CLI

The account and token making the request. Handy for checking a token works. Needs a token.

lemon whoami

The workspaces you belong to, with your role and access in each. Needs a token.

lemon workspaces list

List domains, with filters and paging. Needs a token.

--project-id <id>Project, by name or id.

--registrar-account-id <id>Registrar account, by name or id.

--status <Active|Expired|Transferred|Unknown>Older filter, worked out from the expiry date: Active (today or later), Expired (past), Unknown (no date). "Transferred" returns archived domains. Prefer --display-status.

--display-status <Active|Expiring soon|Expired|Unknown|Not at registrar|Archived>Status as the app shows it. "Archived" returns archived domains; other values leave them out.

--archived <exclude|include|only>Archived domains: "exclude" (default) leaves them out, "include" adds them, "only" returns just them.

--search <text>Case-insensitive substring match against the domain name. % and _ match literally.

--expiring-within-days <n>Only return domains expiring within this many days. Already-expired domains are excluded unless --include-expired is true.

--include-expiredWhen --expiring-within-days is set, also include domains whose expiry date is already in the past.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

--timezone <text>IANA time zone used to decide what 'today' is, e.g. Australia/Sydney. Defaults to your account time zone, else UTC.

--fields <summary|full>summary (default) returns lean rows; full adds notes, ids, dateLastChecked, and timestamps.

--limit <n>Max rows to return (default 25, max 500).

--offset <n>Rows to skip, for pagination.

lemon domains list --expiring-within-days 30

Add a domain to a project under a registrar account. Needs a read and write token.

--project-id <id>requiredProject, by name or id.

--registrar-account-id <id>requiredRegistrar account, by name or id.

--status <Active|Expired|Transferred|Unknown>Optional; worked out from --expiry-date when left out. "Transferred" archives the domain.

--auto-renewWhether the domain renews automatically.

--expiry-date <YYYY-MM-DD>Expiry date, YYYY-MM-DD. none clears it.

--notes <text>Free-text notes, max 2000 characters.

--archivedtrue archives the domain (no longer tracked, e.g. transferred to another company); false unarchives it.

--archived-note <text>Why the domain was archived, max 500 characters. Kept only while archived.

lemon domains add example.com --project-id <id> --registrar-account-id <id>

Add up to 200 domains in one request. A bad entry never fails the batch. Needs a read and write token.

--domains <json|@file>requiredDomain names, such as example.com,example.org.

lemon domains bulk-add --domains @domains.json

Look domains up in the public registry: registrar, expiry, and whether each is already in your account. Needs a token.

lemon domains lookup example.com example.org

Add domains by registrar name. Projects and registrar accounts are found or created for you. Needs a read and write token.

--domains <json|@file>requiredDomain names, such as example.com,example.org.

--project-id <id>Defaults to your first project, created if you have none.

--workspace-id <id>Workspace id from lemon workspaces list. Defaults to the first workspace you own.

lemon domains quick-add --domains @domains.json

Domains that expire within a number of days, soonest first. Needs a token.

--within-days <n>How many days ahead to look.

--limit <n>Most rows to show.

--include-expiredAlso include domains whose expiry date is already in the past (overdue).

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

--timezone <text>IANA time zone used to decide what 'today' is, e.g. Australia/Sydney. Defaults to your account time zone, else UTC.

lemon domains expiring --within-days 60

Get one domain by id or by its exact name, e.g. /domains/example.com. Needs a token.

lemon domains get example.com

Update a domain. Only the fields you send change. Needs a read and write token.

--domain-name <text>The domain name, such as example.com.

--status <Active|Expired|Transferred|Unknown>Optional; follows --expiry-date when that changes. "Transferred" archives the domain.

--auto-renewWhether the domain renews automatically.

--expiry-date <YYYY-MM-DD>Expiry date, YYYY-MM-DD. none clears it.

--notes <text>Free-text notes, max 2000 characters. Empty string clears it.

--project-id <id>Project, by name or id.

--registrar-account-id <id>Registrar account, by name or id.

--archivedtrue archives the domain (no longer tracked, e.g. transferred to another company); false unarchives it.

--archived-note <text>Why the domain was archived, max 500 characters. Kept only while archived.

lemon domains update <id> --auto-renew --notes "Renew in March"

Delete a domain. Owners only; Editors archive instead. Needs a read and write token.

lemon domains delete <id>

List the projects you can see, with your role in each. Needs a token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon projects list

Create a project in a workspace. Needs a read and write token.

