The current EPP workflow uses POST /v2/domains/{domainId}/epp-code to request an authorisation code and GET on the same route to retrieve it when the registrar can return one. Treat the code as a secret that can help authorise a registrar transfer.
IN THIS ARTICLE
01 Check authority and support
Resolve the domain's current identifier from your owned inventory. The credential needs domains:epp, an active permitted account and the sensitive-action authorisation enforced by the API. The TLD and registrar must support an EPP-code workflow.
A made-up step-up header does not provide MFA or grant additional permission. Use the approved identity and current account controls rather than adding undocumented authentication fields.
02 Request the code
POST /v2/domains/DOMAIN_ID/epp-code
Idempotency-Key: epp-request-local-1042
Content-Type: application/json
{}Use the authentication described in the API introduction. Keep the resulting operation reference and follow its status. If a code is not immediately returned, do not expose a pending result as a usable transfer code.
03 Retrieve and deliver securely
After the registrar workflow completes, send GET /v2/domains/DOMAIN_ID/epp-code. Inspect the response and its epp_code value when supplied. Some registrar workflows can accept a request without returning a code through the API; read the specific error and follow the approved support or delivery process.
Show the code only to the authorised domain owner or integration component that needs it. Do not place it in URL parameters, analytics, ordinary logs, screenshots or an unprotected email template.
04 Understand what the code does
Retrieving EPP does not unlock the domain, initiate the transfer or remove registry eligibility restrictions. Check lock state and the transfer policy separately. If the proposed transfer is cancelled, retain the intended registrar-lock protection and follow the registrar's procedure if a code may have been exposed.
Why has the API not returned my EPP authorisation code?
For a refusal, check domain ownership, effective scope, account state and provider support. For a timeout during the request, inspect the existing operation before creating another. Give support the domain and request reference, not the secret code itself.
An accepted code-request operation may still be processing, or the provider may deliver the code through a different authorised channel. Read the request outcome and current domain state before assuming an empty immediate response means the code does not exist.