domain.latino API

Authentication

Send your API key as a Bearer token. Create and manage keys in your account settings — the full key is shown only once at creation, so store it securely.

Authorization: Bearer dpk_live_<selector>_<secret>

Keys look like dpk_<env>_<selector>_<secret>, where env is live or test.

A logged-in browser session can call the same endpoints; session-authenticated writes additionally require an X-CSRF-Token header. Bearer-token requests do not.

Scopes & rate limits

Every key carries a set of scopes. A call must be made with a key that holds the endpoint's scope. Rate limits are applied per scope, per key.

Restricted scopes are double-gated: a key may list the scope, but calls only succeed once an admin has granted it to your account. Apply from your account settings.

Supported domain zones

One account and one API key work across every zone below — the base URL you call selects the zone.

Quickstart

Two quick calls to get started:

# Check a name
curl -s https://domain.latino/api/v1/check-domain \
  -H "Authorization: Bearer dpk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"domain":"acme.latino"}'

# Who am I + what can I do
curl -s https://domain.latino/api/v1/account \
  -H "Authorization: Bearer dpk_live_…"

Endpoints

All endpoints are live. Request and response schemas, parameters and status codes are fully described in the OpenAPI document.

Account

Domains

Catalog

Orders

Payment methods

Webhooks

Restricted

For the complete request/response contract, import the OpenAPI spec: Download OpenAPI (JSON).

Webhooks

Register an HTTPS endpoint and we push signed events as they happen. The signing secret is shown once at creation.

We POST the event envelope as JSON:

{
  "id": "evt_…",
  "event": "payment.succeeded",
  "created": "2026-05-28T12:00:00+00:00",
  "data": { "order": { … } }
}

Verify every delivery by recomputing the HMAC-SHA256 over the raw request body with your signing secret and comparing in constant time:

X-Domain-Pay-Signature: sha256=<HMAC_SHA256(raw_body, signing_secret)>

Non-2xx responses (or timeouts) are retried with exponential backoff (1 min to 24 h) up to 6 attempts. After 5 consecutive dead deliveries the endpoint is auto-disabled and the owner is alerted.

Errors

All errors share one shape. The request_id is echoed on every error — quote it in support requests.

{ "error": "scope_required", "message": "…", "request_id": "req_ab12…", "scope": "orders.read" }

Restricted access

The zone-file, premium and registered endpoints need an approved grant in addition to the scope:

1. Create (or already have) an API key listing the restricted scope.
2. In your account settings, open Restricted API access, pick the scope, and explain how you'll use the data.
3. Our team reviews and emails you a decision.
4. Once approved, any key on your account that lists that scope can use it immediately. No paid tier — approval is per account.