The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key.
instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions.
method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.
GET
/
site-verification
Read this site's domain-verification status
curl --request GET \ --url https://api.sorraia.app/v1/site-verification \ --header 'X-Sorraia-Site-Key: <api-key>'
A per-site key (sor_site_...), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — GET /site-catalog, GET /site-verification and POST /site-verification/attempt — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and Authorization: Bearer will not accept it.
It is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.
How to prove ownership, for each method. Present while the site is unverified, and on a site verified with wp_plugin — it carries the verification token.
Show child attributes
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Sorraia API","description":"Read and manage your Sorraia forms, submissions, calendars, bookings, shop widgets, and orders over a simple REST API.","colors":{"primary":"#4f46e5","light":"#6366f1","dark":"#4338ca"},"logo":{"light":"https://mintcdn.com/formitto/1R_V_WlIjgoIjzVh/logo/light.svg?fit=max\u0026auto=format\u0026n=1R_V_WlIjgoIjzVh\u0026q=85\u0026s=5984e96b2333c3ec1beec3cc96387eba","dark":"https://mintcdn.com/formitto/1R_V_WlIjgoIjzVh/logo/dark.svg?fit=max\u0026auto=format\u0026n=1R_V_WlIjgoIjzVh\u0026q=85\u0026s=f80ebac182bb5ed97275235aadc16eaf"},"favicon":"https://mintcdn.com/formitto/1R_V_WlIjgoIjzVh/favicon.svg?fit=max\u0026auto=format\u0026n=1R_V_WlIjgoIjzVh\u0026q=85\u0026s=6e2d44b14ef77374bea125effdf06cd3","navbar":{"links":[{"href":"https://www.npmjs.com/package/@sorraia/sdk","label":"npm"}],"primary":{"type":"button","label":"Dashboard","href":"https://sorraia.app"}},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"formitto","hasAudioNarration":false,"actualSubdomain":"formitto","customDomains":["docs.sorraia.app"],"gitSource":{"type":"github","owner":"francisco-janeiro","repo":"wc_builder","deployBranch":"main","contentDirectory":"docs","isPrivate":true,"mountPath":"","label":""},"entitlements":{"AI_CHAT":{"status":"DISABLED"}},"buildId":"6ae2246be925292424a58018","clientVersion":"0.0.4117","searchFilterCounts":[{"language":"default","tag":"API Reference","count":26},{"language":"default","tag":"Endpoints","count":25},{"language":"default","tag":"Guides","count":11},{"language":"default","tag":"Resources","count":6},{"language":"default","tag":"forms","count":5},{"language":"default","tag":"submissions","count":4},{"language":"default","tag":"Get started","count":3},{"language":"default","tag":"bookings","count":3},{"language":"default","tag":"orders","count":3},{"language":"default","tag":"webhooks","count":3}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":false,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-rbac-roles","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-metadata","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/site-verification/read-this-sites-domain-verification-status","slug":"/api-reference/site-verification/read-this-sites-domain-verification-status","pageMetadata":{"title":"Read this site's domain-verification status","description":"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a **site key**, not an API key.\n\n`instructions` — and therefore the verification token inside it — is present while `verified` is `false`, and on a verified site whose `method` is `wp_plugin`. Sorraia re-checks every verified site daily, and for `wp_plugin` that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with `dns_txt` or `meta_tag` does not get `instructions`.\n\n`method` is the method that last proved (or was chosen to prove) ownership: `dns_txt`, `meta_tag`, `wp_plugin`, or `null` if none has been picked. `instructions.wp_plugin.paths` lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\n","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /site-verification","href":"/api-reference/site-verification/read-this-sites-domain-verification-status","autogeneratedByOpenApi":true},"description":{"compiledSource":"\"use strict\";\nconst {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n code: \"code\",\n p: \"p\",\n strong: \"strong\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_Fragment, {\n children: [_jsxs(_components.p, {\n children: [\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a \", _jsx(_components.strong, {\n children: \"site key\"\n }), \", not an API key.