---
title: "Check the DNS record for a claimed domain"
method: POST
path: "/organizations/{organizationID}/sso/domains/{domain}/verify"
tags: ["Organizations"]
---

# Check the DNS record for a claimed domain

`POST /organizations/{organizationID}/sso/domains/{domain}/verify`

## Request

- Base URL: `https://api.xata.tech`
- URL: `https://api.xata.tech/organizations/{organizationID}/sso/domains/{domain}/verify`
- Auth: OAuth 2
  - Implicit: `https://auth.xata.io/realms/xata/protocol/openid-connect/auth`
  - Scopes: `org:write`

Looks up the challenge TXT record. Verification is a poll, not a command: a missing or stale record is reported
as `verified: false` on a 200 rather than as an error, so a client can retry while DNS propagates. Verifying a
domain that lost its verification restores its provider, with enforcement off.

## Response `200`

Current state of the domain after checking DNS

- OrganizationSSODomain: An email domain claimed by an organization for SSO
  - `domain` string, required: The claimed email domain
  - `provider_alias` string, required: The alias an identity provider on this domain will be given. Derived from the organization and the domain, so it is known before the provider exists, which is what lets a client show the redirect URI to register with the provider up front.
  - `verified` boolean, required: Whether control of the domain has been proven through DNS
  - `verification` OrganizationSSODomainVerification: The DNS TXT record that proves an organization controls a domain
    - `record_name` string, required: Name to create the record at
    - `record_type` string, required: DNS record type
    - `record_value` string, required: Value the record must hold
  - `missing_since` string, date-time, nullable: When the daily recheck first found the record missing from a verified domain.
  - `revokes_at` string, date-time, nullable: When the domain stops being verified if the record is still missing.

## Other responses

- `401`: Error returned when authentication or authorization fails
- `403`: Single sign-on is not enabled for the organization, or the caller is not an Admin
- `404`: The organization has not claimed the domain
- `409`: Another organization verified the domain first
- `5XX`: Unexpected Error

## Changes

- **2026-09-29** `5d5197f76970`: 2 info
  - added the optional property `missing_since` to the response with the `200` status
  - added the optional property `revokes_at` to the response with the `200` status
- **2026-09-11** `dea04a8fcb58`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xata/apis/xata-api/changes/organizations/:organizationID/sso/domains/:domain/verify/post.md)

---

[API](https://skmtc.dev/xata/apis/xata-api.md) - [All operations](https://skmtc.dev/xata/apis/xata-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xata/apis/xata-api/revisions/3145f2078d68?raw)