---
title: "Approve or deny a domain claim (owner key only)"
method: POST
path: "/v1/merchants/{id}/claims"
tags: ["Merchant Setup"]
---

# Approve or deny a domain claim (owner key only)

`POST /v1/merchants/{id}/claims`

## Request

- Base URL: `https://api.insumermodel.com`
- URL: `https://api.insumermodel.com/v1/merchants/{id}/claims`
- Auth: API key in header `X-API-Key`

Resolves one pending claim on this merchant's verified domain. Approving associates the claimant with the domain record; denying closes the claim. Each claim resolves once — a second attempt returns 409.

## Path parameters

- `id` string, required

## Request body

- object
  - `claimId` string, required
  - `action` 'approve' | 'deny', required

## Response `200`

Claim resolved

- object
  - `ok` boolean
  - `data` object
    - `claimId` string
    - `action` 'approved' | 'denied'

## Other responses

- `400`: Missing claimId or invalid action, or merchant has no verified domain
- `401`: Missing or invalid API key
- `403`: API key does not manage this merchant, not the owner of record, or claim belongs to another domain
- `404`: Claim or merchant not found
- `409`: Claim already resolved
- `429`: Rate limit exceeded. API-key requests count against the key's daily limit; every authenticated response carries X-RateLimit-Limit and X-RateLimit-Remaining headers, and a 429 additionally carries Retry-After (seconds until the window resets).
- `500`: Unexpected server error. Safe to retry; no credits are charged on a 500. Router endpoints return the standard error envelope; standalone endpoints (the ones whose 200 is a flat object) return a flat {"error": "..."} object.

---

[API](https://skmtc.dev/insumermodel/apis/insumerapi.md) · [All operations](https://skmtc.dev/insumermodel/apis/insumerapi/llms.txt) · [OpenAPI document](https://skmtc.dev/insumermodel/apis/insumerapi/revisions/91f56fe9e3d8?raw)