---
title: "Verify domain connections"
method: POST
path: "/api/v1/experience/connections/verify-domain"
tags: ["experience"]
---

# Verify domain connections

`POST /api/v1/experience/connections/verify-domain`

## Request

- Base URL: `https://point11.ai`
- URL: `https://point11.ai/api/v1/experience/connections/verify-domain`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.point11.ai/oauth2/authorize`, token URL `https://auth.point11.ai/oauth2/token`)

Check that your organization controls every host a connected website approves, and record the answer on the connection. A host is proven by a domain your organization verified for single sign-on (it or a parent of it), or by the TXT record the connection's domainVerification.record names, published at the host or a parent domain. Until every host is proven, journeys treat the website as one you do not own: robots.txt and the full site fence, no test actions, no sign-in, no iPhone Safari. A record that is not there yet answers verified false with the hosts left; a DNS or single sign-on lookup that does not answer is retryable and records nothing. Pass the revision you read; verifying does not change it.

## Headers

- `Point11-Organization` string, uuid
- `Idempotency-Key` string, uuid, required

## Request body

- ExperienceConnectionsVerifyDomainRequest
  - `id` string, uuid, required
  - `expectedRevision` integer, required

## Response `200`

Success.

- ExperienceConnectionsVerifyDomainResponse
  - `connection` ExperienceConnectionsRevokeResponse, required
    - `id` string, uuid, required
    - `businessProfileId` string, uuid, required
    - `name` string, required
    - `environment` 'test' | 'production', required
    - `websiteUrl` string, nullable, required
    - `approvedOrigins` string[], required
    - `deniedPaths` string[], required: Paths on the approved origins your journeys never request, each with everything below it, by any method: a request to one is refused and recorded on the step.
    - `actionPolicy` 'observe' | 'test_actions', required
    - `webAuthentication` union, required
      - object
        - `method` 'browser_session', required
        - `signedInUrl` string, uri, required
        - `signedInSelector` string, required
      - object
        - `method` 'password_form', required
        - `signedInUrl` string, uri, required
        - `signedInSelector` string, required
        - `loginUrl` string, uri, required
        - `usernameSelector` string, required
        - `passwordSelector` string, required
        - `submitSelector` string, required
        - `totpSelector` string
        - `totpSubmitSelector` string
    - `nativeAuthentication` ExperienceNativeAuthentication, nullable, required
      - `ios` ExperienceIos
        - `usernameSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `passwordSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `submitSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `signedInSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `totpSelector` object
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `totpSubmitSelector` object
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
      - `android` ExperienceIos
        - `usernameSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `passwordSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `submitSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `signedInSelector` object, required
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `totpSelector` object
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
        - `totpSubmitSelector` object
          - `using` 'id' | 'accessibility id', required
          - `value` string, required
    - `revision` integer, required
    - `status` 'active' | 'revoked', required
    - `domainVerification` ExperienceDomainVerification, required
      - `verified` boolean, required: Whether your organization has proved it controls every host in hosts at this revision. Until it has, journeys treat the website as one you do not own: they honour its robots.txt behind the full site fence, take no test actions, never sign in, and do not run iPhone Safari.
      - `verifiedAt` string, date-time, nullable, required
      - `hosts` string[], required: The hosts of the approved origins the proof covers.
      - `record` object, required: The DNS record that proves a host: a TXT record named label, a dot and the host (or a parent domain of it, which covers every host under it), holding value. A domain your organization verified for single sign-on proves every host under it without one. Then call experience_connections_verify_domain_v1.
        - `type` 'TXT', required
        - `label` string, required
        - `value` string, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `revokedAt` string, date-time, nullable, required
  - `verified` boolean, required
  - `proofs` object[], required
    - `host` string, required
    - `method` 'workos_domain' | 'dns_txt' | 'point11_preview', required
    - `domain` string, required
  - `unproven` string[], required: The hosts no proof covers yet; empty once verified.

## Other responses

- `400`: The input, query, or Idempotency-Key is invalid.
- `401`: The bearer is missing, expired, or not accepted.
- `402`: Billing refused the write: the code names the reason and `details.reason` carries it.
- `403`: The credential lacks the operation's scope or role, or the operation needs a different door.
- `404`: The resource or organization does not exist for this caller.
- `405`: This path takes another HTTP method, named in `Allow`.
- `409`: The request conflicts with current state or with prior use of its Idempotency-Key.
- `413`: The request, or the answer it asks for, is too large; narrow it.
- `429`: The credential's rate budget is spent; retry after `Retry-After` seconds.
- `500`: An unexpected server failure; retry later. Only `request_id` identifies it.
- `503`: A dependency is temporarily unavailable; retry after `Retry-After` seconds.
- `default`: Another status a product answers for its own refusal (for example `415` for an unsupported attachment); branch on `code`.

---

[API](https://skmtc.dev/point11/apis/point11-api.md) · [All operations](https://skmtc.dev/point11/apis/point11-api/llms.txt) · [OpenAPI document](https://skmtc.dev/point11/apis/point11-api/revisions/36a84c7aca11?raw)