# List custom domains

`GET /v1/custom-domains` · permission `custom-domains:read`

Lists the environment's custom login domains, oldest first. Only forward pagination (`after`) is supported; `before` and any `order` other than `asc` return `422`. Removed (`released`) domains are left out unless `include_released=true`; `status` returns only domains in that status (`released` included). An environment has at most 1 custom domain (20 on Enterprise).

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `limit` | integer | no | Page size, 1-100 (default 20). |
| `after` | string | no | Cursor from the previous page's `list_metadata.after`. |
| `status` | string | no | Only domains in this status: `pending_dns`, `issuing`, `active`, `degraded`, `disabled` or `released`. |
| `include_released` | boolean | no | When `true`, released domains are listed too. Ignored when `status` is given. |

No request body.

## Response

`200 OK` with a page of domains (the list items have no `caa` field).

```json
{
  "data": [
    {
      "id": "cdom_01j9xk3m7q8r2s4t6v8w0y2z4a",
      "hostname": "login.example.com",
      "is_primary": true,
      "status": "active",
      "failure_reason": null,
      "dns_records": [
        {
          "type": "TXT",
          "name": "_akp-verify.login.example.com",
          "value": "idp-verify=3q2-7wEXAMPLEtokenQ9"
        },
        {
          "type": "CNAME",
          "name": "login.example.com",
          "value": "acme.eu.edge.keenauth.app"
        }
      ],
      "certificate_expires_at": "2027-01-04T09:31:12Z",
      "last_checked_at": "2026-10-05T09:31:00Z",
      "next_check_at": null,
      "activated_at": "2026-10-05T09:31:12Z",
      "degraded_since": null,
      "status_changed_at": "2026-10-05T09:31:12Z",
      "created_at": "2026-10-05T09:30:00.123456Z",
      "updated_at": "2026-10-05T09:31:12Z"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 422 | `invalid_cursor` | The cursor is malformed or belongs to another filter. |
| 422 | `validation_failed` | A query parameter is invalid (`before`, `order=desc`, unknown `status`). |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry after the `Retry-After` period. |

## Example

```bash
curl "https://api.eu.keenauth.com/v1/custom-domains?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```