Skip to main content
POST
Verify this site's domain via the WordPress plugin

Authorizations

X-Sorraia-Site-Key
string
header
required

A per-site key (sor_site_...), shown on the site's Embed card in the dashboard (Site → Embed) and regenerable there. It authorises three operations for the single site it belongs to — GET /site-catalog, GET /site-verification and POST /site-verification/attempt — and nothing else. It is NOT an API key: it carries no scopes, reads no customer data, and Authorization: Bearer will not accept it.

It is not purely read-only: the attempt endpoint can mark the site's domain verified. It does so only by asking Sorraia to fetch the site's verification token back from the registered hostname — the key proves account access, never hostname control, so it cannot claim a domain it cannot serve the token from.

Response

Verified.

domain
string
required
verified
boolean
required

Always true — a failed check returns 400.

method
string
required

Always wp_plugin from this endpoint.

verifiedAt
string<date-time>
lastCheckedAt
string<date-time>