Integrations - Connectors - Domain Verification

Domain ownership verification for DAST targets.

📄️ Add Domain

Registers a domain for ownership verification under the authenticated client and returns a DNS TXT verification token. The domain remains unvalidated until it is verified or its terms of service are accepted.

📄️ List Domains

Lists the domains registered by the authenticated client, optionally filtered by validation state via the validated query parameter. Returns 404 if the client does not exist.

📄️ Verify Domain

Verifies domain ownership by resolving the domain's DNS TXT records and checking for the previously issued verification token. Marks the domain as validated on success; returns a false status when the token is not found.

📄️ Bind Domain

Binds a registered domain to a repository as its dynamic scan application URL. The domain must be verified or have its terms of service accepted (400 otherwise); returns 404 if the domain or client is not found.

📄️ Add App Verification Target

Registers a specific application URL for scoped ownership verification under the authenticated client and returns a verification token, plus the HTML meta tag and well-known file that can be used to prove ownership. Unlike whole-domain verification, this does not require DNS control of the apex domain.

📄️ List App Verification Targets

Lists the application URLs registered for scoped ownership verification by the authenticated client, optionally filtered by validation state via the validated query parameter. Returns 404 if the client does not exist.

📄️ Verify App Ownership

Verifies ownership of a specific application URL by checking for the previously issued verification token in an HTML meta tag or a well-known file served from that URL. Marks the entry as validated on success; returns a false status when the proof is not found.

📄️ Accept Domain Terms of Service

Marks an unverified domain as accepted under the terms of service, allowing pentest use without DNS verification. Returns 404 if the domain is not registered for the authenticated client.

📄️ Delete Domain

Removes a registered domain, identified by its UUID, from the authenticated client's domain list. Returns 404 if the domain is not found.