Skip to main content
Deprecated. This page documents the v2 buyer API, which is closed to new API clients and switches off on 1 December 2026. Use V3 instead: see Move a v2 buyer REST integration to V3. The conversion endpoint, Log event, stays open.
Real buyer operations require proof that your organization controls its confirmed operator domain. This is separate from choosing the operator domain and the account’s operating-unit code. An account administrator confirms that identity in Buyer Setup or with PATCH /api/v2/buyer/readiness/operator. An active account member with an email address at the exact operator domain proves it automatically. For a child account, an active member of its parent account also counts. Signing in to a different account does not prove the claim. A Scope3 SuperAdmin can instead review and approve the exact saved buyer operator domain. That approval does not change sign-in access, account membership, the account’s registered login domain, or the account’s operating-unit code. Only one organization can verify a domain. Once an organization has verified a domain, no other organization’s account is proved on it, by member email, a DNS record or a review; ask Apostra for a staff review if your organization operates as that domain. A DNS TXT record is another way to provide proof. In the account’s domain settings, choose Verify with a DNS record, publish the record Apostra shows, and check it. See Which domain is which for the record and how it is checked. The manual review path below lets the Apostra team follow up when neither account membership nor a DNS record fits. These paths add proof without changing the operating-unit code, organization membership, or billing company.
Verify via AAO is retired. POST /api/v2/buyer/readiness/operator/verify and POST /api/v2/accounts/{customerId}/domain/verify answer 410 Gone and point to the DNS record and manual review. An approval made earlier through AAO stays valid.

​
Verify with a DNS record

Two calls on the account whose registered domain you are proving. The caller needs the ADMIN role on the account, directly or as an admin of its organization. POST /api/v2/accounts/{customerId}/domain/dns-verification starts the check and returns the TXT record to publish. Calling it again returns the same record until the registered domain changes.
curl
POST /api/v2/accounts/{customerId}/domain/dns-verification/check reads the record from DNS. When it finds the exact value, the registered domain is approved and state is verified. Otherwise state stays pending and the response repeats the record. For an organization that claims a domain, the check proves the claimed domain, and proving it makes the claim the organization’s registered domain. See Your organization’s domain.

​
Errors

  • 400 VALIDATION_ERROR — the account has no registered domain, or the check ran before the record was started.
  • 403 ACCESS_DENIED — the caller is not an admin of the account.
  • 409 CONFLICT — the registered domain changed during the check. Start again for the new domain.
  • 429 RATE_LIMITED — the account was checked a few seconds ago. Wait and check again.

​
Request manual review

POST /api/v2/buyer/readiness/operator/verify-request Submits a manual verification request. Use this path when you’re an agency or consultant claiming a client domain that doesn’t match your work email. Your request has been recorded. A member of Apostra team will follow up with you at the email address you provided.
curl

​
Parameters

​
Response

Returns 202 Accepted:

​
Errors

  • 400 VALIDATION_ERROR — missing or malformed fields.
  • 401 UNAUTHORIZED — missing or invalid bearer token.

Buyer setup and go-live

Confirm the operator domain and the account’s operating-unit code before proving control of the operator domain.

Account tasks

All account operations