What API Token privileges are needed for DNS Cluster to work correctly?

Hello, We are creating a new DNS-Only nameserver for our DNS Cluster. The DNS Clustering documentation provided by Cpanel is not clear.... What are the necessary API Token privileges needed to allow our web servers to manage the DNS on the DNS Cluster ameserver? (I am hesitant to enable the "Everything" privilege, because I feel it's best security practice to limit access to only what is needed.) Is the "DNS Clustering" privilege sufficient? Or are the "Add DNS Zones" and "Remove DNS Zones" privileges also needed? Anything else? Thanks!