curl --request POST \
--url https://api.sorraia.app/v1/site-verification/attempt \
--header 'X-Sorraia-Site-Key: <api-key>'import requests
url = "https://api.sorraia.app/v1/site-verification/attempt"
headers = {"X-Sorraia-Site-Key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Sorraia-Site-Key': '<api-key>'}};
fetch('https://api.sorraia.app/v1/site-verification/attempt', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sorraia.app/v1/site-verification/attempt",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Sorraia-Site-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sorraia.app/v1/site-verification/attempt"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Sorraia-Site-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sorraia.app/v1/site-verification/attempt")
.header("X-Sorraia-Site-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sorraia.app/v1/site-verification/attempt")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Sorraia-Site-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"domain": "<string>",
"verified": true,
"method": "<string>",
"verifiedAt": "2023-11-07T05:31:56Z",
"lastCheckedAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>",
"code": "wp_plugin_fetch_failed",
"method": "<string>",
"attempts": [
{
"path": "<string>",
"ok": true,
"reason": "<string>"
}
]
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Verify this site's domain via the WordPress plugin
Ask Sorraia to check the wp_plugin proof now. The method is fixed — this endpoint cannot trigger a dns_txt or meta_tag check — and the request takes no body.
Sorraia fetches the site’s own registered hostname over HTTPS, trying /?rest_route=/sorraia/v1/verify then /wp-admin/admin-ajax.php?action=sorraia_verify, each with a cache-busting parameter, and looks for the site’s verification token. Redirects are followed only within the registered hostname and its www/apex twin. On an exact token match the site is marked verified and its method is set to wp_plugin.
The site key never asserts verification — it only asks for the check to run. The token still has to be found at the hostname being claimed.
Requires the Sorraia WordPress plugin to be installed and connected with this site’s key. Not available on subdirectory installs or subdirectory multisite, where the plugin does not sit at the hostname root — use the DNS record there.
curl --request POST \
--url https://api.sorraia.app/v1/site-verification/attempt \
--header 'X-Sorraia-Site-Key: <api-key>'import requests
url = "https://api.sorraia.app/v1/site-verification/attempt"
headers = {"X-Sorraia-Site-Key": "<api-key>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {'X-Sorraia-Site-Key': '<api-key>'}};
fetch('https://api.sorraia.app/v1/site-verification/attempt', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sorraia.app/v1/site-verification/attempt",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"X-Sorraia-Site-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.sorraia.app/v1/site-verification/attempt"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("X-Sorraia-Site-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sorraia.app/v1/site-verification/attempt")
.header("X-Sorraia-Site-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sorraia.app/v1/site-verification/attempt")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["X-Sorraia-Site-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"domain": "<string>",
"verified": true,
"method": "<string>",
"verifiedAt": "2023-11-07T05:31:56Z",
"lastCheckedAt": "2023-11-07T05:31:56Z"
}{
"error": "<string>",
"code": "wp_plugin_fetch_failed",
"method": "<string>",
"attempts": [
{
"path": "<string>",
"ok": true,
"reason": "<string>"
}
]
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}{
"error": "<string>",
"code": "<string>"
}Authorizations
A per-site key (sor_site_...), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — GET /site-catalog, GET /site-verification and POST /site-verification/attempt — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and Authorization: Bearer will not accept it.
It is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.