API Reference · Applications

Create Application

Start (or resume) a verification

POST/v1/applications

Public (no credentials needed)Idempotency-Key:optionalMCP:start_application

Idempotent per owner + domain (200 existing, 201 new). Creates a guest session when no credential is sent and returns guest_token once. Blocked providers → 422 blocked_provider. example.com domains always run in test mode with simulated DNS.

cURL example

cURL request

curl -X POST "https://api.verifiedinbox.ai/v1/applications" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "acme.com",
    "environment": "live"
  }'

Parameters

Parameter	Type	Description
Idempotency-Keyheader	string	Unique key per intended action (≤ 255 chars). Same key + same body replays the first response; same key + different body → 409.

Request body

application/json · required

Field Type Description

Field	Type	Description
domainrequired	string	A domain, URL or email address.
environmentoptional	string	Guests only; example.com domains always use `test`. Allowed: `live`, `test`

domainrequired

string

A domain, URL or email address.

environmentoptional

string

Guests only; example.com domains always use `test`.

Allowed: live, test

Example request payload (CreateApplicationRequest)

{
  "domain": "acme.com",
  "environment": "live"
}

Response

200 OKExisting draft returned.

application/json

Field	Type	Description
backgroundrequired	BackgroundWork[]	Active long-running work plus anything finished in the last 10 minutes. Nested fields (6) `kind` (string) `message` (string): Plain-English description. `next_run_at` (string (date-time)) `state` (string) `status` (string) `updated_at` (string (date-time))
brand_namerequired	string	Display-name guess (website title or domain label).
contact_emailrequired	string \| null	—
createdrequired	boolean	False when an existing draft was returned.
created_atrequired	string (date-time)	—
current_steprequired	string	Where to work now: the first step needing attention, else the first step the user hasn't completed. Allowed: `domain`, `email-security`, `logo`, `trademark`, `eligibility`, `checkout`, `business`, `logo-approval`, `dns`, `certificate`, `go-live`
domainrequired	string	Normalized ASCII (punycode) domain.
domain_displayrequired	string	Unicode form of the domain.
domain_statusrequired	string	Whether the domain is registered and can have its own logo (`unknown` while checking). Allowed: `unknown`, `ok`, `not_registered`, `blocked_provider`
email_usagerequired	string \| null	How email is used on the domain, as told by the customer (null until answered). Allowed: `none`, `low`, `active`
environmentrequired	string	— Allowed: `live`, `test`
guest_tokenoptional	string	Only when a guest session was created by this call. Store it.
guest_token_noteoptional	string	—
idrequired	string (uuid)	—
next_actionsrequired	NextAction[]	What to do next (for people and agents). Nested fields (9) `api` (ApiRef) `description` (string) `kind` (string) `mcp_tool` (string) `requires_auth` (boolean) `requires_payment` (boolean) `step` (string) `title` (string) `url` (string): Web URL when the action happens in the browser (e.g. sign in).
organizational_domainrequired	string	Registrable domain (e.g. `acme.com` for `news.acme.com`).
outcomesrequired	Outcomes	Separate outcomes — never collapsed into one "verified" flag. Nested fields (10) `bimi` (string) `business` (string) `certificate` (string) `dmarc_rollout` (string) `eligibility` (string) `inbox_display` (string) `logo` (string) `ownership` (string) `payment` (string) `trademark` (string)
ownerrequired	ApplicationOwner	—
productrequired	string \| null	Chosen product, else the recommended one. Allowed: `vmc`, `cmc`
product_selectedrequired	string \| null	Product explicitly chosen by the customer. Allowed: `vmc`, `cmc`
recommended_productrequired	string \| null	From eligibility; null until assessed. Allowed: `vmc`, `cmc`
stepsrequired	Step[]	The 11 wizard steps, in order. Nested fields (8) `completed_at` (string (date-time)): When the user completed the step (null if not yet). `paid` (boolean) `phase` (string) `requirements` (StepRequirement[]): The minimum this step needs (required) plus recommended extras. `slug` (string) `status` (string): `complete`: the user finished it. `attention`: finished earlier, but something it relied on is now missing or broken. `ready`: the current step has everything it needs; complete it with `completeStep`. `action_required` / `in_progress` / `blocked`: the current step isn't ready. `locked`: comes after the current step. `summary` (string): One plain-English sentence. `title` (string)
updated_atrequired	string (date-time)	—
versionrequired	integer	Optimistic-concurrency version; send as `If-Match`.
web_urlrequired	string	Deep link to the current step in the web app.