\"]\n }), \"\\n\", _jsxs(_components.p, {\n children: [_jsx(_components.code, {\n children: \"instructions\"\n }), \" — and therefore the verification token inside it — is present while \", _jsx(_components.code, {\n children: \"verified\"\n }), \" is \", _jsx(_components.code, {\n children: \"false\"\n }), \", and on a verified site whose \", _jsx(_components.code, {\n children: \"method\"\n }), \" is \", _jsx(_components.code, {\n children: \"wp_plugin\"\n }), \". Sorraia re-checks every verified site daily, and for \", _jsx(_components.code, {\n children: \"wp_plugin\"\n }), \" that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with \", _jsx(_components.code, {\n children: \"dns_txt\"\n }), \" or \", _jsx(_components.code, {\n children: \"meta_tag\"\n }), \" does not get \", _jsx(_components.code, {\n children: \"instructions\"\n }), \".\"]\n }), \"\\n\", _jsxs(_components.p, {\n children: [_jsx(_components.code, {\n children: \"method\"\n }), \" is the method that last proved (or was chosen to prove) ownership: \", _jsx(_components.code, {\n children: \"dns_txt\"\n }), \", \", _jsx(_components.code, {\n children: \"meta_tag\"\n }), \", \", _jsx(_components.code, {\n children: \"wp_plugin\"\n }), \", or \", _jsx(_components.code, {\n children: \"null\"\n }), \" if none has been picked. \", _jsx(_components.code, {\n children: \"instructions.wp_plugin.paths\"\n }), \" lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\"]\n })]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Read this site's domain-verification status","description":"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a **site key**, not an API key.\n\n`instructions` — and therefore the verification token inside it — is present while `verified` is `false`, and on a verified site whose `method` is `wp_plugin`. Sorraia re-checks every verified site daily, and for `wp_plugin` that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with `dns_txt` or `meta_tag` does not get `instructions`.\n\n`method` is the method that last proved (or was chosen to prove) ownership: `dns_txt`, `meta_tag`, `wp_plugin`, or `null` if none has been picked. `instructions.wp_plugin.paths` lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\n","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /site-verification","href":"/api-reference/site-verification/read-this-sites-domain-verification-status","autogeneratedByOpenApi":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"operationId":"getSiteVerification","tags":["site-verification"],"summary":"Read this site's domain-verification status","description":"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a **site key**, not an API key.\n\n`instructions` — and therefore the verification token inside it — is present while `verified` is `false`, and on a verified site whose `method` is `wp_plugin`. Sorraia re-checks every verified site daily, and for `wp_plugin` that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with `dns_txt` or `meta_tag` does not get `instructions`.\n\n`method` is the method that last proved (or was chosen to prove) ownership: `dns_txt`, `meta_tag`, `wp_plugin`, or `null` if none has been picked. `instructions.wp_plugin.paths` lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\n","security":["01db5dd7-ef3b-4afc-9059-2004887dcdc8"],"responses":{"200":"f439c4b5-d39a-431e-b23a-dd4a5ca9c2de","401":"bb2be872-c245-4ad4-9e19-46b2494c4315","404":"b4669c2c-94a2-4d30-8a9e-5f454f539cff","429":"9cb2cb97-3e6e-4d5c-9b31-e1fd8252509a","500":"08d8aaf3-6433-44f5-87b3-1d9557623ac4"},"method":"get","type":"path","servers":["1288d52e-9559-4827-9579-29758cd1947d"],"path":"/site-verification","baseUrlOptions":["https://api.sorraia.app/v1"],"title":"Read this site's domain-verification status","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{},"responses":{"f439c4b5-d39a-431e-b23a-dd4a5ca9c2de":{"description":"The site's verification status.","content":{"application/json":{"schema":{"type":"object","required":["domain","verified","method","methods"],"properties":{"domain":{"type":"string","description":"The registered hostname, e.g. `example.com`.","isRequired":true,"uniqueKey":"domain","typeLabel":"string"},"verified":{"type":"boolean","description":"Whether ownership of the hostname is currently proven.","isRequired":true,"uniqueKey":"verified","typeLabel":"boolean"},"method":{"oneOf":[{"type":"string","enum":["dns_txt","meta_tag","wp_plugin",null],"description":"How ownership was last proven, or the method chosen at registration. `null` if none has been picked.\n","isRequired":true,"uniqueKey":"method.oneOf.0","typeLabel":"enum\u003cstring>"},{"type":"null","enum":["dns_txt","meta_tag","wp_plugin",null],"description":"How ownership was last proven, or the method chosen at registration. `null` if none has been picked.\n","isRequired":true,"uniqueKey":"method.