Control D

SECURITY · DEVELOPER

DNS profiles, filters, and resolver rules on the account they connected.

Connecting Control D in practice

Control D warns in its own getting-started page that the API has no versioning and that breaking changes can land without notice, and tokens come in exactly two strengths. Asking an agent to add one block rule means handing it a Write token, which is full read and write over every DNS profile, device and IP allow-list on the account.

Scopes that draw scrutiny

Write token Control D describes it as a "Full access token. Allows reads and writes" — the only level above Read, with no per-profile, per-device or per-endpoint narrowing.
Read token View-only, but that still covers every profile, device and known-IP list on the organization, including the DNS analytics configuration.

Who has to approve

Token creation is an admin action: Control D documents the API section as the place where Organization admins and owners generate and manage API credentials. A token can additionally be pinned to an Allowed IPs list of comma-separated IPv4, IPv6 or CIDR entries, and both the type and that list can be edited afterwards.

Worth knowing

The docs carry a standing usage warning: the API has no versioning, changes are usually non-breaking, and breaking changes can be introduced without warning.
Every response is JSON with a success boolean; failures come back with success:false and an error object whose code repeats the HTTP status in its first three digits, so a client that inspects only one of the two can misread the other.
Returned data lives under body.<controllerName>, not under a fixed key, so the response shape changes with the endpoint you called.
Every object is addressed by a PK field rather than a conventional id, so identifiers have to be carried through from a list call.

Checked against Control D API getting started (2026-09-29), Control D API authentication (2026-09-29), Control D response conventions (2026-09-29), Control D organization API tokens (2026-09-29)

Acts as the person, not as itself

Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.

Credentials never touch the agent

Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.

Every call on the record

Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.

What an agent can do

Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.

controld_delete_accessWRITE

Deauthorize an IP from a device. Only useful for restricted devices, or devices that have Legacy Resolvers. via DELETE /access

write

controld_delete_devices_by_device_idWRITE

Delete an Endpoint. This will break DNS on any physical gadget that uses this Device's unique DNS resolvers. via DELETE /devices/{device_id}

write

controld_delete_profiles_by_profile_idWRITE

Delete profile based on the primary key (PK). Profile cannot be enforced by a device to be deleted successfully (must be orphaned profile). via DELETE /profiles/{profile_id}

write

controld_delete_profiles_by_profile_id_groups_by_folderWRITE

Delete folder and all custom rules inside it. via DELETE /profiles/{profile_id}/groups/{folder}

write

controld_delete_profiles_by_profile_id_rules_by_hostnameWRITE

Delete one or more custom rules. via DELETE /profiles/{profile_id}/rules/{hostname}

write

controld_get_accessREAD

List up to latest 50 IPs that were used to query against a Device (resolver). via GET /access

read

controld_get_analytics_endpointsREAD

Returns Analytics stroage regions that can be set on the account or organization. via GET /analytics/endpoints

read

controld_get_analytics_levelsREAD

Returns Analytics log levels which can be enabled on Devices. via GET /analytics/levels

read

controld_get_billing_paymentsREAD

Returns billing history of all payments made. via GET /billing/payments

read

controld_get_billing_productsREAD

Returns all products currently activated on an account. via GET /billing/products

read

controld_get_billing_subscriptionsREAD

Returns all active and canceled subscriptions associated with an account. via GET /billing/subscriptions

read

controld_get_devicesREAD

List all Endpoints that are associated with an account or organization. via GET /devices

read

controld_get_devices_typesREAD

Return a list of allowed device types. via GET /devices/types

read

controld_get_ipREAD

Returns current IP and datacenter that was used to handle the API request. via GET /ip

read

controld_get_networkREAD

Returns network stats on available services in different POPs. via GET /network

read

controld_get_organizations_membersREAD

View organization membership via GET /organizations/members

read

controld_get_organizations_organizationREAD

View details of an organization. via GET /organizations/organization

read

controld_get_organizations_sub_organizationsREAD

View sub-organizations and their details. via GET /organizations/sub_organizations

