---
title: "Verify AAO-hosted publisher origin"
method: POST
path: "/api/properties/hosted/{domain}/verify-origin"
tags: ["Property Resolution"]
---

# Verify AAO-hosted publisher origin

`POST /api/properties/hosted/{domain}/verify-origin`

Trigger origin verification for an AAO-hosted publisher: fetches the publisher's own `/.well-known/adagents.json` and checks for an `authoritative_location` field pointing at the AAO-hosted URL. On success, promotes `agent_publisher_authorizations` rows from `source='aao_hosted'` to `source='adagents_json'` for the manifest's authorized agents — buyers reading the registry then see them as origin-attested.

Bind-on-verify: when the pointer carries an `adcp_claim` token (see the claim endpoint), a successful verification binds the domain to that claim's organization and returns `bound_org_id`. Binding is driven by which token the origin pointer carries, never by who triggers verification, so any authenticated caller may trigger it and a squatter cannot bind a domain they don't control. An existing verified owner is never overwritten.

Failure classification:
- `not_found`: publisher origin returned 404 (permanent — demotes if previously verified).
- `invalid_json` / `no_authoritative_location` / `authoritative_location_mismatch`: publisher origin returned a parseable response that doesn't satisfy the spec stub pattern (permanent — demotes).
- `unresolvable`: DNS NXDOMAIN, private IP, or non-http scheme (permanent — demotes).
- `transient`: 5xx / 429 / 3xx / network timeout (leaves persisted state alone, stamps `origin_last_checked_at`).

## Path parameters

- `domain` string, required

## Response `200`

Verification outcome

- object
  - `verified` boolean, required
  - `reason` 'authoritative_location_pointer' | 'not_found' | 'invalid_json' | 'no_authoritative_location' | 'authoritative_location_mismatch' | 'unresolvable' | 'transient', required
  - `checked_at` string, required
  - `detail` string
  - `bound_org_id` string

## Other responses

- `400` — Invalid domain
- `401` — Authentication required
- `404` — No hosted property for this domain

---

[API](https://skmtc.net/adcontextprotocol/apis/agenticadvertising-org-registry-api.md) · [All operations](https://skmtc.net/adcontextprotocol/apis/agenticadvertising-org-registry-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/adcontextprotocol/agenticadvertising-org-registry-api/revisions/9ea7fedf54c0/schema)