Add a delegated or purchased domain
POST /v1/domains
Add a domain the customer controls. ns_delegated is the default: the customer publishes the returned nameserver records and Extrovert serves the inbox domain’s mail zone. The legacy purchased intent creates a commerce request and cannot charge or register until human or pre-authorized policy approval; use /v1/commerce/requests/domain-purchases for its canonical response. ns_delegated needs domain:manage only. scope chooses the domain’s visibility (org shared by default, or project bound to the key’s project).
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”Request body for the agent-facing POST /v1/domains. ns_delegated adds a domain the customer controls without spending. The legacy purchased input is accepted only as a compatibility shim and is converted to the human-controlled commerce request flow; it never approves, charges, or registers inline.
object
Onboarding path. Defaults to ns_delegated. purchased is a deprecated compatibility input that creates a commerce request.
Domain visibility. Defaults to org (org-shared, usable by every project in the org). project binds the domain to the key’s OWN bound project (never client-selected) so it can create inboxes only in that project. A legacy/unscoped key (no bound project) falls back to org.
Optional assertion that must match the key’s bound project; NEVER a selector. A mismatch is 403. The binding is always derived from the key.
Responses
Section titled “ Responses ”Connected; returns the nameserver records for delegated setup.
The agent-facing view of one domain: its status plus the nameserver records the customer must publish for delegated setup. Records are empty on list reads and for hosted/purchased modes.
object
A DNS record the customer must add for domain onboarding.
object
Example
TXTA DNS record the customer must add for domain onboarding.
object
Example
TXTobject
Present when an agent initiated the request.
object
Legacy purchased intent recorded as a commerce request.
object
Present when an agent initiated the request.
object
Invalid request.
The canonical error envelope. error is a stable machine code.
object
Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).
Example
forbiddenHuman-readable detail (never leaks internals).
Example
missing required scopeMissing or invalid credential.
The canonical error envelope. error is a stable machine code.
object
Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).
Example
forbiddenHuman-readable detail (never leaks internals).
Example
missing required scopeAuthenticated but lacking the required scope, or out of quota.
The canonical error envelope. error is a stable machine code.
object
Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).
Example
forbiddenHuman-readable detail (never leaks internals).
Example
missing required scopeResource conflict (e.g. a duplicate entry).
The canonical error envelope. error is a stable machine code.
object
Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).
Example
forbiddenHuman-readable detail (never leaks internals).
Example
missing required scopeA required capability is not configured (e.g. buy-through-us).
The canonical error envelope. error is a stable machine code.
object
Stable error code (e.g. unauthorized, forbidden, not_found, invalid, quota_exceeded, rate_limited).
Example
forbiddenHuman-readable detail (never leaks internals).
Example
missing required scope