I'm very happy with INWX, but their API is a bit lacking when it comes to limiting the potential blast radius.

It's either full access to everything or, thanks to their support for creating a special account on request, only full access to DNS management.