---
title: "Publish or unpublish merchant in public directory"
method: POST
path: "/v1/merchants/{id}/directory"
tags: ["Merchant Setup"]
---

# Publish or unpublish merchant in public directory

`POST /v1/merchants/{id}/directory`

## Request

- Base URL: `https://api.insumermodel.com`
- URL: `https://api.insumermodel.com/v1/merchants/{id}/directory`
- Auth: API key in header `X-API-Key`

Publish (or refresh) the merchant's listing in the public directory. No request body needed to publish — call again after updating tokens/settings. Send `{ "listed": false }` to unpublish (delist); the company and its tokens stay intact, only the public entry is removed. Partner-provisioned merchants (created with an externalId) must pass domain verification before they can publish — an unverified one is rejected with 403.

## Path parameters

- `id` string, required

## Request body

- object
  - `listed` boolean: Set to false to unpublish (delist) the merchant. Omit to publish/refresh.
  - `ownerCredential` object: Optional owner credential to record in the domain-ownership ledger when publishing a merchant with a verified domain (defaults to the managing API key). Lets a partner name the end customer's own credential as the domain owner of record.
    - `type` 'license' | 'key' | 'wallet' | 'uid'
    - `id` string

## Response `200`

Published, or unpublished when listed=false

- object
  - `ok` true
  - `data` object
    - `id` string
    - `published` boolean
    - `tokensListed` integer
    - `nftCollectionsListed` integer
  - `meta` Meta
    - `version` string
    - `timestamp` string, date-time

## Other responses

- `401`: Invalid or missing API key
- `403`: API key does not own this merchant, or a partner-provisioned merchant (externalId set) has not passed domain verification yet.
- `404`: Merchant not found
- `409`: The merchant's verified domain is already registered to another owner in the domain-ownership ledger. A claim has been opened; the current owner must approve it before this listing can publish.
- `429`: Rate limit exceeded. API-key requests count against the key's daily limit; every authenticated response carries X-RateLimit-Limit and X-RateLimit-Remaining headers, and a 429 additionally carries Retry-After (seconds until the window resets).
- `500`: Unexpected server error. Safe to retry; no credits are charged on a 500. Router endpoints return the standard error envelope; standalone endpoints (the ones whose 200 is a flat object) return a flat {"error": "..."} object.

---

[API](https://skmtc.dev/insumermodel/apis/insumerapi.md) · [All operations](https://skmtc.dev/insumermodel/apis/insumerapi/llms.txt) · [OpenAPI document](https://skmtc.dev/insumermodel/apis/insumerapi/revisions/91f56fe9e3d8?raw)