Verify AAO-hosted publisher origin

Trigger origin verification for an AAO-hosted publisher: fetches the publisher’s own /.well-known/adagents.json and checks for an authoritative_location field pointing at the AAO-hosted URL. On success, promotes agent_publisher_authorizations rows from source='aao_hosted' to source='adagents_json' for the manifest’s authorized agents — buyers reading the registry then see them as origin-attested.

Requires authentication and either AAO admin OR org-membership matching the hosted property’s owner. Fail-closed on NULL ownership.

Failure classification:

• not_found: publisher origin returned 404 (permanent — demotes if previously verified).
• invalid_json / no_authoritative_location / authoritative_location_mismatch: publisher origin returned a parseable response that doesn’t satisfy the spec stub pattern (permanent — demotes).
• unresolvable: DNS NXDOMAIN, private IP, or non-http scheme (permanent — demotes).
• transient: 5xx / 429 / 3xx / network timeout (leaves persisted state alone, stamps origin_last_checked_at).

POST /api/properties/hosted/{domain}/verify-origin

Verify AAO-hosted publisher origin

cURL

curl --request POST \
  --url https://agenticadvertising.org/api/properties/hosted/{domain}/verify-origin \
  --header 'Authorization: Bearer <token>'

200

{
  "verified": true,
  "checked_at": "<string>",
  "detail": "<string>"
}

Authorizations

bearerAuthoauth2

Authorization · string · header · required

Bearer token in the Authorization header. Two token types are accepted:

• Organization API key (sk_...) issued via the dashboard. Org-scoped, long-lived, for server-to-server use.
• User JWT obtained via the OAuth 2.1 authorization code flow with PKCE. User-scoped, short-lived. Discover the authorization server at /.well-known/oauth-authorization-server and the protected-resource metadata at /.well-known/oauth-protected-resource/api.

Path Parameters

domain · string · required

Example:

"examplepub.com"

Response

200

application/json

Verification outcome

verified · boolean · required

reason · enum<string> · required

Available options: authoritative_location_pointer, not_found, invalid_json, no_authoritative_location, authoritative_location_mismatch, unresolvable, transient

checked_at · string · required

detail · string