# Check an account's key now

> Check an account's key now: CustomDomain™ API reference in the provider accounts group. Covers request parameters, the request body, responses and error codes.

Source: https://docs.customdomain.ai/docs/api-reference/provider-accounts/checkProviderAccount

## `POST https://api.customdomain.ai/v1/provider-accounts/{id}:check`

Reads the account's key against its provider right now: the same one cheap call as the daily check (the provider's domain list where it gives one, else a read of one domain the account covers), and its verdict is recorded the same way. Nothing is written at the provider. The answer is the account, with its `health`, and `result`: `ok` (the provider accepted the key), `refused` (the provider refused it: the account is now `needs_reconnect`, with a timeline event for each domain it covers and an inbox item, once), or `unreachable` (the provider could not be asked or answered with an error that is not a refusal; `message` says what, and the failure counts toward the backoff and toward `needs_you` `check_failed`).

A pasted key the provider had refused that works again returns to `active`, recorded in the audit log as `provider_account.updated` (`status` before and after, `via` `check_now`). A key a secure sign-in made keeps its status: it is renewed by signing in again.

Every check that asked the provider is recorded in the audit log as `provider_account.checked`: who asked (`actorId`), the account (`target`), the `provider` and the `result` (`ok`, `refused` or `unreachable`), never the key and never the provider's own words. It is written whatever happens to the verdict afterwards, so a check whose verdict was dropped (`409` because the account changed while the provider answered) is on record too. A call that never asked the provider (a `403`, a `429`, a `409` because the account is a one time key, holds no key or has nothing to read the key against, or a request that ended before the provider was asked, which answers `503`, gives its minute back and spends nothing from the hourly budget of reach checks) writes nothing.

Takes the workspace's API key and an admin, an owner or the member who connected the account (`403` otherwise). A key an end user's own sign-in made is never used for it (`403`), and a one time key is used once and never checked (`409`). An account whose provider cannot list its domains and which covers none answers `409` `nothing_to_check`. One check a minute for an account: a second answers `429` `rate_limited` with `Retry-After: 60`. Each check is also one read of the workspace's hourly budget of reach checks: once it is spent the call answers `429` `reach_quota` with `Retry-After`, asks the provider nothing, records nothing and keeps no minute, so the same account can be checked as soon as the hour turns. The daily check is outside that budget.

### Authentication

`apiKey`

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `id` | path | string | yes |  |

### Responses

| Status | Description |
| --- | --- |
| `200` | The account after the check, and what the check found. |
| `401` | Error envelope: {code, title, details}. |
| `403` | Error envelope: {code, title, details}. |
| `404` | Error envelope: {code, title, details}. |
| `409` | The account holds no key, it is a one time account, nothing could be read the key against (`nothing_to_check`), or it changed while it was checked |
| `429` | `rate_limited`: this account's key was checked less than a minute ago (`Retry-After: 60`), or `reach_quota`: the workspace has made as many reach checks at providers as it may this hour (`Retry-After` is the seconds until the hour ends). |
| `503` | Error envelope: {code, title, details}. |

### `200` response body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `account` | object | yes |  |
| `result` | `ok`, `refused`, `unreachable` | yes | What the check found. |
| `message` | string | no | For `unreachable`, the provider's own words, on one line. |

The full specification is served at `GET https://api.customdomain.ai/v1/openapi.json`.