Domains

Remove domain

Remove a domain from the account (h-implement-proper-deletion, DOM-2). Runs the whole-domain cascade first — every proof of the domain and every delegation issued from it are revoked — then deletes the row and its saved provider credentials, drops the cached artifact claims, and cleans up outside the account best-effort: our _proof TXT record at the DNS provider (only with a saved credential, by exact name and value) and the Resend sending domain (unless another account still uses it). What stays and why is listed in external.leftovers; a cleanup failure never fails the removal. Requires a single-use domain_remove step-up grant bound to this id (403 2fa_required; reason: target_mismatch when the grant names other ids). A notice goes to the owner. Cannot be undone — to use the domain again, add it and verify it afresh. With an API key, use DELETE /verifications/domain/{id}, which refuses a verified domain.

delete/api/v1/me/domains/{id}

Request

Base URL: https://api.proof.holdings
URL: https://api.proof.holdings/api/v1/me/domains/{id}
Auth: API key in cookie auth_token

Path parameters

idstring required

MongoDB ObjectId

Example:507f1f77bcf86cd799439011

Response

Domain removed — what was revoked, what was cleaned up, what stays

successtrue required

domainstring required

proofs_revokedinteger required

Example response

{
  "domain": "example.com",
  "delegations_revoked": [
    {
      "proof_id": "ph_dlg_0123456789abcdef0123456789abcdef",
      "delegate": "pkg:npm/@acme/cli",
      "delegate_type": "purl",
      "principal": "example.com"
    }
  ],
  "carriers": [
    {
      "delegation": "pkg:npm/@acme/cli"
    }
  ],
  "notice": [
    {
      "kind": "email",
      "address": "o***@example.com",
      "outcome": "sent"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.