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"method","typeLabel":"enum\u003cstring> | null"},"methods":{"type":"array","items":{"type":"string","uniqueKey":"methods.items.[INDEX]","typeLabel":"string"},"description":"Every verification method this API supports.","isRequired":true,"uniqueKey":"methods","typeLabel":"string[]"},"verifiedAt":{"oneOf":[{"type":"string","format":"date-time","description":"When ownership was last proven. Cleared if verification lapses.","uniqueKey":"verifiedAt.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"When ownership was last proven. Cleared if verification lapses.","uniqueKey":"verifiedAt.oneOf.1","typeLabel":"null"}],"uniqueKey":"verifiedAt","typeLabel":"string\u003cdate-time> | null"},"lastCheckedAt":{"oneOf":[{"type":"string","format":"date-time","description":"When Sorraia last looked, whether or not the check passed. Distinct from `verifiedAt`, which only moves on success.\n","uniqueKey":"lastCheckedAt.oneOf.0","typeLabel":"string\u003cdate-time>"},{"type":"null","format":"date-time","description":"When Sorraia last looked, whether or not the check passed. Distinct from `verifiedAt`, which only moves on success.\n","uniqueKey":"lastCheckedAt.oneOf.1","typeLabel":"null"}],"uniqueKey":"lastCheckedAt","typeLabel":"string\u003cdate-time> | null"},"instructions":{"type":"object","description":"How to prove ownership, for each method. **Present while the site is unverified, and on a site verified with `wp_plugin`** — it carries the verification token.\n","required":["token","dns_txt","meta_tag","wp_plugin"],"properties":{"token":{"type":"string","description":"The site's verification token — 32 base64url characters. Treat it as a proof-of-control nonce rather than a bearer credential: with `meta_tag` and `wp_plugin` it is published on the merchant's own site by design.\n","isRequired":true,"uniqueKey":"instructions.token","typeLabel":"string"},"dns_txt":{"type":"object","properties":{"type":{"type":"string","description":"Always `TXT`.","uniqueKey":"instructions.dns_txt.type","typeLabel":"string"},"host":{"type":"string","description":"The record host — the registered hostname itself, with no underscore prefix.","uniqueKey":"instructions.dns_txt.host","typeLabel":"string"},"value":{"type":"string","description":"The record value, `sorraia-verify=\u003ctoken>`. Must match exactly.","uniqueKey":"instructions.dns_txt.value","typeLabel":"string"}},"isRequired":true,"uniqueKey":"instructions.dns_txt","typeLabel":"object"},"meta_tag":{"type":"object","properties":{"url":{"type":"string","description":"The page Sorraia will fetch.","uniqueKey":"instructions.meta_tag.url","typeLabel":"string"},"html":{"type":"string","description":"The tag to place in that page's \u003chead>.","uniqueKey":"instructions.meta_tag.html","typeLabel":"string"}},"isRequired":true,"uniqueKey":"instructions.meta_tag","typeLabel":"object"},"wp_plugin":{"type":"object","properties":{"paths":{"type":"array","items":{"type":"string","uniqueKey":"instructions.wp_plugin.paths.items.[INDEX]","typeLabel":"string"},"description":"The exact URLs Sorraia will probe, in order. Allowlist these if a firewall is in the way.\n","uniqueKey":"instructions.wp_plugin.paths","typeLabel":"string[]"},"pluginSlug":{"type":"string","description":"The WordPress plugin slug (`sorraia`).","uniqueKey":"instructions.wp_plugin.pluginSlug","typeLabel":"string"},"note":{"type":"string","description":"Human-readable prerequisites and limitations.","uniqueKey":"instructions.wp_plugin.note","typeLabel":"string"}},"isRequired":true,"uniqueKey":"instructions.wp_plugin","typeLabel":"object"}},"uniqueKey":"instructions","typeLabel":"object"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"domain":"\u003cstring>","verified":true,"method":"dns_txt","methods":["\u003cstring>"],"verifiedAt":"2023-11-07T05:31:56Z","lastCheckedAt":"2023-11-07T05:31:56Z","instructions":{"token":"\u003cstring>","dns_txt":{"type":"\u003cstring>","host":"\u003cstring>","value":"\u003cstring>"},"meta_tag":{"url":"\u003cstring>","html":"\u003cstring>"},"wp_plugin":{"paths":["\u003cstring>"],"pluginSlug":"\u003cstring>","note":"\u003cstring>"}}}}},"exampleType":"generated"}},"exampleType":"generated"},"bb2be872-c245-4ad4-9e19-46b2494c4315":{"description":"No `X-Sorraia-Site-Key` header was sent.","content":{"application/json":{"schema":{"type":"object","description":"Standard error envelope. `code` is a stable machine-readable string (e.g. invalid_api_key, insufficient_scope, not_found, rate_limited, domain_required, forbidden_field, plan_feature_gated, plan_limit_reached). Some errors carry extra context fields (candidates, required, fields, invalid, retryAfter, feature, resource, cap, used, domainId).