---
title: "White-label partner asserts domain ownership"
method: PUT
path: "/v1/merchants/{id}/verification"
tags: ["Merchant Setup"]
---

# White-label partner asserts domain ownership

`PUT /v1/merchants/{id}/verification`

## Request

- Base URL: `https://api.insumermodel.com`
- URL: `https://api.insumermodel.com/v1/merchants/{id}/verification`
- Auth: API key in header `X-API-Key`

Record that a managing white-label partner verified an organization's domain in its own branded flow, so the org can publish to the directory without ever seeing an Insumer-branded challenge. Sets verification.status=verified with method=partner. RESTRICTED to designated white-label partner keys — a normal self-serve key cannot assert verification this way and must use the domain-verification challenge flow (POST/PUT /v1/merchants/{id}/domain-verification).

## Path parameters

- `id` string, required

## Request body

- object
  - `domain` string, required: Domain the partner verified (no protocol prefix).
  - `ownerCredential` object: Optional end-customer credential to record as the domain owner of record in the ownership ledger (defaults to the partner key). Lets the partner distinguish the community that actually owns the domain from the shared pool key.
    - `type` 'license' | 'key' | 'wallet' | 'uid'
    - `id` string
  - `notify` string: Optional notification contact recorded with the domain binding, used for ownership-claim notices.

## Response `200`

Domain marked verified

- object
  - `ok` true
  - `data` object
    - `verified` true
    - `domain` string
    - `method` 'partner'
  - `meta` Meta
    - `version` string
    - `timestamp` string, date-time

## Other responses

- `400`: A valid domain is required
- `401`: Invalid or missing API key
- `403`: Key is not a white-label partner key, or does not manage this merchant
- `404`: Merchant not found
- `429`: Rate limit exceeded. API-key requests count against the key's daily limit; every authenticated response carries X-RateLimit-Limit and X-RateLimit-Remaining headers, and a 429 additionally carries Retry-After (seconds until the window resets).
- `500`: Unexpected server error. Safe to retry; no credits are charged on a 500. Router endpoints return the standard error envelope; standalone endpoints (the ones whose 200 is a flat object) return a flat {"error": "..."} object.

---

[API](https://skmtc.dev/insumermodel/apis/insumerapi.md) · [All operations](https://skmtc.dev/insumermodel/apis/insumerapi/llms.txt) · [OpenAPI document](https://skmtc.dev/insumermodel/apis/insumerapi/revisions/91f56fe9e3d8?raw)