Platform

tmgmt is a read-only reseller API. One control plane serves HTTP, MCP, and CLI clients alike; every route is a read, and nothing a customer can reach performs a supplier write.

Read-only posture

The API surface is GET-only with a single exception: POST /v1/domains/{resourceId}/dns/preview, which returns a dry-run preview of a DNS change without applying it. All other routes only read — portfolio inventory, discovery, quotes, plans, and notifications. Purchase, renewal, transfer, and DNS changes are never executed; registration and lifecycle endpoints return validated plans and preflights rather than performing mutations.

Supplier writes stay disabled on every offering, and failures return a neutral error envelope: code, message, retryable, and details.

Discovery, built in

Capabilities are discoverable at runtime — clients don't need out-of-band documentation to know what's available:

• GET /v1/capabilities — the live discovery endpoint describing the API's capabilities.
• GET /v1/offerings — the reseller offering coverage matrix: the eight white-label offering ids and their read-only coverage.

The OpenAPI spec documents 29 routes in total. See the docs hub for the full route table and the raw spec.

Entitlement-gated reads

Reads are gated on entitlement evidence. Evidence is caller-supplied: the platform reports what it can verify and marks anything unverifiable as "unknown" rather than guessing. When entitlement can't be verified for an offering, the corresponding read routes return 409 — the request is understood but not serviceable without verified entitlement.

Dry-run previews

Where a change would matter, tmgmt previews it first. POST /v1/domains/{resourceId}/dns/preview renders exactly what a DNS update would do — a dry run that changes nothing. Registration quotes and safety-checked registration plans work the same way: inspectable, never executed.

White-label posture

tmgmt customers must not know the upstream supplier. Public ids, error messages, OpenAPI descriptions, and notifications use neutral, customer-facing naming — no supplier brands appear anywhere a customer can see.