Example 200 response (ApplicationCreated)

{
  "background": [
    {
      "kind": "domain_scan",
      "message": "Everything checks out.",
      "next_run_at": "2026-10-31T12:00:00Z",
      "state": "string",
      "status": "pending",
      "updated_at": "2026-10-31T12:00:00Z"
    }
  ],
  "brand_name": "string",
  "contact_email": "string",
  "created": true,
  "created_at": "2026-10-31T12:00:00Z",
  "current_step": "domain",
  "domain": "acme.com",
  "domain_display": "string",
  "domain_status": "unknown",
  "email_usage": "none",
  "environment": "live",
  "guest_token": "string",
  "guest_token_note": "string",
  "id": "0192a5e0-1234-7000-8000-000000000001",
  "next_actions": [
    {
      "api": {
        "method": "string",
        "path": "string"
      },
      "description": "string",
      "kind": "string",
      "mcp_tool": "string",
      "requires_auth": true,
      "requires_payment": true,
      "step": "domain",
      "title": "string",
      "url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
    }
  ],
  "organizational_domain": "string",
  "outcomes": {
    "bimi": "not_published",
    "business": "not_started",
    "certificate": "not_ordered",
    "dmarc_rollout": "missing",
    "eligibility": "unknown",
    "inbox_display": "not_observed",
    "logo": "missing",
    "ownership": "pending",
    "payment": "unpaid",
    "trademark": "not_started"
  },
  "owner": {
    "type": "guest"
  },
  "product": "vmc",
  "product_selected": "vmc",
  "recommended_product": "vmc",
  "steps": [
    {
      "completed_at": "2026-10-31T12:00:00Z",
      "paid": true,
      "phase": "check",
      "requirements": [],
      "slug": "domain",
      "status": "locked",
      "summary": "string",
      "title": "string"
    }
  ],
  "updated_at": "2026-10-31T12:00:00Z",
  "version": 1,
  "web_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
}

201 OKCreated.

application/json

Field	Type	Description
backgroundrequired	BackgroundWork[]	Active long-running work plus anything finished in the last 10 minutes. Nested fields (6) `kind` (string) `message` (string): Plain-English description. `next_run_at` (string (date-time)) `state` (string) `status` (string) `updated_at` (string (date-time))
brand_namerequired	string	Display-name guess (website title or domain label).
contact_emailrequired	string \| null	—
createdrequired	boolean	False when an existing draft was returned.
created_atrequired	string (date-time)	—
current_steprequired	string	Where to work now: the first step needing attention, else the first step the user hasn't completed. Allowed: `domain`, `email-security`, `logo`, `trademark`, `eligibility`, `checkout`, `business`, `logo-approval`, `dns`, `certificate`, `go-live`
domainrequired	string	Normalized ASCII (punycode) domain.
domain_displayrequired	string	Unicode form of the domain.
domain_statusrequired	string	Whether the domain is registered and can have its own logo (`unknown` while checking). Allowed: `unknown`, `ok`, `not_registered`, `blocked_provider`
email_usagerequired	string \| null	How email is used on the domain, as told by the customer (null until answered). Allowed: `none`, `low`, `active`
environmentrequired	string	— Allowed: `live`, `test`
guest_tokenoptional	string	Only when a guest session was created by this call. Store it.
guest_token_noteoptional	string	—
idrequired	string (uuid)	—
next_actionsrequired	NextAction[]	What to do next (for people and agents). Nested fields (9) `api` (ApiRef) `description` (string) `kind` (string) `mcp_tool` (string) `requires_auth` (boolean) `requires_payment` (boolean) `step` (string) `title` (string) `url` (string): Web URL when the action happens in the browser (e.g. sign in).
organizational_domainrequired	string	Registrable domain (e.g. `acme.com` for `news.acme.com`).
outcomesrequired	Outcomes	Separate outcomes — never collapsed into one "verified" flag. Nested fields (10) `bimi` (string) `business` (string) `certificate` (string) `dmarc_rollout` (string) `eligibility` (string) `inbox_display` (string) `logo` (string) `ownership` (string) `payment` (string) `trademark` (string)
ownerrequired	ApplicationOwner	—
productrequired	string \| null	Chosen product, else the recommended one. Allowed: `vmc`, `cmc`
product_selectedrequired	string \| null	Product explicitly chosen by the customer. Allowed: `vmc`, `cmc`
recommended_productrequired	string \| null	From eligibility; null until assessed. Allowed: `vmc`, `cmc`
stepsrequired	Step[]	The 11 wizard steps, in order. Nested fields (8) `completed_at` (string (date-time)): When the user completed the step (null if not yet). `paid` (boolean) `phase` (string) `requirements` (StepRequirement[]): The minimum this step needs (required) plus recommended extras. `slug` (string) `status` (string): `complete`: the user finished it. `attention`: finished earlier, but something it relied on is now missing or broken. `ready`: the current step has everything it needs; complete it with `completeStep`. `action_required` / `in_progress` / `blocked`: the current step isn't ready. `locked`: comes after the current step. `summary` (string): One plain-English sentence. `title` (string)
updated_atrequired	string (date-time)	—
versionrequired	integer	Optimistic-concurrency version; send as `If-Match`.
web_urlrequired	string	Deep link to the current step in the web app.

