UltraDNS (DigiCert)
UltraDNS API credentials setup: invite a dedicated UltraDNS API-only user and place it in the read-only REPORTING group or DNS-specific DNS-ADMINISTRATION group.
On this page
UltraDNS API credentials permissions
- Credential type
- API-only user name and password
- Preview access
- REPORTING
- Apply access
- DNS-ADMINISTRATION
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
This provider does not have a DNSControl id.
Create credentials
Invite a dedicated UltraDNS API-only user and place it in the read-only REPORTING group or DNS-specific DNS-ADMINISTRATION group.
Access you'll grant
REPORTING
DNS-ADMINISTRATION
Before you start
- An active UltraDNS account.
- A Primary Account Owner or administrative user who can invite users and assign groups.
- Confirm Customer Test Environment access and limitations with UltraDNS Customer Support before using the optional test endpoint.
Setup steps
0 of 6 done
Open the account's users
In the UltraDNS portal, open Accounts, select the Account that owns the zones, and open its Users area. The account administrator performs the invitation; the API-only user cannot use the portal afterward.
Choose a DNS access group
Choose
REPORTINGfor a preview-only connection orDNS-ADMINISTRATIONfor apply. If you create a custom group instead, grant only Read for preview; apply needs Read, Write, Create, and Delete on the intended Domain and Resource Records objects.Preview groupREPORTINGApply groupDNS-ADMINISTRATIONApply permission levelsRead Write Create DeleteInvite an API-only user
Select Invite New User, choose the account under Invite to Account, choose the group under Assign to Group, enable API only access, enter the dedicated user's email, and select Invite.
Accept the invitation
Follow the invitation email and set the dedicated User Name and password. Keep both values. UltraDNS's OAuth password grant accepts only the user name and password, which is why this must be an API-only credential rather than an interactive SSO login.
Record the account name (optional)
If the user belongs to more than one account, copy the value in the Account column on Accounts and enter it here. Leave it empty when the user has exactly one account. DNSMigrator also uses it when creating a primary zone.
Paste the credentials
Enter the dedicated API user name and Password, plus the optional Account name. Enable Use the customer test environment only for credentials provisioned there; it sends every request to
test-api.ultradns.cominstead of production.Production APIhttps://api.ultradns.comCustomer test APIhttps://test-api.ultradns.com
Troubleshooting
UltraDNS rejects the user name or password
Confirm the invitation was accepted and the user has API only access. Stop retrying after repeated failures: UltraDNS locks accounts after multiple unsuccessful logins.
The user can access several accounts
Enter the exact Account value from the Accounts page so DNSMigrator can scope zone listing and zone creation.
Preview works but apply is denied
Move the user from REPORTING to DNS-ADMINISTRATION, or give its custom group Read, Write, Create, and Delete on the relevant Domain and Resource Records objects.
Test-environment login fails
Turn off the test-environment option for production credentials. If you need the test endpoint, ask UltraDNS Customer Support about Customer Test Environment access and limitations.
Official documentation
- UltraDNS user management
- UltraDNS groups and permissions
- UltraDNS REST authorization
- UltraDNS REST environments
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| API user nameusername | Required | The User Name chosen while accepting the invitation for the API-only user. |
| Passwordpassword | Required | The password for that API-only user, not an SSO or portal-only credential. |
| Account nameaccountName | Optional | The Account value on UltraDNS's Accounts page. Required when the user can access multiple accounts and when creating a primary zone. |
| Use the customer test environmenttestEnvironment | Optional | Enable only after confirming Customer Test Environment access and limitations with UltraDNS Customer Support. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Managed through the API
- Minimum TTL
- 0 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- PTR
- ALIAS
- DS
- HTTPS
- SVCB
- TLSA
- SSHFP
- NAPTR
- SPF
- RP
Caveats
- Traffic-management pools (SiteBacker, Traffic Controller, Directional and Simple Load Balancing) are copied as plain answers and flagged; we never change or delete them on UltraDNS.
- Resource Distribution pools keep their pool settings when we update their answers.
- ALIAS is written as UltraDNS Apex Alias, which only works at the zone apex, can't coexist with both A and AAAA at the apex, and can't be used in statically signed zones.
- SOA, apex NS and system-generated records (such as Valimail DMARC records) are managed by UltraDNS and left untouched.
- Web Forwards and secondary or alias zones aren't migrated; secondary and alias zones are read-only.
- UltraDNS locks an account after repeated failed logins, so double-check the password before retrying.
Troubleshooting
- UltraDNS rejects the user name or password
- Confirm the invitation was accepted and the user has API only access. Stop retrying after repeated failures: UltraDNS locks accounts after multiple unsuccessful logins.
- The user can access several accounts
- Enter the exact Account value from the Accounts page so DNSMigrator can scope zone listing and zone creation.
- Preview works but apply is denied
- Move the user from REPORTING to DNS-ADMINISTRATION, or give its custom group Read, Write, Create, and Delete on the relevant Domain and Resource Records objects.
- Test-environment login fails
- Turn off the test-environment option for production credentials. If you need the test endpoint, ask UltraDNS Customer Support about Customer Test Environment access and limitations.