---
title: "Call domain.connect"
method: POST
path: "/api/v1/tools/domain.connect"
tags: ["domain"]
---

# Call domain.connect

`POST /api/v1/tools/domain.connect`

## Request

- Base URL: `https://app.goosybear.ai`
- URL: `https://app.goosybear.ai/api/v1/tools/domain.connect`
- Auth: HTTP bearer

Point a domain the member already owns at one of their sites — 'I want to use mydomain.com for this', 'connect the domain I bought', 'hook my own address up to this page'. Connect a domain the customer already owns to one of their pages. It reserves the name and starts the certificate, then hands back the DNS records they must add at whoever manages that domain's DNS. ALWAYS relay those records and the copy_card — the connection does not finish until the customer adds them. Never say the domain is live: use domain.records or page.domain_status to check. Not for moving a connected domain from one site to another — that is `domain.point_at_site`.

Every result names the workspace it ran in. Say which workspace the answer is about. When the account has more than one workspace and none is selected, this tool refuses with `workspace_ambiguous` and lists the choices — offer them, never pick one.

## Headers

- `x-request-id` string

## Request body

- object
  - `hostname` string, required: The domain the customer already owns, e.g. example.com or offers.example.com. Pass what they said — a pasted URL, a trailing dot or mixed case are all normalized. A name under the platform's own address is refused.
  - `site_id` string, uuid, required: The SITE the member means, as a site UUID. You are NOT shown the id of the site open on screen — it never appears in your context, so there is nothing to copy. When they say 'this site', 'the site I'm looking at', or name no site at all, they mean that on-screen site, and the way to reach it is: where this schema leaves site_id OPTIONAL, OMIT IT ENTIRELY — that is the primary path, not a fallback, and the turn's own surface resolves it server-side. Where the schema REQUIRES it, call page.list with `name` set to the site they named — it returns that one site's id, or the candidates to ask them about. Never pass a board, board-item, thread or any other id that merely happens to be nearby in the conversation — those name different objects and will be refused — and never one you composed.
  - `workspace` string: Which workspace to run in — its slug. Omit to use your default. With more than one reachable workspace and no default, the call is refused and the choices are listed.

## Response `200`

The call was admitted and dispatched. `ok` says whether the tool succeeded — a refusal the tool itself produced is still a 200, exactly as it is a successful JSON-RPC result over MCP.

- union
  - object: The tool ran and answered.
    - `ok` true, required
    - `domain_id` string, uuid, required
    - `hostname` string, required
    - `activation_status` string, nullable, required
    - `dcv_status` string, nullable, required
    - `overall` string, required
    - `records` object[], required
      - `type` string, required
      - `name` string, required
      - `value` string, required
      - `priority` number, nullable, required
      - `ttl` number, nullable, required
      - `source` string, required
      - `placed_by_us` boolean, required
    - `copy_card` string[], required
    - `workspace` string, required: The slug of the workspace this call ran in.
    - `working_in` object, required: Which workspace this call ran in, and how that was decided. Present on every workspace-scoped result.
      - `label` string, required: The chip words — e.g. "working in: Acme Main".
      - `note` string, required: Why this workspace — e.g. "your default", "this call only".
      - `workspace` string, required: The resolved workspace's slug.
      - `source` 'call-override' | 'key-pin' | 'stored-default' | 'sole-reachable', required: Which rung of the R7 precedence resolved the workspace.
  - ToolRefusal: A call that was admitted and dispatched, and did not succeed.
    - `ok` false, required
    - `code` string, required: The typed reason — e.g. `workspace_ambiguous`, `invalid_arguments`, or the tool's own failure code.
    - `message` string, required: A sentence a person can act on.
    - `workspaces` string[]: On a workspace refusal: the slugs this key may pass as `workspace`.
    - `issues` object[]: On `invalid_arguments`: which fields failed, and why.
      - `path` string, required
      - `message` string, required
    - `path` string: On an authoring refusal: where in your call's input it points, e.g. `steps.<key>.params.<field>`.
    - `fix` string: On an authoring refusal: the change to your call that would pass.
    - `instruction` string: On an authoring refusal: what to do next with it.

## Other responses

- `400`: The request could not be used: the body is present but not a JSON object (`tenant_api.malformed_body`); it is a top-level array carrying more messages than this endpoint accepts (`tenant_mcp.batch_too_large`); or the `Idempotency-Key` header is malformed (`tenant_api.idempotency_key_invalid`), disagrees with the body's `idempotency_key` (`tenant_api.idempotency_key_conflict`), or was sent to an action that cannot replay a retry (`tenant_api.idempotency_unsupported`). Nothing ran.
- `401`: No bearer credential, or one that did not resolve. Deliberately ONE undifferentiated answer for absent / unknown / revoked / expired, so the endpoint is never an oracle over the key space.
- `403`: The credential is good but the surface is not open to it — the platform or account API switch is off, or the holder lacks the `api.access` capability. The `code` says which.
- `404`: No such tool. The body names no tool and is identical for every unrecognised name.
- `429`: Over this key's per-minute cap. Carries `Retry-After` and `error.retry_after_seconds`.

---

[API](https://skmtc.dev/goosybear/apis/goosy-bear-api.md) · [All operations](https://skmtc.dev/goosybear/apis/goosy-bear-api/llms.txt) · [OpenAPI document](https://skmtc.dev/goosybear/apis/goosy-bear-api/revisions/6d82fb124064?raw)