---
title: "Enable/disable new purchases for a channel/domain (audited)"
method: POST
path: "/api/v2/admin/purchase-flags"
tags: ["v2 Admin"]
---

# Enable/disable new purchases for a channel/domain (audited)

`POST /api/v2/admin/purchase-flags`

## Request

- Base URL: `https://pdf2md.dev`
- URL: `https://pdf2md.dev/api/v2/admin/purchase-flags`
- Auth: HTTP bearer

EP-023-T23 (+ EP-024 per-domain web). Server-authoritative runtime switch, without a restart; written through this endpoint, so the change is audited ([AUDIT] purchase_flag_changed). Does not block existing subscribers. For channel=web, `domain` is required and must be an allow-listed public host (each site domain has its own switch). CLI: deploy/v2-tools/purchase-flags.sh.

## Request body

- object
  - `channel` 'extension' | 'web', required
  - `domain` string: Required for channel=web: which public host (e.g. pdf2md.dev). Ignored for extension.
  - `enabled` boolean, required

## Response `200`

New flags

- V2AdminPurchaseFlags: EP-024 admin view of purchase flags: the extension flag plus the per-domain web flags.
  - `extension` boolean, required: Whether new extension purchases are enabled
  - `web` object, required: Per-domain web purchase flags keyed by public host, e.g. {"pdf2md.dev": true, "pdf2md.huskyhaul.online": false}

## Other responses

- `400` (unresolved $ref)
- `401`: Missing/invalid API key or session
- `404`: Surface disabled (ADMIN_SECRET not set)

---

[API](https://skmtc.dev/pdf2md/apis/pdf-to-markdown-api-facade.md) · [All operations](https://skmtc.dev/pdf2md/apis/pdf-to-markdown-api-facade/llms.txt) · [OpenAPI document](https://skmtc.dev/pdf2md/apis/pdf-to-markdown-api-facade/revisions/4636782fb8b6?raw)