Get auth code to move a domain away

The auth code that moves a domain from manitu to another provider.

WWriteNot idempotentbetaNeeds service_domain

Tool

manitu_domain_transfer_out_authcode_geton https://mcp.manitu.de/mcp

POST

/v1/domain/transfer/out/authcode/geton https://api.manitu.de

Try it

Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Annotations as tools/list sends them

readOnlyHint falsedestructiveHint falseidempotentHint falseopenWorldHint false

Description for the model

Gets the auth code (EPP or transfer code) that moves a domain from manitu to another provider - the customer gives it to the new provider. Needs the customer's consent: the first call is refused with a conflict consent_required carrying consent_list (the AGB) and a consent_token. Show the customer every item - title with link, in its language (the binding wording) - and ask for an explicit yes; only then make the same call again with consent_token (valid 15 minutes, once). Never agree on the customer's behalf. The code itself is withheld here (secrets_withheld): tell the customer to take it from the customer panel (mein.manitu.de) - he also gets a mail. auto_nack true: at this registry a transfer away is refused unless manitu lets it through - the customer should tell manitu once he started it at the new provider. Refused with a conflict when the domain cannot be moved (not_transferable: not active, or a subdomain).

Arguments

namestringrequired

The domain name, with international characters or in ASCII.

min length 1max length 253

regenerateboolean

true: a new code - the old one stops working. Default false.

consent_tokenstringwrite-only

The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once.

min length 1max length 255

Result structuredContent, checked against the schema

namestringrequired

The domain, with international characters.

authcodestring | nullrequired

The auth code - a secret; null where it is withheld (secrets_withheld), or where the registry has none to give.

expires_atstring | nullrequired

Until when the code is valid; null: no end known.

Format date-time

auto_nackbooleanrequired

true: at this registry a transfer away is refused unless manitu lets it through.

secrets_withheldbooleanrequired

The code is left out here (an answer to an agent).

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

namestringrequired

The domain name, with international characters or in ASCII.

min length 1max length 253

regenerateboolean

true: a new code - the old one stops working. Default false.

consent_tokenstringwrite-only

The consent_token from the consent_required answer of the same call - only after the customer agreed to everything in its consent_list. Valid 15 minutes, once.

min length 1max length 255

Response in `data`; the rest of the body as on every call

namestringrequired

The domain, with international characters.

authcodestring | nullrequired

The auth code - a secret; null where it is withheld (secrets_withheld), or where the registry has none to give.

expires_atstring | nullrequired

Until when the code is valid; null: no end known.

Format date-time

auto_nackbooleanrequired

true: at this registry a transfer away is refused unless manitu lets it through.

secrets_withheldbooleanrequired

The code is left out here (an answer to an agent).

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.

MCPtools/call

Request

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "manitu_domain_transfer_out_authcode_get",
    "arguments": {
      "name": "example.com"
    }
  }
}

Result

{
  "structuredContent": {
    "name": "example.com",
    "authcode": "string",
    "expires_at": "2026-10-23T12:00:00+02:00",
    "auto_nack": true,
    "secrets_withheld": true
  },
  "content": [
    {
      "type": "text",
      "text": "… the same answer as text …"
    }
  ],
  "isError": false
}

POST/v1/domain/transfer/out/authcode/get

Request

curl -X POST 'https://api.manitu.de/v1/domain/transfer/out/authcode/get' \
  -H 'X-API-Key: $API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "example.com"
  }'

const response = await fetch('https://api.manitu.de/v1/domain/transfer/out/authcode/get', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.API_KEY,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "example.com"
  }),
});
const answer = await response.json();

<?php

$curl = curl_init('https://api.manitu.de/v1/domain/transfer/out/authcode/get');

curl_setopt_array($curl, [
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'X-API-Key: ' . getenv('API_KEY'),
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => '{"name":"example.com"}',
    CURLOPT_RETURNTRANSFER => true,
]);

$answer = json_decode(curl_exec($curl), true);

import os

import requests

response = requests.request(
    "POST",
    "https://api.manitu.de/v1/domain/transfer/out/authcode/get",
    headers={"X-API-Key": os.environ["API_KEY"]},
    json={
        "name": "example.com",
    },
)
answer = response.json()

Response 200

{
  "status": {
    "type": "success",
    "code": 200
  },
  "meta": {},
  "data": {
    "name": "example.com",
    "authcode": "string",
    "expires_at": "2026-10-23T12:00:00+02:00",
    "auto_nack": true,
    "secrets_withheld": true
  }
}

Get auth code to move a domain away

Annotations as tools/list sends them

Description for the model

Arguments

Result structuredContent, checked against the schema

Authentication

Request body JSON; unknown fields are refused

Response in data; the rest of the body as on every call

Statuses

Response in `data`; the rest of the body as on every call