While creating an application token for OVH API use, there are security options an user might and should leverage.

One of the options is the rights that can be configured.

I would advise for documenting the following rights as being the minimal scope needed by cloudron to perform its dutties:

GET /domain/zone/{zone Name}/record
POST /domain/zone/{zone Name}/record
PUT /domain/zone/{zone Name}/record/*
DELETE /domain/zone/{zone Name}/record/*
GET /domain/zone/{zone Name}/record/*
POST /domain/zone/{zone Name}/refresh

Rights, above, are extracted from the OVH API client of cloudron (as is on master branch at time I wrote this post) and translated to the expected format in the OVH createToken page.