domains

OVHcloud domain names, by the OVHcloud API

Returns, for each domain name of an OVHcloud account, the days left before it expires, how it is renewed, and the status of its service, read through the OVHcloud API with an application's keys that may only read. Four watches are offered, each one set on the probe.

Versions

Generic: the OVHcloud API is the same in its three places, Europe (eu.api.ovh.com), Canada (ca.api.ovh.com) and the United States (api.us.ovhcloud.com), version 1.0. The address is that of protocol:ovh:endpoint, where the keys were created.

How it works

Every request is a GET to <protocol:ovh:endpoint><path>, signed by ovh.sign.

1. GET /domain: the domain names of the account, ["example.com", …].
2. For each domain, GET /domain/<name>/serviceInfos, the service that bills it:

{"domain": "example.com", "expiration": "2027-03-14", "status": "ok", "renew": {"automatic": true, "deleteAtExpiration": false, "forced": false, "manualPayment": false, "period": 12}, …}

• days-left is the time from now to expiration, in days, to the tenth. expiration is a date without a time: it is read as midnight UTC that day.
• renewal is delete-at-expiration when renew.deleteAtExpiration is true, automatic when renew.automatic is true, manual otherwise, and unknown when OVHcloud gives no renew (it may be null).
• status is status: ok, autorenewInProgress, inCreation, expired, unPaid or pendingDebt.
• An address of the API not written https://<host>/<version> stops the collector misconfigured before anything leaves.
• A code 401 (keys wrong, expired or revoked, or the poller's clock off) or 403 (the consumer key not allowed the route) stops the collector misconfigured; a code 400 or 404 too; any other code but 200 stops it unreachable.

The keys come from protocol:ovh: the application secret never leaves the poller, only the signature it makes; the consumer key goes in a header, to the API only, in HTTPS. The answers are not secret.

Prerequisites

• An application created on the API of the account's place, and a consumer key whose access rules allow these routes and nothing else:

{
  "accessRules": [
    { "method": "GET", "path": "/domain" },
    { "method": "GET", "path": "/domain/*" }
  ]
}

The application key goes in protocol:ovh:application-key, its secret in protocol:ovh:application-secret, the consumer key in protocol:ovh:consumer-key, the address of the API in protocol:ovh:endpoint, https://eu.api.ovh.com/1.0. With an IAM policy of OVHcloud instead, the actions are domain:apiovh:get and domain:apiovh:serviceInfos/get.

• The poller reaches the API in HTTPS, and its clock is right: OVHcloud refuses a signature too far from its own time. The certificates of OVHcloud are issued by public authorities: the profile "Standard" trusts them.

Variables

The collector declares none of its own: it reads protocol:ovh and protocol:ovh:endpoint.

Outputs

Watches

A domain left to expire on purpose is left out by the selection of the probe.

Limits

• One call per domain each run, beside the list.
• The days are counted from midnight UTC of the expiry date, which OVHcloud gives without a time nor a zone: a few hours off at most.
• Not checked against an OVHcloud account: the routes, their fields and their values are those of the schema the OVHcloud API publishes for itself (/1.0/domain.json: services.Service, service.RenewType, service.StateEnum), which its console shows; the date written 2027-03-14 is the form of its type date, not seen in an answer.