Lock or unlock a domain through the current v2 API

Resolve the domain's current identifier and read its lock state first. Confirm the customer authorised the change and that the credential has domains:lock. Check whether another lock or transfer operation is pending.

PUT /v2/domains/DOMAIN_ID/lock
Idempotency-Key: lock-change-local-1042
Content-Type: application/json

{
  "locked": false
}

Use JSON false to request unlock or true to request lock. Do not send the old lockstatus parameter or a string such as "false". Omitting the documented field can invoke a default, so send your intended value explicitly.

1. Record the returned resource and job reference.
2. Follow the queued action and inspect any provider error.
3. Read the lock resource again and compare desired, observed and status information when provided.
4. Synchronize through the supported workflow if a fresh provider observation is required.

A pending desired state is not proof that the registrar has applied it. Do not tell the customer a transfer is ready merely because the API accepted the unlock request.

Unlocking does not initiate a transfer or remove every registry restriction. Recent registration, previous transfer, change-of-registrant policy, disputes and other registry states can still prevent transfer. EPP-code retrieval is a separate sensitive action.

A lock does not secure website files or change public DNS resolution. Continue normal hosting and account security practices.

If a transfer is cancelled or no longer required, submit an authorised lock request and verify it completed. For a timeout, inspect the original action before creating another; preserve the same idempotency key for an unchanged retry.

For a refused request, check scope, ownership, account policy and registrar support. Do not attempt to bypass a registry or dispute lock by changing customer records or creating another reseller identity.

• Check a domain's registrar-lock state through the API
• Request and retrieve a domain EPP authorisation code through the API
• Submit an inbound domain transfer with the Domain Nexus v2 API
• Retry Domain Nexus requests without creating duplicate domain operations