were missing updates to separate Request vs Response. This has been fixed.

​

Added

• Create Transfer: Added 504 Gateway Timeout response when domain status cannot be retrieved due to blocked-hostname.
• Create Transfer: Added optional warnings object to CreateTransferResponse with message and statuses to surface non-blocking registry status advisories.
• Domain Lock Status Change Webhook: Added ExpirationClientHold to the lockType enum. This lock type is applied to expired domains of configured API Reseller accounts.

​

Fixed

• Create Transfer: Fixed issue where a 400 Bad Request was returned for Insufficient Funds instead of the correct 402 Payment Required status.
• Get Domain: Fixed intermittent 500 Server Error caused by legacy contact data by updating API definitions to allow legacy contacts to be returned while still enforcing correct formatting in requests.

​

Added

• Domain Claims Period Support: Register domains during trademark claims period.
• New endpoint: GET /core/v1/domaininfo/claims/{domain} returns claim identifiers and validity dates.

​

Changed

• TLD Requirements: GET /core/v1/domaininfo/requirements/{tld} now returns claimsCheckRequired.
• Domain Create: POST /core/v1/domains now accepts optional claims object (claimId, notBefore, notAfter) when required by the TLD.

​

Added

• List Domains: New includeRenewalPrice query parameter.
  • true (default) includes renewal pricing in responses.
  • false omits renewal pricing for better performance.

​

Changed

• renewalPrice field is optional when includeRenewalPrice=false.
• Default pagination for List Domains changed from 1000 to 250.
• Removed access restriction on GET /core/v1/contacts/unverified (now available to all reseller accounts).
• .at TLD requirement now enforces data acknowledgement.

​

Fixed

• Create Transfer: Block transfers for domains registered less than 60 days; returns 409 Conflict with clear message and details.

​

Changed

• Webhook documentation: standardized response code capitalization from 4xx/5xx to 4XX/5XX.

​

Added

• Get Specific TLD Requirements: Added registryOperator parameter.
• Webhook HMAC Header Documentation: X-NAMECOM-SIGNATURE now shown on all webhook endpoints.

​

Fixed

• Request validation now enforces required fields as described in the API documentation.

​

Fixed

• Create Domain: Now correctly honors privacyEnabled=false instead of overriding with account default when provided.

​

Fixed

• Get Specific TLD Requirements: Clarified that punycode is expected (not URL-encoded params).

​

Added

• Contact model: Added verification status fields.
• Create Domain: Returns 451 Unavailable for Legal Reasons where restricted by law.
• Create Domain: Returns detailed validation errors for contact creation failures.
• Webhooks: All webhooks now send X-NAMECOM-SIGNATURE to verify authenticity.

​

Fixed

• Contact Verification List: Corrected createDate and verifyBy values for some contacts.

​

Added

• New webhook: domain.lock.status_change with registryStatuses in payload.
• New contact verification APIs (account-restricted):
  • List Unverified Contacts
  • Verify Contact

​

Changed

• TLD Pricing: Clarified that null pricing indicates unavailability for specific TLD/duration combinations.
• DNS Record Update: Duplicate record DB errors now return 409 Conflict instead of a generic server error.

​

Added

• Domain Info: New capabilities returned per TLD:
  • supportsPrivacy
  • requiresPreDelegation

​

Added

• Get Specific TLD Requirements: Added hsts, minDomainLength, minIdnDomainLength.
• Subscribe to Notifications: Documented 409 Conflict response when already subscribed.
• Zone Check API: Documented existing error responses.

​

Added

• Download Premium Domain Lists: New account-restricted API endpoint to download premium domain lists.

​

Added

• Transfers: GET /transfers and GET /transfers/{id} now include a full list of possible transfer statuses.

​

Changed

• Transfers: Status field standardized to snake_case; aligned with Domain Transfer Status Change webhook.

​

Fixed

• Create Domain: Now honors account setting for Automatic Advanced Security for new purchases.

