---
title: "Get a domain's Agent Authorization status"
method: GET
path: "/domains/{id}/agent-authorization"
tags: ["Domains"]
---

# Get a domain's Agent Authorization status

`GET /domains/{id}/agent-authorization`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/domains/{id}/agent-authorization`
- Auth: HTTP bearer

Whether the domain publishes an Agent Authorization (`_agents`) TXT record that lets agents on Primitive email it, read from DNS with the same engine the send path uses (an answer may be up to five minutes old): published (a record authorizes them), published_unauthorized (a record exists but does not), not_set_up (no record, the default) or inconclusive (the lookup could not tell; retry). The domain is one of the organization's, verified or pending; a credential confined to some mailboxes sees only the domains its scope covers. Needs domains:read.

## Path parameters

- `id` string, uuid, required

## Response `200`

Get a domain's Agent Authorization status

- object
  - `success` true, required
  - `data` GetDomainAgentAuthorizationResult, required
    - `domain_id` string, uuid, required
    - `domain` string, required
    - `state` 'published' | 'published_unauthorized' | 'not_set_up' | 'inconclusive', required
    - `records` string[], required

## Other responses

- `400`: validation_error: the id is not a domain id.
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)