# tmgmt — full reference

tmgmt is a white-label reseller API platform exposing read-only portfolio management across domains, customer accounts, SSL certificates, commerce, aftermarket domains, domain parking, hosting, and notifications. Customers must not know the upstream supplier; public ids, errors, and docs use neutral naming.

OpenAPI spec: /openapi.json (interactive viewer at /api.html). Docs hub: /docs.html. Platform overview: /platform.html. Offerings detail: /offerings.html.

## Offering matrix (white-label id -> customer-facing category)

| id | category | covers | key read routes |
|---|---|---|---|
| domains | domains | domain portfolio, DNS, discovery and lifecycle APIs | GET /v1/domains, /v1/domains/{resourceId}, /v1/domains/availability, /v1/domains/suggestions, /v1/domains/quote, /v1/domains/prepare-registration, /v1/domains/{resourceId}/dns, POST /v1/domains/{resourceId}/dns/preview |
| customer-accounts | customer accounts | trusted reseller customer context derived server-side | GET /v1/portfolio/context |
| certificates | SSL certificates | certificate inventory, expiration/status/renewal risk | GET /v1/portfolio/certificates, /v1/portfolio/broader-health, /v1/portfolio/exceptions |
| commerce | commerce | store/channel/transaction reads | GET /v1/portfolio/commerce, /v1/portfolio/broader-health, /v1/portfolio/exceptions |
| aftermarket | aftermarket domains | aftermarket/auction reads | GET /v1/portfolio/aftermarket |
| parking | domain parking | parked-domain reads | GET /v1/portfolio/parking |
| hosting | hosting | hosting-product reads | GET /v1/portfolio/hosting |
| notifications | notifications | portfolio notifications + payload schemas | GET /v1/portfolio/notifications, /v1/portfolio/notifications/schemas/{schemaName} |

Entitlement-gated portfolio reads return 409 when entitlement is unverified.

GET /v1/portfolio/exceptions is GET-only: any other method returns 405 Method Not Allowed (with an `Allow: GET` header and no response body).

## Read-only posture

The API is GET-only except POST /v1/domains/{resourceId}/dns/preview, a dry-run preview that changes nothing. Purchase, renewal, transfer, and DNS changes are never executed; registration/lifecycle endpoints return validated plans and preflights instead. Supplier writes stay disabled on every offering. Errors use a neutral envelope: {code, message, retryable, details}.

HTTP, MCP, and CLI share one control plane. Entitlement evidence is caller-supplied; unknown values are reported as "unknown".

## API surface (29 routes)

GET /health/live
GET /health/ready
GET /v1/capabilities            <- live discovery endpoint
GET /v1/domains
GET /v1/domains/availability
GET /v1/domains/prepare-registration
GET /v1/domains/quote
GET /v1/domains/suggestions
GET /v1/domains/{resourceId}
GET /v1/domains/{resourceId}/dns
POST /v1/domains/{resourceId}/dns/preview   <- dry-run only
GET /v1/offerings               <- reseller offering coverage matrix
GET /v1/operations/{operationId}
GET /v1/portfolio
GET /v1/portfolio/actions
GET /v1/portfolio/aftermarket
GET /v1/portfolio/broader-health
GET /v1/portfolio/catalog
GET /v1/portfolio/certificates
GET /v1/portfolio/commerce
GET /v1/portfolio/context
GET /v1/portfolio/diagnostics
GET /v1/portfolio/exceptions
GET /v1/portfolio/health
GET /v1/portfolio/hosting
GET /v1/portfolio/notifications
GET /v1/portfolio/notifications/schemas/{schemaName}
GET /v1/portfolio/parking
GET /v1/portfolio/renewal-risk