--description <text>Optional description, max 500 characters

--workspace-id <id>Workspace id from lemon workspaces list. Defaults to the first workspace you own.

lemon projects add "Client sites"

Rename a project or change its description. Needs a read and write token.

--name <text>Name.

--description <text>Optional description, max 500 characters

lemon projects update <id> --name "Side projects"

Delete a project and all its domains. Owner only. Asks before deleting; --confirm skips the question. Needs a read and write token.

--confirmDelete for real. Without it nothing is deleted and you see what would go.

lemon projects delete <id> --confirm

List your registrars with their account counts. Needs a token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon registrars list

Add a registrar, such as Namecheap or Porkbun. Needs a read and write token.

--url <text>Registrar website, e.g. namecheap.com

--workspace-id <id>Workspace id from lemon workspaces list. Defaults to the first workspace you own.

lemon registrars add Porkbun

Update a registrar's name or URL. Needs a read and write token.

--name <text>Name.

--url <text>Registrar website, e.g. namecheap.com

lemon registrars update <id> --url https://porkbun.com

Delete a registrar with its accounts and their domains. Asks before deleting; --confirm skips the question. Needs a read and write token.

--confirmDelete for real. Without it nothing is deleted and you see what would go.

lemon registrars delete <id> --confirm

List your registrar accounts, optionally for one registrar. Needs a token.

--registrar-id <id>Registrar, by name or id.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon accounts list

Add an account under one of your registrars. Needs a read and write token.

--registrar-id <id>requiredRegistrar, by name or id.

--display-name <text>requiredName for this account, as you'd like to see it.

--account-username <text>requiredYour username at the registrar.

--contact-email <text>Contact email for the account

--domain-list-url <text>URL of the registrar's domain-list page

lemon accounts add --registrar-id <id> --display-name Personal --account-username me

Update a registrar account. Needs a read and write token.

--display-name <text>Name for this account, as you'd like to see it.

--account-username <text>Your username at the registrar.

--contact-email <text>Contact email for the account. Pass "" or null to clear it.

--domain-list-url <text>URL of the registrar's domain-list page

--is-activeWhether the account is in use.

lemon accounts update <id> --display-name Work

Delete a registrar account and its domains. Asks before deleting; --confirm skips the question. Needs a read and write token.

--confirmDelete for real. Without it nothing is deleted and you see what would go.

lemon accounts delete <id> --confirm

Recent registrar sync results across your accounts. Needs a token.

--limit <n>Most rows to show.

--registrar-account-id <id>Registrar account, by name or id.

lemon sync logs --limit 5

Every monitored domain in a workspace, yours and watched, with its latest change. Needs a token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon monitor list

Start watching domains you don't own, up to 1,000 per workspace. Needs a read and write token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon monitor watch competitor.com dream-name.com

Stop watching a domain. Needs a read and write token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon monitor unwatch competitor.com

What changed on monitored domains, newest first, with filters for domain, kind and date. Needs a token.

--kind <registrar|transfer_lock|nameservers|expired|available|expiry|statuses|dnssec|email_provider|hosting|ssl|website|parked|blacklist>Only this kind of change.

--since <text>ISO date or time; only changes found after it.

--limit <n>Max changes to return (default 100, max 500).

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon monitor changes --since 2026-10-01

A domain's DNS records, read live from its DNS host, and its latest DNS changes. Needs a token.

lemon dns list example.com

Plan DNS record changes without making them. Returns a changeId valid for 10 minutes. Needs a read and write token.

--changes <json|@file>requiredDNS changes as JSON, inline or @file.json. Each is {"action":"create","type","name","content"}, {"action":"update","id",...} or {"action":"delete","id"}; ids come from lemon dns list --ids.

lemon dns plan example.com --changes '[{"action":"create","type":"TXT","name":"@","content":"hello"}]'

Make a planned DNS change at the domain's DNS host. Needs a read and write token.

lemon dns apply <changeId>

Put the records back the way they were before an applied change. Needs a read and write token.

lemon dns undo <changeId>

A domain's auto-renew, transfer lock and nameservers, read live from its registrar, and its latest settings changes. Needs a token.

lemon settings show example.com

Plan a change to auto-renew, the transfer lock or nameservers without making it. Returns a changeId valid for 10 minutes. Needs a read and write token.

--auto-renewWhether the domain renews automatically.

