--- title: "Retrieve detailed information for supplied domain" method: GET path: "/v2/customers/{customerId}/certificates/{certificateId}/domainVerifications/{domain}" tags: ["v2"] --- # Retrieve detailed information for supplied domain `GET /v2/customers/{customerId}/certificates/{certificateId}/domainVerifications/{domain}` Retrieve detailed information for supplied domain, including domain verification details and Certificate Authority Authorization (CAA) verification details. ## Path parameters - `customerId` string, required - `certificateId` string, required - `domain` string, domain, required ## Response `200` Retrieve detailed information for supplied domain, including domain verification details and Certificate Authority Authorization (CAA) verification details. - DomainVerificationDetail - `domain` string, domain, required — Domain name - `domainEntityId` integer, required — A unique identifier that can be leveraged for retrieving domain verification related information. Primarily used when troubleshooting a request - `dceToken` string — DCE verification type token (if DCE verification type). - `status` 'COMPLETED' | 'FAILED_VERIFICATION' | 'VERIFIED_POSSIBLE_FRAUD' | 'DROPPED' | 'DROPPED_CERTIFICATE_AUTHORITY_AUTHORIZATION' | 'DROPPED_GOOGLE_SAFE_BROWSING' | 'INVALID' | 'AWAITING' | 'PENDING_POSSIBLE_FRAUD' | 'REVOKED_CERTIFICATE', required — Domain verification status: * `AWAITING` - Verification pending customer input * `INVALID` - SAN connected to a cancelled request * `COMPLETED` - Verification completed * `FAILED_VERIFICATION` - Verification failed * `PENDING_POSSIBLE_FRAUD` - Flagged for a system level fraud review * `VERIFIED_POSSIBLE_FRAUD` - Fraud detection reviewed but verified * `DROPPED` - SAN dropped from request * `REVOKED_CERT` - Certificate revoked * `DROPPED_GOOGLE_SAFE_BROWSING` - SAN dropped from request due to Google Safe Browsing check * `DROPPED_CERTIFICATE_AUTHORITY_AUTHORIZATION` - SAN dropped from request due to Certificate Authorization Authority DNS record check - `createdAt` string, iso-datetime, required — Timestamp indicating when the domain verification process was started - `modifiedAt` string, iso-datetime, required — Timestamp indicating when the domain verification process was last updated - `type` 'DOMAIN_CONTROL_EMAIL' | 'AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_ADMIN' | 'AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_ADMINSTRATOR' | 'AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_HOST_MASTER' | 'AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_POST_MASTER' | 'AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_WEB_MASTER' | 'DOMAIN_ACCESS_EMAIL' | 'DOMAIN_ACCESS_LETTER' | 'DOMAIN_ZONE_CONTROL' | 'MANUAL_DOMAIN_ACCESS_EMAIL' | 'PREVIOUS_DOMAIN_ACCESS_EMAIL' | 'REGISTRATION_AUTHORITY_DOMAIN_ACCESS_LETTER' | 'REGISTRATION_AUTHORITY_DOMAIN_ZONE_CONTROL' | 'REGISTRATION_AUTHORITY_OVERRIDE' | 'REGISTRATION_AUTHORITY_WEBSITE_CONTROL' | 'CUSTOMER_OWNED' | 'WEBSITE_CONTROL', required — Domain verification type: * `AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_ADMIN` - Domain verified using domain control verification email sent to admin@ * `AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_ADMINSTRATOR` - Domain verified using domain control verification email sent to administrator@ * `AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_HOST_MASTER` - Domain verified using domain control verification email sent to hostmaster@ * `AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_POST_MASTER` - Domain verified using domain control verification email sent to postmaster@ * `AUTO_GENERATED_DOMAIN_ACCESS_EMAIL_WEB_MASTER` - Domain verified using domain control verification email sent to webmaster@ * `DOMAIN_ACCESS_EMAIL` - Domain verified using a domain access email * `DOMAIN_ACCESS_LETTER` - Customer completed a domain access letter which was used for domain verification * `DOMAIN_CONTROL_EMAIL` - Domain verified using HTML file or DNS zone file text value * `DOMAIN_ZONE_CONTROL` - DNS zone file containing a pre-generated text value used for domain verification * `MANUAL_DOMAIN_ACCESS_EMAIL` - DAE sent to an email address manually entered by a rep * `PREVIOUS_DOMAIN_ACCESS_EMAIL` - Customers domain access email for a prior certificate request was used for domain verification * `REGISTRATION_AUTHORITY_DOMAIN_ACCESS_LETTER` - Representative reviewed a customer provided domain access letter and verified domain * `REGISTRATION_AUTHORITY_DOMAIN_ZONE_CONTROL` - Representative verified domain using a manual domain zone control check * `REGISTRATION_AUTHORITY_OVERRIDE` - Representative verified domain using alternative methods * `REGISTRATION_AUTHORITY_WEBSITE_CONTROL` - Representative