Turning on "ID Protection" does not call Gandi API

[julienmru]

This is critical as we need to comply with GDPR.

When a customer tries to turn on "ID Protection" on, with module logs turned on, no API call is issued to Gandi, thus leading the customer to believe ID protection ("private registration") is enabled but it's not. I also checked the domain status at Gandi and private registration is indeed disabled.

[grigouze]

Hello. Thanks for the report.

Can you give an example of a domain to see what's wrong ?

(You can send it via a support ticket if you don't want to give it here)

[julienmru]

You can try with any domain on your end (I tried a .com). No API call is logged in the module log of WHMCS.

I checked the module code and no code mentions data_obfuscated (except a function which unsets it from the API result) so that makes sense why the module does not do anything.

[grigouze]

As said in documentation, the "ID Protection" is on by default : https://api.gandi.net/docs/domains/#post-v5-domain-domains There is also more explaination here : https://docs.gandi.net/en/domain_names/common_operations/whois_privacy.html.

SO you don't have to enable it, but maybe you want to disable it ?

[julienmru]

You may check ticket 15030076. None of the domains transferred got "ID Protection" enabled.

You'll the API call I was able to get on my email from 1/04/2022 at 16:56 and data_obfuscated is not set. However, "ID Protection" was not enabled on the domain.

Same issue for all domains under my org.

[grigouze]

@julienmru I found the problem, the obfuscation is not by default for transfer, but the doc said the opposite.

Thanks for the report, we will change it by default to true.

[julienmru]

@grigouze Thanks, but will you allow "ID Protection" to be managed through WHMCS?

Is the fix you'll release done on the API or on the WHMCS module?

[grigouze]

@julienmru The fix will be on the API side.

The problem for WHMCS is that the ID protection is on contact and not on Domain, so it's not really easy to swicth to it.

But you can switch older domain already transferred on our website.

[julienmru]

@grigouze Ok got it, thanks!

However, I'm not sure ID protection is per contact though

• the checkbox is only in the domain
• I enabled it on domain tf**22.com and it's not enabled on domain reu***age.com albeit it's the same owner on both.

[julienmru]

@grigouze Was my feedback understandable? Thanks :)