There is an option to create tsigkey for: zone or pool. https://docs.openstack.org/api-ref/dns/?expanded=#create-tsigkeys There is a SCOPE for tsigkey which can be either ZONE or POOL In fact it’s possible to use Zone ID with SCOPE:POOL to create to create tsigkey or Pools ID with SCOPE:ZONE. There is no validation on SCOPE value as we would expect it to be.