---
title: "Get EPP auth code"
method: GET
path: "/api/domains/{domain}/auth-code"
tags: ["Domains"]
---

# Get EPP auth code

`GET /api/domains/{domain}/auth-code`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/domains/{domain}/auth-code`
- Auth: HTTP bearer

Get the EPP/auth code needed to transfer a domain to another registrar. Automatically unlocks the domain if it's locked. Whoever holds the auth code can move the domain, and its mail with it: reading it needs the `email:auth_secrets` scope and a token not confined to mailboxes (403 INSUFFICIENT_SCOPE or 403 MAILBOX_CONFINED otherwise), and every read is recorded in the audit log. Some registrars have no API for the code: the first call then answers 202 with `status: "requested"` while Domani's team unlocks the domain and gets the code by hand (within 1 business day, `expected_by`); the user gets an email when it is ready, and a later call answers 200 with `status: "ready"` and the code. Within 60 days of a registration or transfer-in such a domain answers 409 TRANSFER_LOCKED with `available_at`.

## Path parameters

- `domain` string, required

## Response `200`

Auth code retrieved

- AuthCodeResult: A domain's transfer (EPP) code, or the request Domani's team is working on when the registrar has no API for it
  - `domain` string, required
  - `status` 'ready' | 'requested', required: `ready`: the code is in auth_code. `requested`: Domani's team is getting it from the registrar; the user gets an email when it is ready.
  - `auth_code` string, nullable, required: EPP auth code to give to the new registrar. null while requested.
  - `was_unlocked` boolean, required: Whether the domain was unlocked to allow the transfer
  - `requested_at` string, date-time: When the code was asked for (registrars without an API for it)
  - `expected_by` string, date-time: When Domani's team will have the code at the latest (status requested)
  - `hint` string, required
  - `next_steps` string[], required

## Other responses

- `202`: The registrar has no API for the code: Domani's team is getting it. Call again once the user got the email saying it is ready.
- `401`: Missing or invalid API key
- `403`: Reading the auth code needs the email:auth_secrets scope (INSUFFICIENT_SCOPE) and a token not confined to mailboxes (MAILBOX_CONFINED)
- `404`: Domain not found
- `409`: TRANSFER_LOCKED: the domain was registered or transferred in less than 60 days ago (`available_at` says when it can leave), or CAPABILITY_UNAVAILABLE: transfer codes are not available for this domain
- `429`: Rate limit exceeded - wait and retry

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)