I'm very happy with INWX, but their API is a bit lacking when it comes to limiting the potential blast radius.

It's either full access to everything or, thanks to their support for creating a special account on request, only full access to DNS management.

Been with INWX for >10y, never had an issue.

INWX is really great and they also support just about every TLD.