\n","required":["error"],"additionalProperties":true,"properties":{"error":{"type":"string","description":"Human-readable message.","isRequired":true,"uniqueKey":"error","typeLabel":"string"},"code":{"type":"string","description":"Stable machine-readable error code.","uniqueKey":"code","typeLabel":"string"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>","code":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"b4669c2c-94a2-4d30-8a9e-5f454f539cff":{"description":"The site key is unknown, has been regenerated, or the site is archived. Returned instead of 401 so the response cannot be used to probe which keys exist.\n","content":{"application/json":{"schema":{"type":"object","description":"Standard error envelope. `code` is a stable machine-readable string (e.g. invalid_api_key, insufficient_scope, not_found, rate_limited, domain_required, forbidden_field, plan_feature_gated, plan_limit_reached). Some errors carry extra context fields (candidates, required, fields, invalid, retryAfter, feature, resource, cap, used, domainId).\n","required":["error"],"additionalProperties":true,"properties":{"error":{"type":"string","description":"Human-readable message.","isRequired":true,"uniqueKey":"error","typeLabel":"string"},"code":{"type":"string","description":"Stable machine-readable error code.","uniqueKey":"code","typeLabel":"string"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>","code":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"9cb2cb97-3e6e-4d5c-9b31-e1fd8252509a":{"description":"The per-API-key request budget for the current window is exhausted.","headers":{"X-RateLimit-Limit":{"description":"The per-API-key request budget for the current 1-hour window.","schema":{"type":"integer"}},"X-RateLimit-Remaining":{"description":"Requests remaining in the current window after this request.","schema":{"type":"integer"}},"X-RateLimit-Reset":{"description":"Unix timestamp (seconds) at which the rate-limit window resets.","schema":{"type":"integer"}},"Retry-After":{"description":"Seconds to wait before retrying. Present on 429 responses.","schema":{"type":"integer"}}},"content":{"application/json":{"schema":{"type":"object","description":"Standard error envelope. `code` is a stable machine-readable string (e.g. invalid_api_key, insufficient_scope, not_found, rate_limited, domain_required, forbidden_field, plan_feature_gated, plan_limit_reached). Some errors carry extra context fields (candidates, required, fields, invalid, retryAfter, feature, resource, cap, used, domainId).\n","required":["error"],"additionalProperties":true,"properties":{"error":{"type":"string","description":"Human-readable message.","isRequired":true,"uniqueKey":"error","typeLabel":"string"},"code":{"type":"string","description":"Stable machine-readable error code.","uniqueKey":"code","typeLabel":"string"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>","code":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"},"08d8aaf3-6433-44f5-87b3-1d9557623ac4":{"description":"An unexpected server error.","content":{"application/json":{"schema":{"type":"object","description":"Standard error envelope. `code` is a stable machine-readable string (e.g. invalid_api_key, insufficient_scope, not_found, rate_limited, domain_required, forbidden_field, plan_feature_gated, plan_limit_reached). Some errors carry extra context fields (candidates, required, fields, invalid, retryAfter, feature, resource, cap, used, domainId).\n","required":["error"],"additionalProperties":true,"properties":{"error":{"type":"string","description":"Human-readable message.","isRequired":true,"uniqueKey":"error","typeLabel":"string"},"code":{"type":"string","description":"Stable machine-readable error code.","uniqueKey":"code","typeLabel":"string"}},"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"error":"\u003cstring>","code":"\u003cstring>"}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{"01db5dd7-ef3b-4afc-9059-2004887dcdc8":{"siteKeyAuth":{"type":"apiKey","in":"header","name":"X-Sorraia-Site-Key","description":"A per-site key (`sor_site_...`), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — `GET /site-catalog`, `GET /site-verification` and `POST /site-verification/attempt` — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and `Authorization: Bearer` will not accept it.\n\nIt is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.\n","scopes":[],"schemeName":"siteKeyAuth"}}},"servers":{"1288d52e-9559-4827-9579-29758cd1947d":{"url":"https://api.sorraia.app/v1","description":"Production"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"apiKey","in":"header","name":"X-Sorraia-Site-Key","description":"A per-site key (`sor_site_...`), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — `GET /site-catalog`, `GET /site-verification` and `POST /site-verification/attempt` — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and `Authorization: Bearer` will not accept it.\n\nIt is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.\n","scopes":[],"schemeName":"siteKeyAuth"},"schema":{"title":"X-Sorraia-Site-Key","type":"string","description":"A per-site key (`sor_site_...`), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — `GET /site-catalog`, `GET /site-verification` and `POST /site-verification/attempt` — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and `Authorization: Bearer` will not accept it.\n\nIt is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.\n","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"siteKeyAuth","name":"X-Sorraia-Site-Key"}],"title":"siteKeyAuth"}]},"originalFileLocation":"api/openapi.yaml"},"subdomain":"formitto","siteName":"Sorraia API","title":"Read this site's domain-verification status - Sorraia API","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-28T16:36:06.449Z","originalFileLocation":"api-reference/site-verification/read-this-sites-domain-verification-status.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key. instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions. method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Sorraia API\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Read this site\u0026#x27;s domain-verification status - Sorraia API\">\u003cmeta data-mint-head property=\"og:description\" content=\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key. instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions. method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Sorraia API\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://formitto.mintlify.site/_mintlify/api/og/v2?division=site-verification\u0026amp;title=Read+this+site%27s+domain-verification+status\u0026amp;description=The+verification+state+of+the+one+site+the+key+belongs+to%2C+plus+the+instructions+for+every+method.+Authenticates+with+a+**site+key**%2C+not+an+API+key.%0A%0A%60instruct\u0026amp;theme=df00d79eed43e7e5708f3da3\u0026amp;signature=d7ccc3ad5b740525cd69cef94298179ee4b69f326f8090c36477c82c7a4ceb4f\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Read this site\u0026#x27;s domain-verification status - Sorraia API\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key. instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions. method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://formitto.mintlify.site/_mintlify/api/og/v2?division=site-verification\u0026amp;title=Read+this+site%27s+domain-verification+status\u0026amp;description=The+verification+state+of+the+one+site+the+key+belongs+to%2C+plus+the+instructions+for+every+method.+Authenticates+with+a+**site+key**%2C+not+an+API+key.%0A%0A%60instruct\u0026amp;theme=df00d79eed43e7e5708f3da3\u0026amp;signature=d7ccc3ad5b740525cd69cef94298179ee4b69f326f8090c36477c82c7a4ceb4f\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/formitto/Nikzz4RyhUK4971j/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Sorraia API\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#4f46e5\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/site-verification/read-this-sites-domain-verification-status.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.sorraia.app/#organization\",\"name\":\"Sorraia API\",\"url\":\"https://docs.sorraia.app\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/formitto/1R_V_WlIjgoIjzVh/logo/light.svg?fit=max\u0026auto=format\u0026n=1R_V_WlIjgoIjzVh\u0026q=85\u0026s=5984e96b2333c3ec1beec3cc96387eba\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.sorraia.app#website\",\"name\":\"Sorraia API\",\"url\":\"https://docs.sorraia.app\",\"publisher\":{\"@id\":\"https://docs.sorraia.app/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status#webpage\",\"url\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status\",\"name\":\"Read this site's domain-verification status\",\"description\":\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key. instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions. method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\",\"dateModified\":\"2026-10-28T16:36:06.449Z\",\"isPartOf\":{\"@id\":\"https://docs.sorraia.app#website\"},\"breadcrumb\":{\"@id\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Endpoints\",\"item\":\"https://docs.sorraia.app/api-reference/forms/list-forms\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Read this site's domain-verification