Example 201 response (ApplicationCreated)

{
  "background": [
    {
      "kind": "domain_scan",
      "message": "Everything checks out.",
      "next_run_at": "2026-10-31T12:00:00Z",
      "state": "string",
      "status": "pending",
      "updated_at": "2026-10-31T12:00:00Z"
    }
  ],
  "brand_name": "string",
  "contact_email": "string",
  "created": true,
  "created_at": "2026-10-31T12:00:00Z",
  "current_step": "domain",
  "domain": "acme.com",
  "domain_display": "string",
  "domain_status": "unknown",
  "email_usage": "none",
  "environment": "live",
  "guest_token": "string",
  "guest_token_note": "string",
  "id": "0192a5e0-1234-7000-8000-000000000001",
  "next_actions": [
    {
      "api": {
        "method": "string",
        "path": "string"
      },
      "description": "string",
      "kind": "string",
      "mcp_tool": "string",
      "requires_auth": true,
      "requires_payment": true,
      "step": "domain",
      "title": "string",
      "url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
    }
  ],
  "organizational_domain": "string",
  "outcomes": {
    "bimi": "not_published",
    "business": "not_started",
    "certificate": "not_ordered",
    "dmarc_rollout": "missing",
    "eligibility": "unknown",
    "inbox_display": "not_observed",
    "logo": "missing",
    "ownership": "pending",
    "payment": "unpaid",
    "trademark": "not_started"
  },
  "owner": {
    "type": "guest"
  },
  "product": "vmc",
  "product_selected": "vmc",
  "recommended_product": "vmc",
  "steps": [
    {
      "completed_at": "2026-10-31T12:00:00Z",
      "paid": true,
      "phase": "check",
      "requirements": [],
      "slug": "domain",
      "status": "locked",
      "summary": "string",
      "title": "string"
    }
  ],
  "updated_at": "2026-10-31T12:00:00Z",
  "version": 1,
  "web_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
}

Other responses & possible errors

Expand a status code below to see the error code, description, and example error payload.

400 (invalid_request)`invalid_request` — the request is malformed.

`invalid_request` — the request is malformed.

Example 400 error response

{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}

409 (version_conflict)`conflict` / `version_conflict` (current state in `details.application`) / Idempotency-Key reuse.

`conflict` / `version_conflict` (current state in `details.application`) / Idempotency-Key reuse.

Example 409 error response

{
  "error": {
    "code": "version_conflict",
    "message": "This application was updated elsewhere. Refresh and try again."
  }
}

422 (unprocessable)`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

Example 422 error response

{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}

429 (rate_limited)`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

Example 429 error response

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}

Was it helpful?