# Authoritative desired DNS record set for a connection

> Authoritative desired DNS record set for a connection: CustomDomain™ API reference in the connections group. Covers parameters, request body and responses.

Source: https://docs.customdomain.ai/docs/api-reference/connections/getConnectionRecords

## `GET https://api.customdomain.ai/v1/connections/{id}/records`

The single source of truth the widget renders, the OAuth callback writes, and the propagation poller verifies. Before records are applied, the default edge record is synthesized server-side.

A delegated agent token needs `domains:read` or `domains:connect`.

A widget token must be the connection's end user: a connection that names another end user than the token's `end_user_ref`, or names one while the token names none, answers `403` `token_wrong_end_user` before anything is read or changed, and a connection that names none is any token's. An API key, an app-scoped token and a delegated agent token are not limited by it.

### Authentication

`widgetJWT`, `apiKey`, `agentToken`, `agentToken`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | Records |
| `401` | Error envelope: {code, title, details}. |
| `403` | `forbidden`: the credential may not do this. `token_wrong_end_user`: a widget token that is not this connection's end user (the connection names another end user than the token's `end_user_ref`, or names one while the token names none); nothing is read or changed, and the answer shows nothing of the connection. Mint the token with the end user's `end_user_ref`. |
| `404` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `connection_id` | string | yes |  |
| `records` | array of object | yes |  |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.