status\",\"item\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status#apireference\",\"headline\":\"Read this site's domain-verification status\",\"name\":\"Read this site's domain-verification status\",\"description\":\"The verification state of the one site the key belongs to, plus the instructions for every method. Authenticates with a site key, not an API key. instructions — and therefore the verification token inside it — is present while verified is false, and on a verified site whose method is wp_plugin. Sorraia re-checks every verified site daily, and for wp_plugin that check fetches the token from the plugin, so the plugin must keep serving it for as long as it is connected; this is how it gets it back after a reinstall or a reconnect. A site verified with dns_txt or meta_tag does not get instructions. method is the method that last proved (or was chosen to prove) ownership: dns_txt, meta_tag, wp_plugin, or null if none has been picked. instructions.wp_plugin.paths lists the exact URLs this API will probe on the site, so a merchant behind a firewall can allowlist them.\",\"url\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status\",\"mainEntityOfPage\":{\"@id\":\"https://docs.sorraia.app/api-reference/site-verification/read-this-sites-domain-verification-status#webpage\"},\"dateModified\":\"2026-10-28T16:36:06.449Z\",\"publisher\":{\"@id\":\"https://docs.sorraia.app/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.sorraia.app#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Sorraia API\",\"publisher\":{\"@type\":\"Organization\",\"name\":\"Sorraia API\"},\"provider\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","agentPointerHref":"/api-reference/site-verification/read-this-sites-domain-verification-status.md","siteName":"Sorraia API","nav":{"global":null,"tabs":[{"tab":"Guides","pages":[{"title":"Guides","href":""}]},{"tab":"API Reference","groups":[{"group":"Overview","pages":[{"title":"API reference","href":"/api-reference/introduction"}]},{"group":"Endpoints","pages":[{"group":"forms","pages":[{"title":"List forms","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /forms","href":"/api-reference/forms/list-forms"},{"title":"Create a form","deprecated":null,"version":null,"openapi":"/api/openapi.yaml post /forms","href":"/api-reference/forms/create-a-form"},{"title":"Get a form","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /forms/{id}","href":"/api-reference/forms/get-a-form"},{"title":"Archive a form","deprecated":null,"version":null,"openapi":"/api/openapi.yaml delete /forms/{id}","href":"/api-reference/forms/archive-a-form"},{"title":"Update a form","deprecated":null,"version":null,"openapi":"/api/openapi.yaml patch /forms/{id}","href":"/api-reference/forms/update-a-form"}]},{"group":"submissions","pages":[{"title":"List a form's submissions","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /forms/{id}/submissions","href":"/api-reference/submissions/list-a-forms-submissions"},{"title":"Ingest a submission","deprecated":null,"version":null,"openapi":"/api/openapi.yaml post /forms/{id}/submissions","href":"/api-reference/submissions/ingest-a-submission"},{"title":"Get a submission","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /submissions/{id}","href":"/api-reference/submissions/get-a-submission"},{"title":"List submissions","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /submissions","href":"/api-reference/submissions/list-submissions"}]},{"group":"calendars","pages":[{"title":"List calendar widgets","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /calendar-widgets","href":"/api-reference/calendars/list-calendar-widgets"},{"title":"Get a calendar widget","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /calendar-widgets/{id}","href":"/api-reference/calendars/get-a-calendar-widget"}]},{"group":"bookings","pages":[{"title":"List a calendar's bookings","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /calendar-widgets/{id}/bookings","href":"/api-reference/bookings/list-a-calendars-bookings"},{"title":"Get a booking","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /bookings/{id}","href":"/api-reference/bookings/get-a-booking"},{"title":"List bookings","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /bookings","href":"/api-reference/bookings/list-bookings"}]},{"group":"ecommerce","pages":[{"title":"List shop widgets","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /ecommerce-widgets","href":"/api-reference/ecommerce/list-shop-widgets"},{"title":"Get a shop widget","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /ecommerce-widgets/{id}","href":"/api-reference/ecommerce/get-a-shop-widget"}]},{"group":"orders","pages":[{"title":"List