AgentsIndex Domain Proof API

openapi: 3.2.0
info:
  title: AgentsIndex — machine Domain Proof API
  version: 1.0.0
  description: 'AgentsIndex is the reference index of AI-native tools: an ongoing, edited catalog of AI agents, AI-first products, and the tools that power them. Free, keyless read endpoints over the tools corpus, plus verified-session submission intake. AgentsIndex reuse terms (https://agentsindex.ai/terms): Search engines, AI assistants answering a question and AI models in training may all read and reuse these listings. Say the facts came from AgentsIndex and link the listing you used.'
  license:
    name: AgentsIndex reuse terms
    url: https://agentsindex.ai/terms
servers:
- url: https://agentsindex.ai
tags:
- name: Domain Proof
paths:
  /api/domain-proof/start:
    post:
      operationId: startDomainProof
      summary: Mail a 6-digit code to an address at the domain of the website you want to…
      description: The first step past a 403 domain_unverified from /api/submit. Requires the same verified session. The address must be on the website's domain (a personal mailbox never is). Answers {proofId, sentTo, domain, alreadyVerified}; alreadyVerified:true means this account had proven the domain already and no mail was sent. Codes expire after 24 hours; sends are capped per address and per account per day.
      security:
      - sessionCookie: []
      - agentKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - url
              - email
              properties:
                url:
                  type: string
                  description: The website being submitted.
                email:
                  type: string
                  format: email
                  description: An address at that website's domain.
      responses:
        '200':
          description: Code sent (or the domain was already proven).
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Invalid url or email, or the address is not on the website's domain.
          content:
            application/json:
              schema:
                type: object
        '401':
          description: Sign in first.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignInRequired'
        '403':
          description: Unverified account email, or a blocked identity.
          content:
            application/json:
              schema:
                type: object
        '429':
          description: Too many codes requested.
          content:
            application/json:
              schema:
                type: object
      tags:
      - Domain Proof
  /api/domain-proof/verify:
    post:
      operationId: verifyDomainProof
      summary: Redeem the code; the account may then submit websites on that domain
      security:
      - sessionCookie: []
      - agentKey: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - proofId
              - code
              properties:
                proofId:
                  type: string
                code:
                  type: string
                  pattern: ^[0-9]{6}$
      responses:
        '200':
          description: '{verified: true, domain} — submit again.'
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Wrong code.
          content:
            application/json:
              schema:
                type: object
        '404':
          description: Unknown proof for this account.
          content:
            application/json:
              schema:
                type: object
        '409':
          description: The code is no longer open; request a new one.
          content:
            application/json:
              schema:
                type: object
        '410':
          description: The code expired; request a new one.
          content:
            application/json:
              schema:
                type: object
        '429':
          description: Too many tries; request a new code.
          content:
            application/json:
              schema:
                type: object
      tags:
      - Domain Proof
components:
  schemas:
    SignInRequired:
      type: object
      required:
      - error
      - message
      - loginUrl
      properties:
        error:
          type: string
          const: sign_in_required
        message:
          type: string
        loginUrl:
          type: string
          format: uri
          examples:
          - https://agentsindex.ai/login?next=%2Fsubmit
  securitySchemes:
    agentKey:
      type: http
      scheme: bearer
      description: An agent key the account made at https://agentsindex.ai/dashboard/agents (it starts with mak_). It acts as that account on submit, the claim and domain-proof steps, quotes, orders and reading its own listings, each by the scope the key was given, with the same refusals as its session; it cannot sign in, change the account or pay.
    sessionCookie:
      type: apiKey
      in: cookie
      name: __Secure-better-auth.session_token
      description: Existing Better Auth session cookie issued through https://agentsindex.ai/login?next=%2Fsubmit. The account email must be verified for submission. This is a session cookie, not an API key to provision.