Skip to main content
GET
Read this site's domain-verification status

Authorizations

X-Sorraia-Site-Key
string
header
required

A per-site key (sor_site_...), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — GET /site-catalog, GET /site-verification and POST /site-verification/attempt — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and Authorization: Bearer will not accept it.

It is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.

Response

The site's verification status.

domain
string
required

The registered hostname, e.g. example.com.

verified
boolean
required

Whether ownership of the hostname is currently proven.

method
enum<string> | null
required

How ownership was last proven, or the method chosen at registration. null if none has been picked.

Available options:
dns_txt,
meta_tag,
wp_plugin,
null
methods
string[]
required

Every verification method this API supports.

verifiedAt
string<date-time> | null

When ownership was last proven. Cleared if verification lapses.

lastCheckedAt
string<date-time> | null

When Sorraia last looked, whether or not the check passed. Distinct from verifiedAt, which only moves on success.

instructions
object

How to prove ownership, for each method. Present only while the site is unverified — it carries the verification token.