Request an EPP code

Read full description Hide full description

Request an authorization code for transferring the domain away. When a fresh code is returned immediately, eppCode contains it and codeSource is fresh_request. If the domain recently had a fresh code generated, the endpoint returns the current code without rotating it, sets codeSource to recent_request, and includes generatedAt; send forceNew: true to rotate again. If a fresh code cannot be generated but the current code is still available, eppCode contains that code, codeSource is current_code, and requestSubmitted is false. If no code is available for an expired or deleted domain, the endpoint returns 409 epp_code_unavailable.

Domains & DNS Domains

Authentication

Required API scopes: read:domainstransfer:domains

Use Authorization: Bearer <token> for API keys. Dashboard sessions may also use hostup_session.

Context

Related endpoints

POST /api/v2/domains/{id}/actions/renew Renew a domain POST /api/v2/domains/{id}/actions/update-epp Save EPP code for transfer POST /api/v2/domains/{id}/actions/status-sync Sync domain status from registry

Path Parameters

id string required Example: dom_01hxa3b4c5d6e7f8g9h0j1k2m3

Public domain ID. Get it from GET /api/v2/domains `data[].id`. Do not invent this value; use the exact ID returned by the referenced API response.

Headers

Accept Example

Content-Type Example

Body

required

application/json

forceNew boolean

When true, bypasses the recent-code reuse window and asks the registrar to generate a new transfer code.

Responses

200 EPP request result.

domainId string required · Example: dom_01hxa3b4c5d6e7f8g9h0j1k2m3

requestSubmitted boolean required · Example: true

True when a fresh EPP/auth-code request was accepted. False when the endpoint returned the existing code from a recent request or provider fallback.

deliveryMethod string · enum required · Example: unknown

`registry_console` means the caller should check the registry/account console. `unknown` means the API has no delivery channel; use `eppCode` if present.

registry_console

unknown

codeSource string · enum · Example: fresh_request

Present when `eppCode` is returned. `fresh_request` means the code came from a successful fresh-code request; `recent_request` means the code was recently generated and reused without rotation; `current_code` means the endpoint returned the current code because a fresh code could not be generated.

fresh_request

recent_request

current_code

generatedAt stringnull · Example: 2026-06-16T17:30:00.000Z

Time when the returned transfer code was generated, when known.

eppCode stringnull required · Example: EPP-AUTH-CODE-1234

EPP/auth code when the endpoint can return one directly; otherwise null.

400 Invalid request. The response body is an RFC 7807 Problem Details document.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

401 Unauthorized. Authentication is required.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

403 Forbidden. The caller lacks a required scope or does not own the resource.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

404 Not found. The resource does not exist or is not owned by the caller.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

409 A transfer code cannot be generated or retrieved in the current domain state.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

429 Rate limited. Retry after the limit resets. 429 responses include `Retry-After` seconds plus `X-RateLimit-*` headers.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

500 Internal error. Retry later or contact support if the issue persists.

type string · Example: https://developer.hostup.se/errors/invalid_request

title string · Example: Validation failed

status integer · Example: 400

detail string · Example: The request body failed validation.

code string · Example: invalid_request

Stable machine-readable code. Branch on this field, not on `detail`.

instance string · Example: /api/v2/orders

requestId string · Example: req_01hxa3b4c5d6e7f8g9h0j1k2m3

timestamp string · Example: 2026-04-27T12:34:56.000Z

errors array<object>

Field-level validation errors when `code` is `invalid_request`.

errors[].pointer string required · Example: /items/0/eppCode

errors[].detail string required · Example: `eppCode` is required for this transfer.

errors[].code string required · Example: missing_required

extensions object

POST https://cloud.hostup.se/api/v2/domains/{id}/actions/request-epp

For AI assistants

View as Markdown

cURL

curl -X POST "https://cloud.hostup.se/api/v2/domains/dom_01hxa3b4c5d6e7f8g9h0j1k2m3/actions/request-epp" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

Response

{
  "domainId": "dom_01hxa3b4c5d6e7f8g9h0j1k2m3",
  "requestSubmitted": true,
  "deliveryMethod": "unknown",
  "codeSource": "fresh_request",
  "generatedAt": "2026-06-16T17:30:00.000Z",
  "eppCode": "EPP-AUTH-CODE-1234"
}

{
  "type": "object",
  "properties": {
    "domainId": {
      "type": "string"
    },
    "requestSubmitted": {
      "type": "boolean",
      "description": "True when a fresh EPP/auth-code request was accepted. False when the endpoint returned the existing code from a recent request or provider fallback."
    },
    "deliveryMethod": {
      "type": "string",
      "description": "`registry_console` means the caller should check the registry/account console. `unknown` means the API has no delivery channel; use `eppCode` if present.",
      "enum": [
        "registry_console",
        "unknown"
      ]
    },
    "codeSource": {
      "type": "string",
      "description": "Present when `eppCode` is returned. `fresh_request` means the code came from a successful fresh-code request; `recent_request` means the code was recently generated and reused without rotation; `current_code` means the endpoint returned the current code because a fresh code could not be generated.",
      "enum": [
        "fresh_request",
        "recent_request",
        "current_code"
      ]
    },
    "generatedAt": {
      "type": [
        "string",
        "null"
      ],
      "description": "Time when the returned transfer code was generated, when known."
    },
    "eppCode": {
      "type": [
        "string",
        "null"
      ],
      "description": "EPP/auth code when the endpoint can return one directly; otherwise null."
    }
  }
}

Request Body

{
  "forceNew": true
}