Build the one-click apply URL (sync) or start the managed async rail

Server URLloading...

POST

/connections/{id}/domainconnect:start

Send

Authorization

Path

Body

Rail A (one-click sync-redirect) by default. service_id may be omitted when a default/sole template is loaded; the response carries the provider-hosted apply_url, the resolved service_id, and the discovered dc_provider name. Set managed: true (or rail: "async") to request the managed async rail instead. When the provider supports it the response carries a consent_url and rail: "async" (and the grant lets the control plane re-apply / revert server-side without re-consent). service_ids (plural) bundles several templates under one managed consent (async only; the OAuth scope is the space-separated list and the callback applies each); on the sync fallthrough only the first template applies.

Either rail is offered only when the DNS provider holds the exact template: the control plane runs the Domain Connect template check against the provider's API first (remembered for a few minutes), and a provider that has not onboarded it is refused with a 503 that names it. A root domain uses apex-a (an A record to the edge address, which needs APEX_A_TARGETS). Our templates point domains at the edge, so a domain routed to your own infrastructure is refused with 422 custom_routing. The sync apply_url carries a signed redirect_uri back to /connect/dc/return/{state} whenever the template allows it; pass return_origin on a sync start to have that return page post the outcome to your page.

A widget JWT starts either rail for its own application's connections (a domain-bound token for its own domain only); an API key for a connection of any application in its tenant, and a member's key needs a role that operates apps.

A delegated agent token needs domains:connect and starts the setup of its own application's connections.

A widget token must be the connection's end user: a connection that names another end user than the token's end_user_ref, or names one while the token names none, answers 403 token_wrong_end_user before anything is read or changed, and a connection that names none is any token's. An API key, an app-scoped token and a delegated agent token are not limited by it.

Path Parameters

Response Body

curl -X POST "https://example.com/connections/string/domainconnect:start" \  -H "Content-Type: application/json" \  -d '{}'

{  "apply_url": "http://example.com",  "consent_url": "http://example.com",  "service_id": "string",  "service_ids": [    "string"  ],  "dc_provider": "string",  "rail": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}