Akamai Edge DNS
Akamai EdgeGrid API client credential setup: create an advanced EdgeGrid API client scoped to Edge DNS and copy its host, client token, client secret, and access token from one .edgerc block.
On this page
Akamai EdgeGrid API client credential permissions
- Credential type
- EdgeGrid API client credential
- Preview access
- DNS—Zone Record Management · READ-ONLY
- Apply access
- DNS—Zone Record Management · READ-WRITE
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "AKAMAIEDGEDNS"
}Create credentials
Create an advanced EdgeGrid API client scoped to Edge DNS and copy its host, client token, client secret, and access token from one .edgerc block.
Access you'll grant
DNS—Zone Record Management · READ-ONLY
DNS—Zone Record Management · READ-WRITE
Before you start
- An Akamai Control Center account with an active Edge DNS contract and access to the groups containing your zones.
- Permission to create an advanced API client. The underlying group needs READ for preview, WRITE for record changes, and ADD when DNSMigrator should create a zone.
- EdgeGrid credentials have a configured expiration date. Rotate with an overlap before that date so the old credential remains active while you replace the connection.
Setup steps
0 of 6 done
Start an advanced API client
In Akamai Control Center, open Identity and Access Management, select Create API client, and choose Advanced so you can restrict APIs, access levels, and groups.
Add Edge DNS API access
In the API access settings, add DNS—Zone Record Management. Choose READ-ONLY for a connection that only previews and reads zones, or READ-WRITE for record changes, zone creation, and DNSSEC changes.
PreviewDNS—Zone Record Management · READ-ONLYApplyDNS—Zone Record Management · READ-WRITELimit the client to DNS groups
Under the client's group access, include only groups that hold the Edge DNS zones. Confirm the selected group has
READ; apply needsWRITE, and creating a zone needsADD.Create and download the credential
Select Create API client, then choose Download to get an
.edgercfile or Copy to copy its credential block. Keephost,client_token,client_secret, andaccess_tokentogether from the same block.Find zone-creation IDs (optional)
Only do this if DNSMigrator should create a zone or filter the zone list by contract. The Edge DNS List groups response contains numeric
groupIdvalues and related contract IDs; List contracts returns eachcontractIdand itsREAD,WRITE,ADD, orDELETEpermissions. These IDs aren't in.edgerc.Groups endpoint/config-dns/v2/data/groupsContracts endpoint/config-dns/v2/data/contractsPaste the EdgeGrid values
Paste each value into the matching field here. Enter the API host without
https://. Add Contract ID and numeric Group ID only when needed; managed clients acting on another account also need the account switch key.
Troubleshooting
Akamai returns HTTP 401
Copy host, client_token, client_secret, and access_token again from one credential block. Don't mix values from two credentials, and remove any scheme or path from the host.
Akamai returns HTTP 403
Add DNS—Zone Record Management to the API client, include the zone's group, and use READ-WRITE for apply. Check the group's READ, WRITE, and ADD permissions for the attempted action.
The zone list is empty
Remove an incorrect Contract ID filter, expand the API client's group access, or add the account switch key when the zones belong to another account managed by this client.
Creating a zone says Contract ID and Group ID are required
Use Edge DNS List groups to get the numeric groupId, then List contracts for that group to get its contractId. Confirm the response includes ADD and the PRIMARY_ZONES feature.
Official documentation
- Edge DNS API: get started
- Create EdgeGrid authentication credentials
- Edge DNS group IDs and access level
- Rotate Akamai API client credentials
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| API hosthost | Required | The value after host = in the downloaded .edgerc block, without https:// or a trailing slash. |
| Client tokenclientToken | Required | The value after client_token = in the same .edgerc block. |
| Client secretclientSecret | Required | The value after client_secret = in the same .edgerc block. |
| Access tokenaccessToken | Required | The value after access_token = in the same .edgerc block. |
| Contract IDcontractId | Optional | Optional. The contractId returned by Edge DNS List contracts; current official examples look like C-0N7RAC7 or K-0N7RAK7. Needed to create zones and used to filter the zone list. |
| Group IDgroupId | Optional | Optional. The numeric groupId returned by Edge DNS List groups for a group this API client can access. Required to create a zone. |
| Account switch keyaccountSwitchKey | Optional | Managed clients only. Open the API client, scroll to Accounts you can manage from this client, search for the target account, and copy its account switch key. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- 60 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- DS
- HTTPS
- SVCB
- TLSA
- SSHFP
- NAPTR
- SPF
- LOC
- CERT
- RP
- ALIAS
Akamai-only types
- AKAMAICDN
- AKAMAITLC
These records need translation or review when you move to another provider.
Caveats
- AKAMAICDN and non-DUAL AKAMAITLC records point at Akamai edge hostnames. Other providers have no equivalent, so recreate them as CNAME or ALIAS records by hand.
- Apex ALIAS records are stored as AKAMAITLC records with the DUAL answer type. ALIAS records below the apex become CNAMEs.
- TXT values can't contain double quotes or backslashes.
Troubleshooting
- Akamai returns HTTP 401
- Copy host, client_token, client_secret, and access_token again from one credential block. Don't mix values from two credentials, and remove any scheme or path from the host.
- Akamai returns HTTP 403
- Add DNS—Zone Record Management to the API client, include the zone's group, and use READ-WRITE for apply. Check the group's READ, WRITE, and ADD permissions for the attempted action.
- The zone list is empty
- Remove an incorrect Contract ID filter, expand the API client's group access, or add the account switch key when the zones belong to another account managed by this client.
- Creating a zone says Contract ID and Group ID are required
- Use Edge DNS List groups to get the numeric groupId, then List contracts for that group to get its contractId. Confirm the response includes ADD and the PRIMARY_ZONES feature.