Constellix DNS
Constellix API key setup: create a DNS-only Constellix sub-user, scope it to the required domains, and generate its HMAC API key pair.
On this page
Constellix API key permissions
- Credential type
- API key and secret key
- Preview access
- DNS app permission + Domains → Read Only
- Apply access
- DNS app permission + Domains → Read/Write/Commit
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
This provider does not have a DNSControl id.
Create credentials
Create a DNS-only Constellix sub-user, scope it to the required domains, and generate its HMAC API key pair.
Access you'll grant
DNS app permission + Domains → Read Only
DNS app permission + Domains → Read/Write/Commit
Before you start
- An active Constellix account.
- An account administrator who can add a sub-user and edit its DNS and domain permissions.
- The new sub-user must accept its invitation before generating API keys.
Setup steps
0 of 6 done
Create a DNS-only sub-user
In the Constellix Management Portal, open Manage Users → + Add User. Complete the user details and under User App Permissions select DNS only, then select Create. Have the user accept the invitation.
Limit the user's domain privileges
In the DNS portal, open Configuration → Users and select Domains beside the new user. In Assign Domain Permissions, set only the required domains to Read Only for preview or Read/Write/Commit for apply; leave every other domain at None.
Preview privilegeRead OnlyApply privilegeRead/Write/CommitOther domainsNoneAllow zone creation only if needed
Under New domain permissions on creation, enable Add Domains only when DNSMigrator should create missing domains. Enable Delete Domains only when rollback may remove a domain that DNSMigrator created.
Create domainsAdd DomainsDelete created domainsDelete DomainsOpen API key generation
Sign in as the scoped sub-user. From the dashboard choose Manage Profile, or choose Edit Profile under the user name, then select Generate API Keys on the left side of the User window.
Set an expiration and generate
In Add API Key, set an expiration in months that covers the migration rather than Never Expires, then select Generate. A user can have up to two API keys, which supports rotation.
Copy and paste both keys
Save the generated key and Secret Key, then paste them into API key and Secret key here. Constellix uses the secret to HMAC-sign the current request timestamp; an administrator cannot retrieve another user's secret key.
Troubleshooting
Constellix returns 401
Use the API key and secret key from the same active, unexpired pair. Request signatures also depend on the current time, so report persistent clock errors to DNSMigrator support.
The domain list is empty
Confirm the sub-user has the DNS app permission and at least Read Only under Configuration → Users → Domains for the intended domains.
Preview works but apply returns 403
Change the selected domains from Read Only to Read/Write/Commit. Enable Add separately if DNSMigrator must create a domain.
A previously working key stops authenticating
Check the expiration chosen in Add API Key and whether an administrator removed API credentials. Generate a replacement key under the same scoped user if needed.
Official documentation
- Generate a Constellix API key
- Configure Constellix domain permissions
- Add a Constellix sub-user
- Constellix DNS API authentication
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| API keyapiKey | Required | The API Key generated under Manage Profile → Generate API Keys for the scoped sub-user. |
| Secret keysecretKey | Required | The paired Secret Key shown for that generated key. It signs requests and must match the API Key exactly. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Not available through this connection
- Minimum TTL
- 0 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- ALIAS
- NAPTR
- SPF
- CERT
- RP
Constellix-only types
- URLFWD
These records need translation or review when you move to another provider.
Caveats
- Records using failover, traffic pools, IP filters, GeoProximity or regional answers are flagged and never changed by us; only the default answer is copied.
- HINFO records and DNSSEC aren't available through the Constellix v4 API.
- HTTP redirection records map to URL forwards for the whole hostname (301, 302 or frame); page title and keywords of frame redirects aren't copied.
- CAA records only support the issue, issuewild and iodef tags.
- Requests are signed with the current time, so the server clock must be accurate.
Troubleshooting
- Constellix returns 401
- Use the API key and secret key from the same active, unexpired pair. Request signatures also depend on the current time, so report persistent clock errors to DNSMigrator support.
- The domain list is empty
- Confirm the sub-user has the DNS app permission and at least Read Only under Configuration → Users → Domains for the intended domains.
- Preview works but apply returns 403
- Change the selected domains from Read Only to Read/Write/Commit. Enable Add separately if DNSMigrator must create a domain.
- A previously working key stops authenticating
- Check the expiration chosen in Add API Key and whether an administrator removed API credentials. Generate a replacement key under the same scoped user if needed.