​

Changed

• Domain Get Pricing: When a pricing category is not available, purchasePrice, renewalPrice, and transferPrice return null instead of a 422.

​

Fixed

• Create Transfer: Supports multiple concurrent transfer requests; 429 now used solely for rate limiting scenarios.
• Pricing error handling: Added 422 Unprocessable Entity for temporary pricing unavailability across:
  • Domain Create
  • Domain Renew
  • Domain Get Pricing
• Domain Get Pricing: Added missing 400 Bad Request documentation for invalid parameters/malformed requests.

​

Changed

• Error Response Consistency: More descriptive pricing-related error details across domain endpoints.

​

Fixed

• createDomain: Returns 400 Bad Request (not 403 Forbidden) for missing/invalid registration requirements.

​

Added

• Zone Check API: Fast availability checks via cached zone file data.
• Idempotency: Support for X-Idempotency-Key on Create Domain and Purchase Privacy.
  • Replayed requests respond with header X-Idempotent-Replay: 1.
• Domain Create docs: Improved examples including IDN domain creation.

​

Fixed

• TLD Pricing API: Ensured required fields are always present in responses.
• Check Availability: Returns 422 Unprocessable Entity when all domains have unsupported TLDs (replacing malformed dual-object JSON).

​

Changed

• Check Availability: Implementation optimized for speed; no behavioral changes.
• Organization field docs updated due to ICANN policy changes.
• 429 Rate Limited response in OpenAPI now indicates message is optional.

​

Changed

• TLD Pricing API:
  • Enforced duration parameter validation.
  • Filter invalid/unsupported tlds; if list becomes empty after filtering, return 400 Bad Request.

​

Fixed

• Domain Info: Return empty objects {} instead of empty arrays [] for relevant parameters.

​

Added

• TLD Pricing API: View general price list with account-level pricing.

​

Changed

• Response Schemas: Clarified which parameters are required and always present in responses.

​

Added

• Domain Info API: Returns general TLD info and any additional registration requirements; formatted for dynamic form generation.

​

Changed

• OpenAPI: Adjusted several descriptions to use v3.0-compatible structures (no functional changes).
• Webhook docs: DomainTransferStatusChange updated with list of triggering statuses.

​

Fixed

• List Domains: Optional filters no longer cause 500 Internal Server Error or incorrect result sets; filters are applied reliably.

​

Fixed

• Create Domain: Missing required contact phone number returns 400 Bad Request instead of 500.
• Validation Enforcement:
  • Contact phone and fax fields strictly validate E.164 format (^\+[1-9]\d{7,14}$); examples updated.
  • All email fields validated per RFC 822 addr-spec (with common practical exceptions).
  • Appropriate enums added; empty strings rejected for fields like first_name.

​

Fixed

• Authentication failures return 401 Unauthorized instead of 500.
• Pagination: perPage=0 now defaults to perPage=1000 instead of returning 500.

​

Fixed

• Create Transfer: Intermittent 500 replaced with 409 Conflict when a transfer is already in process.
  • Message: A transfer is already processing for this domain.

​

Changed

• Documentation format upgraded to OpenAPI 3.1 for better tooling and interactivity.
• Internal implementation rebuilt for faster iteration, better error handling, and consistent endpoint behavior.
• Error messaging:
  • Authentication errors now return 401 Unauthorized (previously conflated with 403 Forbidden which is now reserved for actual permission issues).
  • Insufficient account credit returns 402 Payment Required instead of 500.
• Consistent default values in responses (e.g., false, 0, "") instead of omitting them.
• Correct Content-Type headers for JSON responses (application/json).
• Content-Type: application/json strictly required for all PUT, POST, and PATCH requests (including body-less POST actions due to server behavior).

​

Removed

• SearchStream endpoint (may return in a future version with a revised implementation).

​

Added

• Domain Update endpoint for autorenew, WHOIS Privacy, and locking. See DomainUpdate docs.