Skip to content

Claim App Domain

POST
/apps/{app_id}/domains

Claim a hostname and return the TXT record proving you control it.

409 when another app already holds the host. Hostnames are globally unique, and a silent overwrite would let one builder take another’s traffic — which is why claim_domain raises rather than upserting.

Authorizations

Parameters

Path Parameters

app_id
required
string

Header Parameters

X-Org-Id
Any of:
string

Request Body required

object
hostname
required

The hostname to serve this app on. Normalized server-side: case, a trailing dot and unicode all resolve to one canonical form.

string
<= 253 characters

Responses

201

Successful Response

object
data
required

Everything the builder needs to prove control, and nothing else.

The token is returned ONLY here, at claim time. It is also stored, but there is deliberately no route that reads it back: a token readable on demand is a token an attacker with a stolen read-only key can harvest for every pending domain on the platform.

object
domain
required
object
app_id
required
string
created_at
Any of:
string format: date-time
domain_id
required
string
hostname
required

The canonical, normalized form — not necessarily what was submitted.

string
status
required
string
verified_at
Any of:
string format: date-time
record_name
required

Create the record at this name, e.g. _graph8-challenge.app.example.com

string
record_type
string
default: TXT
record_value
required
string
pagination
Any of:
object
has_next
required

Whether there are more pages

boolean
limit
required

Items per page

integer
next_cursor
Any of:
string
page
required

Current page number (1-indexed)

integer
total
required

Total number of items

integer

422

Validation Error

object
detail
Array<object>
object
loc
required
Array
msg
required
string
type
required
string