---
title: "Outbound domains"
description: "The outbound domains endpoints of the HTTP API."
---

> Documentation Index
> Fetch the complete documentation index at: https://slashobserve.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Outbound domains

## GET /outbound-domains

List the domains the server may fetch content from.

The list is empty until a person allows a domain. When `SLASHOBSERVE_OUTBOUND_DOMAINS` is set, `managed_by` is `config`, the entries come from the setting and carry no `added_at` or `added_by`. Entries are sorted by `domain` in byte order. Service accounts cannot call this endpoint.

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `200` | The allowed domains. | [`OutboundDomainList`](/docs/reference/api/schemas/#outbounddomainlist) |
| `401` | Authentication is missing or invalid. | [`Error`](/docs/reference/api/schemas/#error) |
| `403` | The caller is not allowed to perform the request; a role that is too low is code `forbidden_role`. | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

## POST /outbound-domains

Allow a domain.

Any signed-in person may allow a domain; service accounts cannot. Write `example.com` for that host only, or `*.example.com` for its subdomains only (not `example.com` itself). The entry is stored in its lower case ASCII form. At most 100 domains can be allowed.

### Request body

`application/json`, required.

| Field | Type | Description |
| --- | --- | --- |
| `domain` (required) | `string` |   |

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `201` | The domain is allowed. | [`OutboundDomain`](/docs/reference/api/schemas/#outbounddomain) |
| `400` | The request is malformed or fails validation. | [`Error`](/docs/reference/api/schemas/#error) |
| `401` | Authentication is missing or invalid. | [`Error`](/docs/reference/api/schemas/#error) |
| `403` | The caller is not allowed to perform the request; a role that is too low is code `forbidden_role`. | [`Error`](/docs/reference/api/schemas/#error) |
| `409` | The list is set by `SLASHOBSERVE_OUTBOUND_DOMAINS` (`managed_by_config`), or the domain is already allowed (`domain_exists`). | [`Error`](/docs/reference/api/schemas/#error) |
| `413` | The request body exceeds the size limit. | [`Error`](/docs/reference/api/schemas/#error) |
| `422` | The domain is not a valid host name or pattern (`invalid_domain`), or 100 domains are already allowed (`too_many_domains`). | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

## DELETE /outbound-domains/{domain}

Stop allowing a domain.

The path value is normalized like a new entry, so `Example.COM` removes `example.com`, and `*.example.com` removes the subdomain entry. Service accounts cannot.

### Parameters

| Name | In | Type | Description |
| --- | --- | --- | --- |
| `domain` (required) | path | `string` |   |

### Responses

| Status | Description | Body |
| --- | --- | --- |
| `204` | The domain is no longer allowed. |   |
| `401` | Authentication is missing or invalid. | [`Error`](/docs/reference/api/schemas/#error) |
| `403` | The caller is not allowed to perform the request; a role that is too low is code `forbidden_role`. | [`Error`](/docs/reference/api/schemas/#error) |
| `404` | The resource does not exist. | [`Error`](/docs/reference/api/schemas/#error) |
| `409` | The request conflicts with existing state. | [`Error`](/docs/reference/api/schemas/#error) |
| `422` | The value is not a valid host name or pattern (`invalid_domain`). | [`Error`](/docs/reference/api/schemas/#error) |
| `500` | The server failed to handle the request. | [`Error`](/docs/reference/api/schemas/#error) |

Generated from [`api/openapi.yaml`](https://github.com/slashobserve/slashobserve/blob/bac0fe39/api/openapi.yaml) at `bac0fe39`. [Report a problem](https://github.com/slashobserve/slashobserve/issues/new).