---
title: "Verify the session's records against live DNS"
method: POST
path: "/api/v1/sessions/{token}/verify"
tags: ["Sessions"]
---

# Verify the session's records against live DNS

`POST /api/v1/sessions/{token}/verify`

## Request

- Base URL: `https://app.dodomain.io`
- URL: `https://app.dodomain.io/api/v1/sessions/{token}/verify`
- Auth: none required

Checks every expected record against authoritative nameservers. When all are present the session is marked verified, the connection is recorded, usage is metered and webhooks fire — all in one transaction, and only on an actual authoritative match. `records[].outcome` distinguishes a genuine absence (`absent`), a still-propagating record (`propagating`), a check that could not be completed (`indeterminate`) and a domain that does not resolve at all (`domain_not_found`).

## Path parameters

- `token` string, required

## Response `200`

Success.

- VerifySessionResponse
  - `advisories` object[], required
    - `code` 'caa_excludes_issuer' | 'caa_restricts_issuance' | 'stale_acme_challenge' | 'tls_issuance_unchecked', required
    - `evidence` string[], required
    - `evidenceFqdn` string, required
    - `fqdn` string, required
    - `note` string, required
    - `severity` 'warning' | 'info', required
  - `records` object[], required
    - `authoritativeError` string
    - `authoritativeFound` string[], required
    - `fqdn` string, required
    - `note` string, required
    - `outcome` 'verified' | 'propagating' | 'absent' | 'indeterminate' | 'domain_not_found', required
    - `present` boolean, required
    - `publicFound` string[], required
    - `type` string, required
  - `verified` boolean, required

## Other responses

- `400`: `400 invalid_request` — The request body or query failed schema validation, or a documented capability rule rejected it. `details` carries the field-level report when the failure came from schema validation.
- `404`: `404 not_found` — The addressed resource does not exist, or the caller does not own it — the two collapse to one status on purpose, so an id cannot be enumerated by a caller who does not own it.
- `410`: `410 expired` — The connect session's 24-hour lifetime has elapsed. Returned before any verification, metering, or webhook work happens.
- `429`: `429 rate_limited` — Rate limited. `Retry-After` (seconds) is set and `details.retryAfterSeconds` repeats it. Branch on `details.reason`: `request_rate` means the caller is calling too fast (`details.limit` carries the cap), `recently_checked` means this one connection was DNS-checked inside its cooldown.
- `500`: `500 internal` — An unhandled server-side failure. Reported to our error tracker; safe to retry.

---

[API](https://skmtc.dev/dodomain/apis/dodomain-api.md) · [All operations](https://skmtc.dev/dodomain/apis/dodomain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dodomain/apis/dodomain-api/revisions/44cfb944de58?raw)