Check an organization domain now
POST /v1/organization-domains/{domain_id}:verify · permission organization-domains:write
Runs the verification immediately. A pending or unverified domain is checked in DNS: if the TXT record is found it becomes verified; otherwise it keeps its status, last_failure_code is set and the response is still 200. An expired or revoked domain returns to pending with a new token (a new TXT value). A verified or manual domain is returned unchanged. If the cell's DNS resolver is not configured in this deployment the check is refused with 503.
Request
| Field | Type | Required | Description |
|---|---|---|---|
domain_id |
path | yes | Organization domain ID (odm_…). |
Idempotency-Key |
header | no | Optional key (16-64 characters) that makes a retried request safe. |
No request body.
Response
200 OK with the domain and an ETag header.
{
"id": "odm_01j9xk3m7q8r2s4t6v8w0y2z4c",
"organization_id": "org_01j9xk3m7q8r2s4t6v8w0y2z4a",
"domain": "acme.com",
"status": "verified",
"verification_method": "dns_txt",
"txt_record_name": "_akp-verify.acme.com",
"txt_record_value": "idp-verify=EXAMPLEtokenEXAMPLEtokenEXAMPLEtokenEXAMPLEtok",
"verification_started_at": "2026-10-12T09:30:00.123456Z",
"verified_at": "2026-10-12T09:35:00.654321Z",
"last_checked_at": "2026-10-12T09:35:00.654321Z",
"unverified_at": null,
"next_check_at": "2026-10-13T09:35:00.654321Z",
"last_failure_code": null,
"capture_mode": "off",
"sso_routing_enabled": false,
"created_at": "2026-10-12T09:30:00.123456Z",
"updated_at": "2026-10-12T09:35:00.654321Z",
"version": 2
}
Errors
| HTTP | code | When |
|---|---|---|
| 404 | not_found |
No organization domain with this ID exists in this environment. |
| 409 | conflict |
A concurrent change touched the domain during the check; retry. |
| 409 | organization_disabled |
The organization is disabled. |
| 409 | organization_pending_deletion |
The organization is waiting for self-service deletion; cancel the deletion first. |
| 503 | service_unavailable |
The DNS resolver is not configured in this deployment, or a dependency is temporarily unavailable. |
| 401 | unauthenticated |
The credential is missing, invalid or revoked. |
| 403 | insufficient_permissions |
The credential lacks the required permission. |
| 429 | rate_limited |
The rate limit was exceeded; retry after the Retry-After period. |
Example
curl -X POST https://api.eu.keenauth.com/v1/organization-domains/odm_01j9xk3m7q8r2s4t6v8w0y2z4c:verify \
-H "Authorization: Bearer $KEENAUTH_SECRET_KEY"