ACME DNS-01 API for automated certificate issuance

As a partner/tenant
I want to obtain and renew ACME certificates via DNS-01 using an API-driven challenge against my DNS zones
So that I can automate TLS certificate lifecycle for my services, without manually updating DNS records

• Given a valid API token scoped to a zone I own, when my ACME client requests a challenge, then the AC API creates the _acme-challenge TXT record in the correct zone.

• Given a completed validation, when my client calls cleanup, then the AC API removes the corresponding TXT record.

• The API enforces authorization so a token can only modify TXT records in zones belonging to that tenant.

• The API supports multiple concurrent _acme-challenge TXT values on the same name (required for SAN/wildcard certs).

• The API exposes an endpoint contract compatible with a common client (eg certbot/acme.sh hooks)

• Actions are rate-limited and audit-logged per token.

• Documentation provides a working example (client config + hook script) for at least one supported client.

Out of scope: HTTP-01/TLS-ALPN-01 challenges; certificate storage or deployment on customer hosts.