--transfer-lock

--nameservers <a,b,...>

lemon settings plan example.com --auto-renew true

Make a planned settings change at the domain's registrar. Nameserver changes wait 24 hours first and come back as scheduled. Needs a read and write token.

lemon settings apply <changeId>

Put the settings back the way they were before an applied change. Needs a read and write token.

lemon settings undo <changeId>

Stop a nameserver or transfer lock change that is still waiting out its 24-hour safety delay. Needs a read and write token.

lemon settings stop <changeId>

The workspace's monthly spend limit, what's spent and left this month, the connections that can buy and recent purchases. Needs a token.

--workspace-id <id>Workspace, by name or id. Defaults to your default workspace.

lemon buy status

Quote a domain for 1 year without buying it. Returns a purchaseId valid for 10 minutes and the price in US dollars. Needs a read and write token.

--workspace-id <id>Workspace, by name or id. Defaults to your default workspace.

--connection-id <id>Which registrar connection buys it, from lemon buy status.

lemon buy plan example.com

Buy a quoted domain at the registrar, paid from your account there, within the spend limit. Can't be undone here. Needs a read and write token.

lemon buy confirm <purchaseId>

The webhooks of the workspaces you own, with events, filters and status. Needs a token.

--workspace-id <id>Workspace id from lemon workspaces list. Leave out to cover every workspace you can see.

lemon webhooks list

Add a webhook. Returns its signing secret once. Needs a read and write token.

--events <a,b,...>Event types to send. Default: domain.changed, domain.expiring, domain.expired, registrar.sync_failed.

--description <text>A note to tell webhooks apart, max 200 characters.

--change-kinds <a,b,...>domain.changed only: just these change kinds, e.g. registrar, nameservers, transfer_lock. Empty or null for every kind.

--ownership <all|own|watched>domain.changed only: "own" for portfolio domains, "watched" for watched ones, "all" (default) for both.

--expiry-days <a,b,...>domain.expiring only: days before expiry it fires, from 90, 60, 30, 14, 7, 3, 1. Default 30, 14, 7, 1.

--workspace-id <id>Workspace id from lemon workspaces list. Defaults to the first workspace you own.

lemon webhooks add https://example.com/hooks/lemon --events domain.changed,domain.expiring

Change a webhook's URL, events or filters, or pause and resume it. Needs a read and write token.

--url <text>An https URL, max 2000 characters.

--events <a,b,...>Event types to send; replaces the list.

--description <text>A note to tell webhooks apart, max 200 characters.

--change-kinds <a,b,...>domain.changed only: just these change kinds, e.g. registrar, nameservers, transfer_lock. Empty or null for every kind.

--ownership <all|own|watched>domain.changed only: "own" for portfolio domains, "watched" for watched ones, "all" (default) for both.

--expiry-days <a,b,...>domain.expiring only: days before expiry it fires, from 90, 60, 30, 14, 7, 3, 1. Default 30, 14, 7, 1.

--pausedtrue pauses the webhook; false resumes it.

lemon webhooks update <id> --paused

Delete a webhook and its delivery log. Needs a read and write token.

lemon webhooks remove <id>

Send a test event now and return the result. Needs a read and write token.

lemon webhooks test <id>

A new signing secret, returned once; the old one keeps signing for 24 hours. Needs a read and write token.

lemon webhooks rotate <id>

A webhook's deliveries from the last 30 days, newest first. Needs a token.

--status <pending|delivered|failed>Only deliveries with this status.

--limit <n>Max deliveries to return (default 50, max 200).

lemon webhooks deliveries <id> --status failed

Send one delivery again now, with the same event id. Needs a read and write token.

lemon webhooks resend <deliveryId>

Everything about one domain: registration, locks, status codes, DNS, website, certificate, email, history, transfer readiness and issues. Works without an account.

--freshtrue skips the 10-minute cache and looks everything up again.

lemon report example.com --md

Whether up to 50 names are free to register: full domains, or words combined with extensions: available, taken (with registrar and expiry), dropping soon or unknown. Works without an account.

--domains <a,b,...>Full domains to check, e.g. example.com.

--words <a,b,...>Names without an extension, combined with every entry in tlds.

--tlds <a,b,...>Extensions for words, without the dot. Default ["com"].

--prefixes <a,b,...>Also try each word with these in front, e.g. ["get", "try"].

--suffixes <a,b,...>Also try each word with these after it, e.g. ["hq", "app"].

--pluralAlso try the plural of each word (party -> parties).

