create
POST /v1/domains. DomainCreate is { name?, kind, receive? } — connect a BYOD domain by name, or mint the org’s system subdomain. Idempotent on the name.
list
GET /v1/domains, cursor-paginated.
get
GET /v1/domains/{id} — including the readiness tracks (dns_status, …).
verify
POST /v1/domains/{id}/verify. Re-runnable; each readiness track advances on its own, and the domain comes back as the answer. Run it after publishing the DNS records.
records
GET /v1/domains/{id}/records — the DNS records to publish. Always allowed, on every kind: reading the zone is never the dangerous half.
delete
DELETE /v1/domains/{id}.