read

controld_get_profilesREAD

List all profiles associated with an account. via GET /profiles

read

controld_get_profiles_by_profile_id_defaultREAD

Returns status of the Default Rule. via GET /profiles/{profile_id}/default

read

controld_get_profiles_by_profile_id_filtersREAD

Returns all Native filters for this profile and their states. via GET /profiles/{profile_id}/filters

read

controld_get_profiles_by_profile_id_filters_externalREAD

Returns all 3rd party filters for this profile and their states. via GET /profiles/{profile_id}/filters/external

read

controld_get_profiles_by_profile_id_groupsREAD

Return all folders in a profile. These can be used to group custom rules. via GET /profiles/{profile_id}/groups

read

controld_get_profiles_by_profile_id_rules_by_folder_idREAD

Return custom rules in a folder. For root folder, omit the folder ID. via GET /profiles/{profile_id}/rules/{folder_id}

read

controld_get_profiles_by_profile_id_servicesREAD

This returns services that have any kind of rule associated with it. via GET /profiles/{profile_id}/services

read

controld_get_profiles_optionsREAD

Get all profile options. via GET /profiles/options

read

controld_get_proxiesREAD

Returns list of usable proxies that traffic can be redirected through. via GET /proxies

read

controld_get_services_categoriesREAD

List Service Categories via GET /services/categories

read

controld_get_services_categories_by_categoryREAD

List All Services via GET /services/categories/{category}

read

controld_get_usersREAD

Returns all relevant account information of a Control account. via GET /users

read

controld_post_accessWRITE

Supply an array of IPs to authorize on the device. These IPs will be able to use the Legacy DNS IPv4 resolver and have access to proxies. If this is a restricted device, then only these IPs will be able to communicate with it. via POST /access

write

controld_post_devicesWRITE

Create a new Endpoint. This endpoint will return DNS resolvers specific to this Device. via POST /devices

write

controld_post_organizations_suborgWRITE

Create a new Sub-Organization. via POST /organizations/suborg

write

controld_post_profilesWRITE

Create a new blank profile, or clone an existing one. via POST /profiles

write

controld_post_profiles_by_profile_id_groupsWRITE

Create a new folder and assign it an optional rule. via POST /profiles/{profile_id}/groups

write

controld_post_profiles_by_profile_id_rulesWRITE

Create one or more custom rules. via POST /profiles/{profile_id}/rules

write

controld_put_devices_by_device_idWRITE

Modify an existing Endpoint and its settings. via PUT /devices/{device_id}

write

controld_put_organizationsWRITE

Modify Sub-Organization and all its details, including seats. via PUT /organizations

write

controld_put_profiles_by_profile_idWRITE

Modify an existing profile. via PUT /profiles/{profile_id}

write

controld_put_profiles_by_profile_id_defaultWRITE

Returns status of the Default Rule. via PUT /profiles/{profile_id}/default

write

controld_put_profiles_by_profile_id_filtersWRITE

Enable or disable multiple filters on a specified {profile}, which is the value of PK from the List endpoint. via PUT /profiles/{profile_id}/filters

write

controld_put_profiles_by_profile_id_filters_filter_by_filterWRITE

Enables or disables a {filter} on a specified {profile}, which is the value of PK from the List endpoint. via PUT /profiles/{profile_id}/filters/filter/{filter}

write

controld_put_profiles_by_profile_id_groups_by_folderWRITE

Modify an existing folder. via PUT /profiles/{profile_id}/groups/{folder}

write

controld_put_profiles_by_profile_id_options_by_nameWRITE

Set an option on a profile. via PUT /profiles/{profile_id}/options/{name}

write

controld_put_profiles_by_profile_id_rulesWRITE

Modify an existing custom rule. via PUT /profiles/{profile_id}/rules

write

controld_put_profiles_by_profile_id_services_by_serviceWRITE

Create or modify a rule for a {service} in a {profile}. via PUT /profiles/{profile_id}/services/{service}