# Create Application

> Start (or resume) a verification

**Endpoint:** `POST /v1/applications`  
**Access:** Public (no credentials needed)  
**MCP tool:** `start_application`

Idempotent per owner + domain (200 existing, 201 new). Creates a guest session when no credential is sent and returns `guest_token` once. Blocked providers → 422 `blocked_provider`. example.com domains always run in test mode with simulated DNS.

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/v1/applications" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "acme.com",
    "environment": "live"
  }'
```

## Parameters

| Parameter | Type | Description |
|---|---|---|
| `Idempotency-Key` (header) | `string` | Unique key per intended action (≤ 255 chars). Same key + same body replays the first response; same key + different body → 409. |

## Request body

| Field | Type | Description |
|---|---|---|
| `domain` *(required)* | `string` | A domain, URL or email address. |
| `environment` | `string` | Guests only; example.com domains always use `test`. |

```json
{
  "domain": "acme.com",
  "environment": "live"
}
```

## Responses

### 200 OK

Existing draft returned.

```json
{
  "background": [
    {
      "kind": "domain_scan",
      "message": "Everything checks out.",
      "next_run_at": "2026-10-31T12:00:00Z",
      "state": "string",
      "status": "pending",
      "updated_at": "2026-10-31T12:00:00Z"
    }
  ],
  "brand_name": "string",
  "contact_email": "string",
  "created": true,
  "created_at": "2026-10-31T12:00:00Z",
  "current_step": "domain",
  "domain": "acme.com",
  "domain_display": "string",
  "domain_status": "unknown",
  "email_usage": "none",
  "environment": "live",
  "guest_token": "string",
  "guest_token_note": "string",
  "id": "0192a5e0-1234-7000-8000-000000000001",
  "next_actions": [
    {
      "api": {
        "method": "string",
        "path": "string"
      },
      "description": "string",
      "kind": "string",
      "mcp_tool": "string",
      "requires_auth": true,
      "requires_payment": true,
      "step": "domain",
      "title": "string",
      "url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
    }
  ],
  "organizational_domain": "string",
  "outcomes": {
    "bimi": "not_published",
    "business": "not_started",
    "certificate": "not_ordered",
    "dmarc_rollout": "missing",
    "eligibility": "unknown",
    "inbox_display": "not_observed",
    "logo": "missing",
    "ownership": "pending",
    "payment": "unpaid",
    "trademark": "not_started"
  },
  "owner": {
    "type": "guest"
  },
  "product": "vmc",
  "product_selected": "vmc",
  "recommended_product": "vmc",
  "steps": [
    {
      "completed_at": "2026-10-31T12:00:00Z",
      "paid": true,
      "phase": "check",
      "requirements": [],
      "slug": "domain",
      "status": "locked",
      "summary": "string",
      "title": "string"
    }
  ],
  "updated_at": "2026-10-31T12:00:00Z",
  "version": 1,
  "web_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
}
```

### 201 OK

Created.

```json
{
  "background": [
    {
      "kind": "domain_scan",
      "message": "Everything checks out.",
      "next_run_at": "2026-10-31T12:00:00Z",
      "state": "string",
      "status": "pending",
      "updated_at": "2026-10-31T12:00:00Z"
    }
  ],
  "brand_name": "string",
  "contact_email": "string",
  "created": true,
  "created_at": "2026-10-31T12:00:00Z",
  "current_step": "domain",
  "domain": "acme.com",
  "domain_display": "string",
  "domain_status": "unknown",
  "email_usage": "none",
  "environment": "live",
  "guest_token": "string",
  "guest_token_note": "string",
  "id": "0192a5e0-1234-7000-8000-000000000001",
  "next_actions": [
    {
      "api": {
        "method": "string",
        "path": "string"
      },
      "description": "string",
      "kind": "string",
      "mcp_tool": "string",
      "requires_auth": true,
      "requires_payment": true,
      "step": "domain",
      "title": "string",
      "url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
    }
  ],
  "organizational_domain": "string",
  "outcomes": {
    "bimi": "not_published",
    "business": "not_started",
    "certificate": "not_ordered",
    "dmarc_rollout": "missing",
    "eligibility": "unknown",
    "inbox_display": "not_observed",
    "logo": "missing",
    "ownership": "pending",
    "payment": "unpaid",
    "trademark": "not_started"
  },
  "owner": {
    "type": "guest"
  },
  "product": "vmc",
  "product_selected": "vmc",
  "recommended_product": "vmc",
  "steps": [
    {
      "completed_at": "2026-10-31T12:00:00Z",
      "paid": true,
      "phase": "check",
      "requirements": [],
      "slug": "domain",
      "status": "locked",
      "summary": "string",
      "title": "string"
    }
  ],
  "updated_at": "2026-10-31T12:00:00Z",
  "version": 1,
  "web_url": "https://verifiedinbox.ai/verify/0192a5e0-1234-7000-8000-000000000001/domain"
}
```

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 409 (version_conflict)

`conflict` / `version_conflict` (current state in `details.application`) / Idempotency-Key reuse.

```json
{
  "error": {
    "code": "version_conflict",
    "message": "This application was updated elsewhere. Refresh and try again."
  }
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```