curl --request GET \
--url https://api.sorraia.app/v1/site-verification \
--header 'X-Sorraia-Site-Key: <api-key>'import requests
url = "https://api.sorraia.app/v1/site-verification"
headers = {"X-Sorraia-Site-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-Sorraia-Site-Key': '<api-key>'}};
fetch('https://api.sorraia.app/v1/site-verification', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sorraia.app/v1/site-verification",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-Sorraia-Site-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sorraia.app/v1/site-verification"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-Sorraia-Site-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.sorraia.app/v1/site-verification")
.header("X-Sorraia-Site-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sorraia.app/v1/site-verification")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-Sorraia-Site-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"domain": "<string>",
"verified": true,
"method": "dns_txt",
"methods": [
"<string>"
],
"verifiedAt": "2023-11-07T05:31:56Z",
"lastCheckedAt": "2023-11-07T05:31:56Z",
"instructions": {
"token": "<string>",
"dns_txt": {
"type": "<string>",
"host": "<string>",
"value": "<string>"
},
"meta_tag": {
"url": "<string>",
"html": "<string>"
},
"wp_plugin": {
"paths": [
"<string>"
],
"pluginSlug": "<string>",
"note": "<string>"
}
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Read this site's domain-verification status
The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key.
instructions — and therefore the verification token inside it — is present ONLY while verified is false. Once a site is verified the token authorises nothing further and is not returned, so a plugin that polls for status never receives a secret it does not need.
method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.
curl --request GET \
--url https://api.sorraia.app/v1/site-verification \
--header 'X-Sorraia-Site-Key: <api-key>'import requests
url = "https://api.sorraia.app/v1/site-verification"
headers = {"X-Sorraia-Site-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-Sorraia-Site-Key': '<api-key>'}};
fetch('https://api.sorraia.app/v1/site-verification', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sorraia.app/v1/site-verification",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-Sorraia-Site-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sorraia.app/v1/site-verification"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-Sorraia-Site-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.sorraia.app/v1/site-verification")
.header("X-Sorraia-Site-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sorraia.app/v1/site-verification")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-Sorraia-Site-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"domain": "<string>",
"verified": true,
"method": "dns_txt",
"methods": [
"<string>"
],
"verifiedAt": "2023-11-07T05:31:56Z",
"lastCheckedAt": "2023-11-07T05:31:56Z",
"instructions": {
"token": "<string>",
"dns_txt": {
"type": "<string>",
"host": "<string>",
"value": "<string>"
},
"meta_tag": {
"url": "<string>",
"html": "<string>"
},
"wp_plugin": {
"paths": [
"<string>"
],
"pluginSlug": "<string>",
"note": "<string>"
}
}
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Authorizations
A per-site key (sor_site_...), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — GET /site-catalog, GET /site-verification and POST /site-verification/attempt — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and Authorization: Bearer will not accept it.
It is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.
Response
The site's verification status.
The registered hostname, e.g. example.com.
Whether ownership of the hostname is currently proven.
How ownership was last proven, or the method chosen at registration. null if none has been picked.
dns_txt, meta_tag, wp_plugin, null Every verification method this API supports.
When ownership was last proven. Cleared if verification lapses.
When Sorraia last looked, whether or not the check passed. Distinct from verifiedAt, which only moves on success.
How to prove ownership, for each method. Present only while the site is unverified — it carries the verification token.
Show child attributes
Show child attributes