Time	Status	User Agent
Retrieving recent requests…

Time

Status

User Agent

Retrieving recent requests…

Overview

Use this method to remove a single domain from the list of domains allowed to host the WebSDK for your account, as an API alternative to the Domains to host WebSDK editor in the Dashboard.

See WebSDK settings for background on this allowlist and what it is used for.

Required permissions

To use this method, your app token must have the Manage client's settings permission.

Use case

Use this method to revoke a domain that has been decommissioned or was added by mistake — for example, as part of tearing down a client subdomain in an automated deployment — without needing to open the Dashboard.

📘
Notes

This method is available to Enterprise clients only. Self-service (SS) clients receive a 403 upon this call.

domain is matched against stored entries after normalization, so ?domain=ACME.com also matches a stored https://acme.com.

If domain does not match anything currently on the list, the call is a no-op: it returns 200 with the list unchanged — it does not error.

The domains list can never be emptied entirely through the API — removing the last remaining domain is rejected with 400, naming the Dashboard as the way to clear it deliberately.

Changes made through this API are recorded in the client's audit log, the same as manual edits made in the Dashboard.

All four WebSDK domains methods share a combined rate limit of 60 requests per 60 seconds.

Request example

curl -X DELETE \
     'https://api.sumsub.com/resources/api/websdkDomains?domain=app.example.com' \
     -H 'X-App-Token: <your-app-token>' \
     -H 'X-App-Access-Sig: <your-signature>' \
     -H 'X-App-Access-Ts: <unix-timestamp>'

Response explained

The response is a JSON object with the full, updated list of domains allowed to host the WebSDK for this client.

Field	Type	Description
`domains`	Array of strings	Full, updated list of domains allowed to host the WebSDK — the normalized, deduplicated form of what was sent in the request.

Response examples

If the request is successfully sent and processed, you will get a response like the one below.

{
  "domains": [
    "example.com"
  ]
}

If the request fails, you will receive an HTTP response containing an error code along with a message explaining the error. For example, when trying to remove the last remaining domain:

{
  "description": "Cannot remove the last WebSDK domain. An empty list allows any origin, so clear the list in the dashboard instead.",
  "code": 400,
  "correlationId": "b628a7fbdf4fa487b26406e79e76f3f7"
}

Response codes

Status	Description
`200`	Domain removed, or was not present to begin with; returns the (possibly unchanged) domains list — see Response examples.
`400`	Removing domain would leave the list empty.
`403`	Caller is a self-service client, or the app token lacks the Manage client's settings permission.