a shop widget's orders","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /ecommerce-widgets/{id}/orders","href":"/api-reference/orders/list-a-shop-widgets-orders"},{"title":"Get an order","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /orders/{id}","href":"/api-reference/orders/get-an-order"},{"title":"List orders","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /orders","href":"/api-reference/orders/list-orders"}]},{"group":"webhooks","pages":[{"title":"List webhook subscriptions","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /webhooks","href":"/api-reference/webhooks/list-webhook-subscriptions"},{"title":"Subscribe to an event","deprecated":null,"version":null,"openapi":"/api/openapi.yaml post /webhooks","href":"/api-reference/webhooks/subscribe-to-an-event"},{"title":"Unsubscribe","deprecated":null,"version":null,"openapi":"/api/openapi.yaml delete /webhooks/{id}","href":"/api-reference/webhooks/unsubscribe"}]},{"group":"site-catalog","pages":[{"title":"List a site's embeddable widgets","description":"Every embeddable widget on ONE site — forms, booking calendars, shops, AI chat agents and WhatsApp launchers — shaped for a picker. This is the only operation that authenticates with a **site key** rather than an API key: pass the site's `sor_site_...` value in the `X-Sorraia-Site-Key` header. Find it in the Sorraia dashboard under Site → Embed.\n\nA site key grants this one read on its one site and nothing else. It cannot read submissions, bookings, orders or any other resource, and it is never accepted as an API key.\n\n`embedId` is the identifier that widget's embed URL actually takes: the numeric widget id for forms, calendars, shops and WhatsApp, and the string `publicId` for AI chat. Archived widgets are omitted entirely; paused widgets are listed with `paused: true`. There is no pagination — the full catalogue is returned, ordered by type then name.\n","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /site-catalog","href":"/api-reference/site-catalog/list-a-sites-embeddable-widgets"}]},{"group":"site-verification","pages":[{"title":"Read this site's domain-verification status","deprecated":null,"version":null,"openapi":"/api/openapi.yaml get /site-verification","href":"/api-reference/site-verification/read-this-sites-domain-verification-status"},{"title":"Verify this site's domain via the WordPress plugin","description":"Ask Sorraia to check the `wp_plugin` proof now. The method is fixed — this endpoint cannot trigger a `dns_txt` or `meta_tag` check — and the request takes no body.\n\nSorraia fetches the site's own registered hostname over HTTPS, trying `/?rest_route=/sorraia/v1/verify` then `/wp-admin/admin-ajax.php?action=sorraia_verify`, each with a cache-busting parameter, and looks for the site's verification token. Redirects are followed only within the registered hostname and its www/apex twin. On an exact token match the site is marked verified and its method is set to `wp_plugin`.\n\nThe site key never asserts verification — it only asks for the check to run. The token still has to be found at the hostname being claimed.\n\nRequires the Sorraia WordPress plugin to be installed and connected with this site's key. Not available on subdirectory installs or subdirectory multisite, where the plugin does not sit at the hostname root — use the DNS record there.\n","deprecated":null,"version":null,"openapi":"/api/openapi.yaml post /site-verification/attempt","href":"/api-reference/site-verification/verify-this-sites-domain-via-the-wordpress-plugin"}]}]}]}]},"basePath":"","title":"Read this site's domain-verification status - Sorraia API","buildId":"dpl_41S5Z2jG9QnfDRwN1KZrLdBwj7DM","deploymentId":"dpl_41S5Z2jG9QnfDRwN1KZrLdBwj7DM","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-DDP9JXtj.js","utils-8yQyvEtx.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-CBCFR8Sn.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-rQaXkUHa.js","snippetPresets-J5KpBTgV.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","conditional-requirements-CFM0id0Q.js","ApiExamples-BVxVH4Cj.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-BxdQ2vIi.js","shallow-BjV2tFiD.js","getApiPlaygroundDisplay-C_55tL4O.js","CodeSnippet-C0JpiCOC.js","CodeSnippets-w9Ps7djG.js","Page-DTNSD-0M.js","getPastedJson-BDfB-H8d.js","icon-g-kUkkO9.js","MethodPill-v4l6fq0h.js","DuplicateIcon-CvLo-CfU.js","createIcon-165clrrV.js","DynamicMarkdown-D3RQ-fEj.js","SectionHeading-vvo-3yLf.js","axios-vUo_bRtp.js","Markdown-CMT1uFWQ.js","clsx-C8f2yC9R.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-CI2D8R2Y.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-k78Wrw_e.js"]}