# Re-apply a managed connection's desired records (async one-click, no re-consent)

> reapply connection: reference page for this CustomDomain™ API operation in the connections group. Covers parameters, request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/connections/reapplyConnection

## `POST https://api.customdomain.ai/v1/connections/{id}:reapply`

**Managed mode only.** Recomputes the connection's authoritative desired record set and writes any drift through the provider's async one-click API using the stored, encrypted grant (the provider API base pinned at onboarding), or, for a connection managed through a provider sign-in, through the provider's DNS API with the kept credential (a refresh token is rotated first when the access token has expired); the end user does **not** re-consent. On success the connection is re-verified and `connection.records.updated` is emitted. A failure emits `connection.reapply.failed`; if the provider reports the grant was revoked (401 kill-switch, or a refused refresh token) the grant is cleared and the connection is flagged for re-consent (a sign-in grant leaves `error_code` `oauth_reconnect_needed`).

A domain kept by a continuous provider account (and no kept grant) is re-applied with the account's key: the records CustomDomain™ wrote for the domain are written back and the receipt says `via: provider_account`. A domain whose records CustomDomain™ did not write is refused with `409`, since re-applying would write records nobody put there. The same webhooks are sent.

A delegated agent token needs `domains:connect`. Each of its calls that reached a write (the account's, the kept grant's or CustomDomain™'s own zone's), whatever the answer, is recorded as `agent.acted` ("re-applied a domain's records") for the grant, since a provider that refuses can have changed some record sets; one refused before anything was sent (nothing applied for the domain, a domain not managed or being removed, a rail or an account that is unavailable) leaves no row.

A widget token must be the connection's end user: a connection that names another end user than the token's `end_user_ref`, or names one while the token names none, answers `403` `token_wrong_end_user` before anything is written, and a connection that names none is the token's as before. An API key, an app-scoped token and a delegated agent token are not limited by it.

### Authentication

`widgetJWT`, `apiKey`, `agentToken`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | Re-applied (records updated). NOTE: this is a re-apply RECEIPT, not a connection object; it carries `connection_id` rather than the connection's own `id`, and none of the other connection fields. Fetch `GET /connections/{id}` if you need the connection itself. |
| `400` | Error envelope: {code, title, details}. |
| `401` | Error envelope: {code, title, details}. |
| `403` | `token_wrong_end_user` (a widget token: the connection names another end user, or names one while the token names none; nothing is written), `forbidden`, or `workspace_suspended` (see the `ForbiddenOrSuspended` response). |
| `404` | Error envelope: {code, title, details}. |
| `409` | The connection is not managed, has no stored grant, or the grant was revoked (re-consent required); or a provider account keeps it and CustomDomain™ did not write its records, or the account holds no usable key |
| `422` | The provider refused the provider account's key (`ProviderAuthenticationError`) or the write (`dns_write_failed`) |
| `503` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `connection_id` | string | yes | The connection the re-apply ran against (the `{id}` path parameter). |
| `reapplied` | boolean | yes | Always `true` on a `200`: the provider accepted the write for every template in the grant's bundle. Failures are reported as `409` (not managed / grant revoked), `422` (a provider account's key or write refused), `503` (managed rail unavailable) or `500`, never as `reapplied: false`. |
| `via` | `provider_account` | no | `provider_account` when a continuous provider account's key wrote the records; omitted for a kept grant or a zone CustomDomain™ hosts. |
| `records` | array of object | yes | The authoritative desired record set as recomputed and written: the materialized template records for a template bundle, the records CustomDomain™ wrote for a provider account, otherwise the connection's default desired set. |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.