Verify AAO-hosted publisher origin
Trigger origin verification for an AAO-hosted publisher: fetches the publisher’s own /.well-known/adagents.json and checks for an authoritative_location field pointing at the AAO-hosted URL. On success, promotes agent_publisher_authorizations rows from source='aao_hosted' to source='adagents_json' for the manifest’s authorized agents — buyers reading the registry then see them as origin-attested.
Bind-on-verify: when the pointer carries an adcp_claim token (see the claim endpoint), a successful verification binds the domain to that claim’s organization and returns bound_org_id. Binding is driven by which token the origin pointer carries, never by who triggers verification, so any authenticated caller may trigger it and a squatter cannot bind a domain they don’t control. An existing verified owner is never overwritten.
Failure classification:
not_found: publisher origin returned 404 (permanent — demotes if previously verified).invalid_json/no_authoritative_location/authoritative_location_mismatch: publisher origin returned a parseable response that doesn’t satisfy the spec stub pattern (permanent — demotes).unresolvable: DNS NXDOMAIN, private IP, or non-http scheme (permanent — demotes).transient: 5xx / 429 / 3xx / network timeout (leaves persisted state alone, stampsorigin_last_checked_at).
Authorizations
Bearer token in the Authorization header. Two token types are accepted:
- Organization API key (
sk_...) issued via the dashboard. Org-scoped, long-lived, for server-to-server use. - User JWT obtained via the OAuth 2.1 authorization code flow with PKCE. User-scoped, short-lived. Discover the authorization server at
/.well-known/oauth-authorization-serverand the protected-resource metadata at/.well-known/oauth-protected-resource/api.
Path Parameters
"examplepub.com"