--hacksAlso try domain hacks, where the end of the word becomes the extension (quillbase -> quillba.se).

lemon check lemonade getzestly --tlds com,io,ai

Whether a domain can move to another registrar today, and how. Works without an account.

lemon transfer example.com

Whether a DNS record has reached resolvers worldwide. and optionally &type=MX (default A). Works without an account.

--type <A|AAAA|CNAME|MX|NS|TXT|CAA|SOA>A, AAAA, CNAME, MX, NS, TXT, CAA or SOA

lemon propagation www.example.com --type CNAME

Registration data for up to 50 domains from the registries. Works without an account.

lemon whois example.com example.org

A name's public DNS records, explained. and optionally &type=MX. Works without an account.

--type <A|AAAA|CNAME|MX|TXT|NS|SOA|SRV|CAA|PTR|HTTPS|SVCB|DS|DNSKEY|CDS|CDNSKEY|TLSA|SSHFP|NAPTR|URI|LOC|HINFO|RP|DNAME|CERT|SMIMEA|OPENPGPKEY|NSEC|NSEC3PARAM|RRSIG>one record type, such as MX, TXT or SRV; A, AAAA, CNAME, MX, TXT, NS, SOA, CAA when left out

lemon dns lookup example.com --type MX

The HTTPS certificate a host serves. Works without an account.

lemon ssl example.com

MX, SPF, DMARC, DKIM, BIMI, MTA-STS and TLS-RPT checks for a domain, with a score. Works without an account.

lemon email example.com

A domain's Unicode and punycode (ASCII) forms. Works without an account.

lemon punycode münchen.de

Every redirect from a URL or domain, the final page's headers and a security header grade. or ?url=example.com. Works without an account.

lemon redirects example.com

Whether a domain, its mail servers and website, or an IPv4 address are on public email blocklists, with how to get removed. or ?query=203.0.113.10. Works without an account.

lemon blacklist example.com

Whether a website is down for everyone, from several locations. Works without an account.

lemon down example.com

Whether a domain's server is reachable on its common web and mail ports. and optionally &ports=443,587. Works without an account.

--ports <a,b,...>ports to check, any of 80, 443, 25, 465, 587, 993, 995, 21, 22, 53, 8080, 3306; all of them when left out

lemon ports mail.example.com --ports 25,587,993

Explain an email's raw headers: route with delays, SPF, DKIM and DMARC results and alignment, and signs of spoofing. Send {"headers": "..."}. Nothing is stored. Works without an account.

lemon email-headers message.eml

Who hosts a domain's website, DNS and email, or who holds an IP address. or ?domain=8.8.8.8. Works without an account.

lemon hosting example.com

About 30 checks of a domain's DNS setup (nameservers, delegation and glue, SOA, DNSSEC, website and email records), each a pass, warning, problem or note with a plain fix. Works without an account.

lemon dns health example.com

Lookalike domains of a domain and which are registered, with registrar, creation date, website and mail. Works without an account.

lemon lookalikes example.com

Decode a certificate, chain or CSR. Send {"pem": "..."} with the PEM text. Works without an account.

lemon decode-cert fullchain.pem

A domain's SPF record explained, with DNS lookups counted through every include and mistakes flagged. Works without an account.

lemon spf example.com --md

A domain's DMARC record explained: the policy for failing mail, where reports go, and what to change. Works without an account.

lemon dmarc example.com

A domain's DKIM keys, found on a selector or 30 common ones, with key size and mistakes flagged. and optionally &selector=google. Works without an account.

--selector <text>the s= value from a DKIM-Signature header, e.g. google or selector1, max 189 characters; leave out to try common selectors

lemon dkim example.com --selector google

Explain a DMARC aggregate report: who sends as the domain, how much passes SPF, DKIM and DMARC, and what to change. Send {"report": "..."}, the XML or a .zip or .gz report as base64. Nothing is stored. Works without an account.

lemon dmarc-report google.com!example.com!1792540800!1792627199.zip

robots.txt, sitemap, share preview tags, favicon and web app manifest checks for a site, each with a fix. Works without an account.

lemon site-files example.com

Network, broadcast, host range and masks for an IPv4 or IPv6 block. and optionally &split=26. Works without an account.

--split <text>a longer prefix length to split the block into, such as 26 for a /24 split into four /26 blocks; max 3 characters

lemon subnet 192.168.1.0/24 --split 26

Subdomains of a domain from certificate transparency logs, with whether each still resolves. Works without an account.

lemon subdomains example.com

Domain counts per extension from the daily zone files: total, registered and dropped today and over 30 days. or ?tld=all for every extension. Works without an account.

lemon stats org