Skip to content
GET/api/v1/sso/domain-verification

Get the DNS TXT challenge proving SSO domain ownership (admin)

Returns each SSO configuration in the organization with its verification state and, where a challenge has been issued, the exact TXT record to publish. Ownership proof is MANDATORY before an SSO configuration may authenticate anyone. It exists because without it any org could claim any domain, supply its own IdP key material, and take over arbitrary accounts. The returned token is a challenge nonce, not a secret credential — publishing it in DNS is the entire point, and it is only useful to whoever already controls the zone.

Authentication

Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.

Parameters

orgId in query

Organization to scope the read to. Resolved in order: this query param, then a body field, then the org an authenticated `eg_*` API key is bound to. Required for session auth (a user may belong to several orgs); optional for a key already scoped to one org. 400 MISSING_ORG_ID when none of the three yields a value.

string

Response

200 example

{
  "success": true
}

All status codes

200`{ configs: [{ configId, domain, verified, verifiedAt, graceUntil, record }] }`, where `record` is `{ type: "TXT", name, value }` or null when no challenge has been issued.
400(no description)
401(no description)
403Forbidden — the credential is valid but lacks the API-key scope, member role, or plan entitlement this operation requires.
429(no description)
500Internal Server Error — DB_ERROR.

Code samples

cURL

curl -X GET \
  https://evalguard.ai/api/v1/sso/domain-verification \
  -H "Authorization: Bearer $EVALGUARD_API_KEY"

TypeScript

// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:

const res = await fetch("https://evalguard.ai/api/v1/sso/domain-verification", {
  method: "GET",
  headers: { Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}` },
});
console.log(res.status, await res.json());

Python

# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}

response = requests.request("GET", "https://evalguard.ai/api/v1/sso/domain-verification", headers=headers)
print(response.status_code, response.json())

Go

package main

import (
	"context"
	"fmt"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequestWithContext(context.Background(), "GET", "https://evalguard.ai/api/v1/sso/domain-verification", nil)
	req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
	resp, err := http.DefaultClient.Do(req)
	if err != nil { panic(err) }
	defer resp.Body.Close()
	fmt.Println(resp.Status)
}

Errors

400401403429500

Other Admin endpoints