Outcome
Reads the requested domain’s DNS ownership and routing records, then requests Cloudflare custom-hostname provisioning and reads hostname and SSL state. Active fixture responses do not prove deployed origin or certificate readiness.
Before you start
- Verify identity and the intended environment with topolo whoami before selecting an explicitly authorized organization.
- Discover the published workspace:write permission.
- Discover an accessible Blog workspace and set WORKSPACE_ID to that exact returned id. Pass workspace binding separately from action input.
- Review the actual state change and confirm the unchanged plan before execution. Fixture ids and provider responses grant no live authority.
Discover the target
topolo whoami --json
topolo actions get app_topolo_blog.domains.verify --detail --json
topolo workspaces list topolo-blog --json
- domainId: Exact workspace domain id from domains.list or domains.create.
Request
POST /api/domains/{domainId}/verify
Inspect parameters and test this action.
Input fields
| Field | Required | Meaning |
|---|---|---|
domainId | Yes | Exact workspace domain id from domains.list or domains.create. |
Worked examples
Documentation source snapshot: TopoloBlog 80d6961207a4ca688b7e9edb947dda720051ad32 (tree 534a285e739a27c1ea9e2c187ce8863824f6c590). The examples retain local fixture captures labeled baseline 2c64c35bf291a47bb3a0c597dcea46ccb47e2a08; their exact executed working tree is not established here. They were not rerun at this documentation snapshot. The production catalog marker topolo.app.json is not a deployed worker revision. Recovery metadata read-back on 18 October 2026 associates the current production Blog API and web deployments with this source through the 17 October release receipt. This establishes applicable deployed source; it does not make these examples current production captures.
Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.
Save a reviewed input as payload.json. Replace fixture identifiers using discovery in the authorized context.
topolo actions validate app_topolo_blog.domains.verify --data @payload.json --json
topolo actions plan app_topolo_blog.domains.verify --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --json
topolo actions call app_topolo_blog.domains.verify --resource-type workspace --resource-id "$WORKSPACE_ID" --data @payload.json --confirm --detail --json
MCP uses the same reviewed input. Replace the synthetic workspace resourceId through discovery when a binding is shown:
{
"tool": "topolo_prepare_action",
"arguments": {
"actionId": "app_topolo_blog.domains.verify",
"input": {
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
},
"resourceType": "workspace",
"resourceId": "ws_blog_fixture",
"confirm": true
}
}
{
"tool": "topolo_call_action",
"arguments": {
"actionId": "app_topolo_blog.domains.verify",
"input": {
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
},
"resourceType": "workspace",
"resourceId": "ws_blog_fixture",
"confirm": true,
"detail": true
}
}
Refused request · HTTP 422 · dns_records_missing
Input · payload.json:
{
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
}
Source-reviewed illustration (retained local fixture response; not a current production capture):
{
"error": "dns_records_missing",
"message": "Add CNAME blog.example.com → blog.fixture and TXT _topolo-verification.blog.example.com = topolo-verification=2493d416-1a48-40f6-b2a5-3dbdbedd355c."
}
Read the handler error and returned DNS instructions. Install the exact ownership and routing records before verifying again.
Successful response · HTTP 200
Input · payload.json:
{
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
}
Source-reviewed illustration (retained local fixture response; not a current production capture):
{
"domain": {
"id": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864",
"workspaceId": "ws_blog_fixture",
"hostname": "blog.example.com",
"status": "active",
"verificationToken": "2493d416-1a48-40f6-b2a5-3dbdbedd355c",
"dnsTarget": "blog.fixture",
"records": [
{
"purpose": "routing",
"type": "CNAME",
"host": "blog",
"name": "blog.example.com",
"value": "blog.fixture",
"required": true,
"instruction": "Publish a CNAME from blog to blog.fixture. Leave MX, SPF, and DKIM records unchanged."
},
{
"purpose": "ownership",
"type": "TXT",
"host": "_topolo-verification.blog",
"name": "_topolo-verification.blog.example.com",
"value": "topolo-verification=2493d416-1a48-40f6-b2a5-3dbdbedd355c",
"required": true,
"instruction": "Publish a TXT record at _topolo-verification.blog.example.com with this exact value. Leave every other TXT record unchanged."
}
],
"createdAt": "2026-10-06T07:31:34.327Z",
"updatedAt": "2026-10-06T07:31:34.428Z"
}
}
Call domains.list and confirm the hostname is pending_ssl or active.
Refused request · HTTP 404 · domain_not_found
Input · payload.json:
{
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
}
Source-reviewed illustration (retained local fixture response; not a current production capture):
{
"error": "domain_not_found"
}
Re-discover the exact identifier through its permitted list in the same workspace; do not guess ids.
Refused request · HTTP 401 · auth_error
Input · payload.json:
{
"domainId": "domain_8e1e5047-91bf-4ae4-8ff3-974606947864"
}
Source-reviewed illustration (retained local fixture response; not a current production capture):
{
"error": "Authentication token required"
}
Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.
Verify the result
- Call domains.list and confirm the hostname is pending_ssl or active.
Errors and recovery
- HTTP 422 ·
dns_records_missing: Read the handler error and returned DNS instructions. Install the exact ownership and routing records before verifying again. - HTTP 404 ·
domain_not_found: Re-discover the exact identifier through its permitted list in the same workspace; do not guess ids. - HTTP 401 ·
auth_error: Sign in again in the intended environment using a valid credential. Preserve the returned handler message; SDK auth_error can represent several authentication refusals.
Inspect the raw handler error as well as the SDK code. These examples establish observed local refusals, not every possible provider failure.
Recovery boundary
Disconnect the hostname if it was attached in error.
Related actions
- Disconnect workspace domain: Remove a Blog workspace domain and detach its edge hostname.
Evidence
Actual exported Blog Worker, local Miniflare D1/R2 and all committed migrations. Auth, Insights, DNS, Cloudflare for SaaS, error reporting, queue and scheduled-workflow boundaries are synthetic and outbound fetch is sealed. No deployed provider, delivery or scheduled execution outcome is established. English examples use the packaged test translation release; article checks and widget labels follow the verified request locale. No live translation release is proved by this fixture.
Documentation history
18 October 2026: Architecture reviewed the retained action guide against the pinned source declaration and named implementation boundaries, qualified local-capture provenance, and prepared paired human and agent amendments. This review does not record a product release, new fixture execution or publication.
2026-10-18: Architecture accepted the paired coauthor delta and qualified the current 80D deployment association from existing Recovery evidence. Examples remain source-reviewed retained-fixture illustrations; no new execution or guide publication is recorded.