All Products
Search

This Product

    Domain Names:Authentication rules for the Domains API

    Document Center

    Domain Names:Authentication rules for the Domains API

    Last Updated:Jun 10, 2026

    When a Resource Access Management (RAM) user calls the Domains API, the Domains service checks RAM to verify that the resource owner has authorized access to the requested domain resources.

    For each API call from a RAM user, the Domains service sends an authentication request to RAM to confirm that the caller has the required permissions on the target resources.

    Each API operation checks specific resources based on its semantics. The following tables list the authentication rules for each operation.
    Note $accountid is your Alibaba Cloud account ID. Log on to your Alibaba Cloud account to view it.
    Table 2. Resource-level authorization
    Operation Authenticated action Resource
    SaveSingleTaskForUpdatingContactInfo domain:DomainInfoModification acs:domain:*:$accountid:domain/$domainName
    SaveBatchTaskForUpdatingContactInfo acs:domain:*:$accountid:domain/$domainName
    TransferInReenterTransferAuthorizationCode domain:DomainTransferInOperation acs:domain:*:$accountid:domain/$domainName
    TransferInRefetchWhoisEmail acs:domain:*:$accountid:domain/$domainName
    TransferInResendMailToken acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForCancelingTransferIn acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForCancelingTransferOut domain:DomainTransferOutOperation acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForQueryingTransferAuthorizationCode acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForModifyingDnsHost domain:DnsHostModification acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForCreatingDnsHost acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForSynchronizingDnsHost acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForDeletingDnsHost acs:domain:*:$accountid:domain/$domainName
    SaveBatchTaskForModifyingDomainDns domain:DnsModification acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForTransferProhibitionLock domain:SecuritySetting acs:domain:*:$accountid:domain/$domainName
    SaveBatchTaskForTransferProhibitionLock acs:domain:*:$accountid:domain/$domainName
    SaveSingleTaskForUpdateProhibitionLock acs:domain:*:$accountid:domain/$domainName
    SaveBatchTaskForUpdateProhibitionLock acs:domain:*:$accountid:domain/$domainName
    Table 4. Operation-level authorization
    Operation Authenticated action Resource
    QueryDomainList domain:QueryCommonInfo acs:domain:*:$accountid:*
    QueryDomainByInstanceId acs:domain:*:$accountid:*
    QueryContactInfo acs:domain:*:$accountid:*
    VerifyContactField acs:domain:*:$accountid:*
    QueryTaskList domain:QueryDomainTask acs:domain:*:$accountid:*
    QueryTaskInfoHistory acs:domain:*:$accountid:*
    QueryTaskDetailList acs:domain:*:$accountid:*
    QueryTaskDetailHistory acs:domain:*:$accountid:*
    PollTaskResult acs:domain:*:$accountid:*
    QueryChangeLogList domain:QueryChangeLog acs:domain:*:$accountid:*
    QueryTransferInByInstanceId domain:QueryDomainTransferIn acs:domain:*:$accountid:*
    QueryTransferInList acs:domain:*:$accountid:*
    CheckTransferInFeasibility acs:domain:*:$accountid:*
    TransferInCheckMailToken domain:TransferInCheckMailToken acs:domain:*:$accountid:*
    QueryTransferOutInfo domain:QueryDomainTransferOut acs:domain:*:$accountid:*
    QueryDnsHost domain:QueryDnsHost acs:domain:*:$accountid:*
    QueryRegistrantProfiles domain:QueryRegistrantProfile acs:domain:*:$accountid:*
    ListEmailVerification domain:QueryEmailVerification acs:domain:*:$accountid:*
    AcknowledgeTaskResult domain:AcknowledgeTaskResult acs:domain:*:$accountid:*
    SaveRegistrantProfile domain:RegistrantProfileOperation acs:domain:*:$accountid:*
    DeleteRegistrantProfile acs:domain:*:$accountid:*
    DeleteEmailVerification domain:EmailVerificationOperation acs:domain:*:$accountid:*
    VerifyEmail acs:domain:*:$accountid:*
    ResendEmailVerification acs:domain:*:$accountid:*
    SubmitEmailVerification acs:domain:*:$accountid:*
    Table 6. Service-level authorization
    Operation Authenticated action Resource
    * domain:* acs:domain:*:$accountid:*