Apple Pay Domains

Verify a domain

Re-verify a pending or failed domain, for example a row created before a mode switch or a failed sf_operated attempt. A domain that is already verified returns 409 with the classifier DOMAIN_NOT_RETRIABLE.

On self_managed instances the domain is marked verified immediately, trusting your own attestation of domain ownership to Apple. On sf_operated instances Guardian schedules a background verification against Apple’s Web Merchant Registration API using the platform integrator identity; if the attempt cannot be scheduled, the request returns 503 with the classifier ENQUEUE_FAILED.

POST

api

wallet

apple-pay

domains

{id}

verify

Verify a domain

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "3d7f1b5a-9c4e-4f2d-b8a6-1e5c9d3b7f4a",
  "domain": "pay.example.com",
  "state": "verified",
  "created_at": "2026-02-01T09:15:00Z",
  "last_verified_at": "2026-02-05T11:00:00Z"
}

{
  "code": 400,
  "message": "The request could not be handle due to invalid data",
  "classifier": "BAD_REQUEST"
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 404,
  "message": "The requested resource was not found.",
  "classifier": "NOT_FOUND"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}

{
  "code": 503,
  "message": "Service unavailable",
  "classifier": "SERVICE_UNAVAILABLE"
}

Authorizations

Authorization

string

header

required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Path Parameters

string<uuid>

required

The ID of the domain to verify.

Response

Success response

string<uuid>

required

Example:

"3d7f1b5a-9c4e-4f2d-b8a6-1e5c9d3b7f4a"

domain

string

required

Example:

"pay.example.com"

state

enum<string>

required

Available options:

pending,

verified,

failed

Example:

"verified"

created_at

string<date-time>

required

Example:

"2026-02-01T09:15:00Z"

last_verified_at

string<date-time> | null

Example:

"2026-02-05T11:00:00Z"

⌘I

Verify a domain

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/domains/{id}/verify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "id": "3d7f1b5a-9c4e-4f2d-b8a6-1e5c9d3b7f4a",
  "domain": "pay.example.com",
  "state": "verified",
  "created_at": "2026-02-01T09:15:00Z",
  "last_verified_at": "2026-02-05T11:00:00Z"
}

{
  "code": 400,
  "message": "The request could not be handle due to invalid data",
  "classifier": "BAD_REQUEST"
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 404,
  "message": "The requested resource was not found.",
  "classifier": "NOT_FOUND"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

{
  "code": 422,
  "classifier": "VALIDATION_ERROR",
  "message": "Validation error",
  "validation_errors": [
    {
      "path": "json-path",
      "message": "human readable error message"
    }
  ]
}

{
  "code": 503,
  "message": "Service unavailable",
  "classifier": "SERVICE_UNAVAILABLE"
}

Getting Started

Tokens

Metadata

Admin

Verify a domain

Authorizations

Path Parameters

Response