verified domain using a manual website control check * `CUSTOMER_OWNED` - Validated customer account information used for domain control verification * `WEBSITE_CONTROL` - HTML file in root website directory containing pre-generated value used for domain control verification - `usage` 'COMMON_NAME' | 'SUBJECT_ALTERNATIVE_NAME', required — Type of domain name used for domain verification - `certificateAuthorityAuthorization` object — Contains information about the last Certificate Authority Authorization (CAA) Lookup details for the specified domain. In order for a domain to be eligible to be included in the certificate, the entire domain hierarchy must be scanned for DNS CAA records, as outlined by RFC 6844. The absence of any CAA records found in the domain hierarchy indicates that the domain may be included in the certificate. Alternatively, if CAA records are found when scanning the domain hierarchy, the domain may be included in the certificate as long as `godaddy.com` or `starfieldtech.com` is found in the DNS record value. However, if CAA records are found, yet `godaddy.com` or `starfieldtech.com` is not found in any CAA record's value, then we must drop the domain from the certificate request. In the case where there are repeated DNS errors when scanning the domain hierarchy for CAA records, thus ending in an unsuccessful scan, then the domain can still be included in the certificate provided the primary domain is not setup with DNSSEC. Conversely, if DNSSEC is found to be setup on the primary domain when scanning following repeated CAA failures, the domain must be dropped from the certificate request. Finally, if DNS errors persist to the point where a successful DNSSEC query could not be obtained, then the domain must be dropped from the certificate request. - `status` 'PENDING' | 'REMOVED_DNS_ERROR' | 'REMOVED_DNSSEC_ENABLED' | 'REMOVED_NOT_FOUND_CA' | 'REMOVED_UNKNOWN_CRITICAL_TAG' | 'SUCCESS_CAA' | 'SUCCESS_DNSSEC' — Returns the status of the CAA Lookup for the specified domain: * `PENDING` - The CAA lookup has not yet been attempted for the specified domain. * `REMOVED_DNS_ERROR` - Repeated errors occurred while scanning for CAA records, thereby resulting in a DNSSEC scan. DNS errors then prevented the system from determining if DNSSEC was enabled for the specified domain, and it had to be removed from the certificate request. * `REMOVED_DNSSEC_ENABLED` - Repeated errors occurred while scanning for CAA records, thereby resulting in a DNSSEC scan. DNSSEC was determined to be enabled for the specified domain, and it had to be removed from the certificate request. * `REMOVED_NOT_FOUND_CA` - CAA records were found during the CAA lookup for the speicified domain, but `godaddy.com` or `starfieldtech.com` was not listed as a value, thereby not allowing us to issue a certificate with this domain. The specified domain was removed from the certificate request. * `REMOVED_UNKNOWN_CRITICAL_TAG` - A CAA record was found during the CAA lookup with its Critical bit set, as outlined by RFC 6844, yet the Tag of the CAA record was not understood (as outlined by RFC 6844). The specified domain was removed from the certificate request. * `SUCCESS_CAA` - The CAA lookup was successful for the specified domain, and the domain can remain in the certificate request. * `SUCCESS_DNSSEC` - Repeated errors occurred while scanning for CAA records, thereby resulting in a DNSSEC scan. The system detemined that DNSSEC was not enabled for the specified domain, so the domain is allowed to remain in the certificate request. - `queryPaths` string[] — Details all the individual DNS paths that were scanned for CAA records for this domain, as detailed by RFC 6844. This element not only contains the parts determined from parsing the domain, but also any CNAME or DNAME targets specified by any of those individual parts. - `recommendations` string[] — Returns a list of fix recommendations if the query was unsuccessful, or if the domain was dropped from the certificate request, so that a subsequent certificate request with the specified domain will successfully pass its CAA scan. - `completedAt` string, iso-datetime — The date the certificate request completed processing. ## Other responses - `401` — Authentication info not sent or is invalid - `403` — Authenticated user is not allowed access - `404` — Resource not found - `422` — Application-specific request error - `429` — Too many requests received within interval - `500` — Internal server error --- [API](https://skmtc.net/godaddy/apis/untitled-api-2.md) · [All operations](https://skmtc.net/godaddy/apis/untitled-api-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/godaddy/untitled-api-2/revisions/100b3aa2d7ee/schema)