Skip to content

Update org domain defaults

PATCH /org-domain/{id}

Merge-patch: omit a field to leave it alone, send `null` to clear it. `default_role_id` is the role granted on domain auto-join — Org Owner is refused, since that would auto-elevate anyone with an address on the domain. `sso_connection_id` must name an SSO connection in this organization. Requires `org:manage`. A BROWSER SESSION must additionally carry a fresh step-up reauthentication (`X-Step-Up-Token`, obtained from `/auth/step-up`); without one the call answers `428 step_up_required` and `error.details` names the action and resource to prove. An organization API token is not challenged: step-up re-proves the person behind a session, and a token has no person behind it. It is gated because a verified domain and an SSO connection are DEFERRED membership grants: they admit a principal with no actor present at the moment they fire, which is `POST /invite` with a longer fuse.

Path Parameters

idstring
required·

Org domain id.

Request Body

default_role_idstring,null

Role id (role_…), or null to clear.

sso_connection_idstring,null

SSO connection id (sso_…), or null to unlink.

Response Body

created_atstring · date-time
default_role_idstring,null

Role (role_…) explicitly configured for domain auto-join, or null to track the default. Org Owner is refused here. Read effective_default_role_id to learn what a join actually grants.

domainstring

DNS name, lowercased (e.g. acme.com).

effective_default_role_idstring,null

Server-computed: the role a verified-domain auto-join really grants. Equals default_role_id when that is set and the role still exists; otherwise the Member system role, which is what the join falls back to both when nothing is configured and when the configured role has since been deleted. null means even that fallback is missing, so auto-join on this domain fails rather than seating anyone.

idstring

Org domain id.

organization_idstring

Owning organization (org_…).

sso_connection_idstring,null

Linked SSO connection (sso_…).

updated_atstring · date-time
verification_recordstring,null

The exact DNS TXT value to publish. Present until the domain is verified, then null — the token is of no further use.

verifiedboolean
curl -X PATCH 'https://api.elaichi.ai/org-domain/<id>' \
  -H 'Authorization: Bearer $ELAICHI_API_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{}'
const body = {};

const response = await fetch('https://api.elaichi.ai/org-domain/<id>', {
  method: 'PATCH',
  headers: {
    'Authorization': 'Bearer ' + process.env.ELAICHI_API_TOKEN,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify(body),
});

const data = await response.json();
console.log(data);
import os
import requests

url = "https://api.elaichi.ai/org-domain/<id>"
headers = {
    "Authorization": f"Bearer {os.environ['ELAICHI_API_TOKEN']}",
    "Content-Type": "application/json",
}
payload = {}

response = requests.patch(url, headers=headers, json=payload)
print(response.json())