Core API Reference

Account Domains — Core API

Custom domain management for an account: add, verify, and remove domains used for white-labeled portals and issuers.

Base URL: https://api.authpi.com — see the Core API overview for authentication, pagination, and idempotency, or try these endpoints in the interactive reference.

GET/v1/accounts/{account_id}/domains

List Account Domains

List all custom domains for an account, including their verification and assignment status.

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account

Responses

CodeDescriptionSchema
200Domains retrieved successfullyobject
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError

POST/v1/accounts/{account_id}/domains

Add Account Domain

Add a custom domain to the account.

The domain is added in an unverified state. Verification will happen via Cloudflare Custom Hostnames when the domain is assigned to an issuer (Phase 2).

Limits: Maximum 20 domains per account.

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account

Request body

Content type: application/json

PropertyTypeRequiredDescription
hoststringRequiredDomain name (e.g., 'auth.example.com')

Responses

CodeDescriptionSchema
201Domain added successfullyobject
400Bad Request - The request is malformed or contains invalid data.ApiError
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError
409Conflict - The request conflicts with the current state of the resource.ApiError

DELETE/v1/accounts/{account_id}/domains/{domain}

Remove Account Domain

Remove a custom domain from the account.

If the domain is assigned to an issuer, the assignment and global routing index are cleaned up automatically.

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account
domainstringRequiredDomain name (e.g., 'auth.example.com')

Responses

CodeDescriptionSchema
204No Content - The operation completed successfully with no response body.
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError

POST/v1/accounts/{account_id}/domains/{domain}/verify

Verify Account Domain

Mark a domain as verified.

In Phase 2, this will be called automatically when Cloudflare confirms the Custom Hostname is active. For now, it can be called manually (e.g., by an admin) after verifying ownership.

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account
domainstringRequiredDomain name (e.g., 'auth.example.com')

Responses

CodeDescriptionSchema
200Domain verified successfullyobject
400Bad Request - The request is malformed or contains invalid data.ApiError
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError

POST/v1/accounts/{account_id}/domains/{domain}/assign

Assign Domain to Issuer

Assign a verified domain to an issuer owned by this account.

Once assigned, the IDP portal will route traffic for this domain to the specified issuer. A global KV index is written for fast domain-to-issuer lookups at the edge.

Requirements:

  • Domain must be verified
  • Issuer must belong to the same account
  • A domain can only be assigned to one issuer at a time (reassignment is allowed)

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account
domainstringRequiredDomain name (e.g., 'auth.example.com')

Request body

Content type: application/json

PropertyTypeRequiredDescription
issuer_idstringRequiredThe issuer ID to assign this domain to

Responses

CodeDescriptionSchema
200Domain assigned to issuer successfullyobject
400Bad Request - The request is malformed or contains invalid data.ApiError
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError

POST/v1/accounts/{account_id}/domains/{domain}/unassign

Unassign Domain from Issuer

Remove the issuer assignment from a domain.

The domain remains on the account but is no longer routed to any issuer. The global KV index entry is removed.

Path parameters

NameTypeRequiredDescription
account_idstringRequiredThe unique identifier of the account
domainstringRequiredDomain name (e.g., 'auth.example.com')

Responses

CodeDescriptionSchema
200Domain unassigned successfullyobject
400Bad Request - The request is malformed or contains invalid data.ApiError
401Unauthorized - Authentication is required or has failed.ApiError
403Forbidden - You don't have permission to perform this action.ApiError
404Not Found - The requested resource does not exist.ApiError