Everything the portal's Setup Wizard knows about ONE protected domain, in one call: the registry row (Domain), the observed posture (Posture), the health grade (Health), the six record cards (Records), the enforcement gate (Gate), the recommendations split open / dismissed (Recommendations), the setup steps with the records to publish (SetupSteps, and ActiveStep - the key of the first step that needs work), the 30-day aggregate window with its ten leading sources (Aggregates), and the domain's live MX hosts (MxHosts).

NEVER WRITES. Nothing on this path stamps an observed attribute - our observer, the report parser and the notifier are the only writers - and the portal's habit of forgetting a dismissal whose condition has since resolved is not replicated here (the portal heals the row on its next page load), so such a dismissal can still appear under Recommendations.Dismissed until then. The registry read is strongly consistent, so a call straight after add-protected-domain sees the new row.

Posture status is five-state: Valid, Invalid, Not Found, Not Checked Yet and DNS Only (MTA-STS pointer present, policy file not confirmed). "Not checked yet" is never collapsed into "not found"; each record carries its own checked-at stamp. Pass rates in Gate and Aggregates are on the verified-reporter basis: unverified reporters count towards volume, never towards the headline rate. Gate is read-only; nothing in the API advances a policy.

Aggregates are ALWAYS read - there is no include or opt-out - because the health grade is derived from the recommendation list and the recommendations need the aggregate window, so a partial read would emit a false grade. Health is rated over the FULL generated list, dismissed cards included: dismissing a card hides it, it does not improve the grade. The window is the fixed 30-day window from the tenant's data region; get-volume-series is the endpoint with a range.

MxHosts are the domain's MX records, resolved best-effort on public resolvers (8.8.8.8 then 1.1.1.1, ~3 s) so the MTA-STS step's suggestedPolicyFile carries real mx: lines. When the list is empty that file holds the mail.example.com placeholder and the step's notes say so. The lookup is against the REGISTRY domain, never the posted string.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Admin-only read; no other paid entitlement required.