Control D
SECURITY · DEVELOPER
DNS profiles, filters, and resolver rules on the account they connected.
Acts as the person, not as itself
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Credentials never touch the agent
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Every call on the record
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
controld_delete_accessWRITEDeauthorize an IP from a device. Only useful for restricted devices, or devices that have Legacy Resolvers. via DELETE /access
controld_delete_devices_by_device_idWRITEDelete an Endpoint. This will break DNS on any physical gadget that uses this Device's unique DNS resolvers. via DELETE /devices/{device_id}
controld_delete_profiles_by_profile_idWRITEDelete profile based on the primary key (PK). Profile cannot be enforced by a device to be deleted successfully (must be orphaned profile). via DELETE /profiles/{profile_id}
controld_delete_profiles_by_profile_id_groups_by_folderWRITEDelete folder and all custom rules inside it. via DELETE /profiles/{profile_id}/groups/{folder}
controld_delete_profiles_by_profile_id_rules_by_hostnameWRITEDelete one or more custom rules. via DELETE /profiles/{profile_id}/rules/{hostname}
controld_get_accessREADList up to latest 50 IPs that were used to query against a Device (resolver). via GET /access
controld_get_analytics_endpointsREADReturns Analytics stroage regions that can be set on the account or organization. via GET /analytics/endpoints
controld_get_analytics_levelsREADReturns Analytics log levels which can be enabled on Devices. via GET /analytics/levels
controld_get_billing_paymentsREADReturns billing history of all payments made. via GET /billing/payments
controld_get_billing_productsREADReturns all products currently activated on an account. via GET /billing/products
controld_get_billing_subscriptionsREADReturns all active and canceled subscriptions associated with an account. via GET /billing/subscriptions
controld_get_devicesREADList all Endpoints that are associated with an account or organization. via GET /devices
controld_get_devices_typesREADReturn a list of allowed device types. via GET /devices/types
controld_get_ipREADReturns current IP and datacenter that was used to handle the API request. via GET /ip
controld_get_networkREADReturns network stats on available services in different POPs. via GET /network
controld_get_organizations_membersREADView organization membership via GET /organizations/members
controld_get_organizations_organizationREADView details of an organization. via GET /organizations/organization
controld_get_organizations_sub_organizationsREADView sub-organizations and their details. via GET /organizations/sub_organizations
controld_get_profilesREADList all profiles associated with an account. via GET /profiles
controld_get_profiles_by_profile_id_defaultREADReturns status of the Default Rule. via GET /profiles/{profile_id}/default
controld_get_profiles_by_profile_id_filtersREADReturns all Native filters for this profile and their states. via GET /profiles/{profile_id}/filters
controld_get_profiles_by_profile_id_filters_externalREADReturns all 3rd party filters for this profile and their states. via GET /profiles/{profile_id}/filters/external
controld_get_profiles_by_profile_id_groupsREADReturn all folders in a profile. These can be used to group custom rules. via GET /profiles/{profile_id}/groups
controld_get_profiles_by_profile_id_rules_by_folder_idREADReturn custom rules in a folder. For root folder, omit the folder ID. via GET /profiles/{profile_id}/rules/{folder_id}
controld_get_profiles_by_profile_id_servicesREADThis returns services that have any kind of rule associated with it. via GET /profiles/{profile_id}/services
controld_get_profiles_optionsREADGet all profile options. via GET /profiles/options
controld_get_proxiesREADReturns list of usable proxies that traffic can be redirected through. via GET /proxies
controld_get_services_categoriesREADList Service Categories via GET /services/categories
controld_get_services_categories_by_categoryREADList All Services via GET /services/categories/{category}
controld_get_usersREADReturns all relevant account information of a Control account. via GET /users
controld_post_accessWRITESupply an array of IPs to authorize on the device. These IPs will be able to use the Legacy DNS IPv4 resolver and have access to proxies. If this is a restricted device, then only these IPs will be able to communicate with it. via POST /access
controld_post_devicesWRITECreate a new Endpoint. This endpoint will return DNS resolvers specific to this Device. via POST /devices
controld_post_organizations_suborgWRITECreate a new Sub-Organization. via POST /organizations/suborg
controld_post_profilesWRITECreate a new blank profile, or clone an existing one. via POST /profiles
controld_post_profiles_by_profile_id_groupsWRITECreate a new folder and assign it an optional rule. via POST /profiles/{profile_id}/groups
controld_post_profiles_by_profile_id_rulesWRITECreate one or more custom rules. via POST /profiles/{profile_id}/rules
controld_put_devices_by_device_idWRITEModify an existing Endpoint and its settings. via PUT /devices/{device_id}
controld_put_organizationsWRITEModify Sub-Organization and all its details, including seats. via PUT /organizations
controld_put_profiles_by_profile_idWRITEModify an existing profile. via PUT /profiles/{profile_id}
controld_put_profiles_by_profile_id_defaultWRITEReturns status of the Default Rule. via PUT /profiles/{profile_id}/default
controld_put_profiles_by_profile_id_filtersWRITEEnable or disable multiple filters on a specified {profile}, which is the value of PK from the List endpoint. via PUT /profiles/{profile_id}/filters
controld_put_profiles_by_profile_id_filters_filter_by_filterWRITEEnables or disables a {filter} on a specified {profile}, which is the value of PK from the List endpoint. via PUT /profiles/{profile_id}/filters/filter/{filter}
controld_put_profiles_by_profile_id_groups_by_folderWRITEModify an existing folder. via PUT /profiles/{profile_id}/groups/{folder}
controld_put_profiles_by_profile_id_options_by_nameWRITESet an option on a profile. via PUT /profiles/{profile_id}/options/{name}
controld_put_profiles_by_profile_id_rulesWRITEModify an existing custom rule. via PUT /profiles/{profile_id}/rules
controld_put_profiles_by_profile_id_services_by_serviceWRITECreate or modify a rule for a {service} in a {profile}. via PUT /profiles/{profile_id}/services/{service}
Often connected alongside
Put Control D behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.