Time	Status	User Agent
Retrieving recent requests…

Time

Status

User Agent

Retrieving recent requests…

Overview

Use this method to replace the entire list of domains allowed to host the WebSDK for your account in a single call, as an API alternative to the Domains to host WebSDK editor in the Dashboard.

See WebSDK settings for background on this allowlist and what it is used for.

Required permissions

To use this method, your app token must have the Manage client's settings permission.

Use case

Use this method to synchronize your WebSDK allowlist with a domain inventory you maintain elsewhere (for example, in your own infrastructure config), overwriting the current list in one call instead of adding and removing domains one by one.

📘
Notes

This method is available to Enterprise clients only. Self-service (SS) clients receive a 403 upon this call.

domains must not be empty — an empty list would allow the WebSDK to run on any origin, so the request is rejected rather than clearing the allowlist.

Each entry is automatically normalized to a lowercase host, and duplicates (after normalization) are removed, keeping the first occurrence.

Entries can be exact domains or third-level-and-deeper wildcards (for example, *.shop.acme.com).

The list is capped at 100 domains; a request with more than that is rejected with 400.

This call replaces the list entirely: any domain currently allowed but not included in the request body is removed.

Changes made through this API are recorded in the client's audit log, the same as manual edits made in the Dashboard.

All four WebSDK domains methods share a combined rate limit of 60 requests per 60 seconds.

Request example

curl -X PUT
     'https://api.sumsub.com/resources/api/websdkDomains' \
     -H 'X-App-Token: <your-app-token>' \
     -H 'X-App-Access-Sig: <your-signature>' \
     -H 'X-App-Access-Ts: <unix-timestamp>' \
     -H 'Content-Type: application/json' \
     -d '{
           "domains": [
             "example.com",
             "app.example.com"
           ]
         }'

Response explained

The response is a JSON object with the full, updated list of domains allowed to host the WebSDK.

Field	Type	Description
`domains`	Array of strings	Full, updated list of domains allowed to host the WebSDK — the normalized, deduplicated form of what was sent in the request.

Response examples

If the request is successfully sent and processed, you will get a response like the one below.

{
  "domains": [
    "example.com",
    "app.example.com"
  ]
}

If the request fails, you will receive an HTTP response containing an error code along with a message explaining the error. For example, when domains is empty:

{
  "description": "At least one WebSDK domain is required. An empty list allows any origin, so clear the list in the dashboard instead.",
  "code": 400,
  "correlationId": "b628a7fbdf4fa487b26406e79e76f3f7"
}

Response codes

Status	Description
`200`	Domains list replaced; returns the updated list — see Response examples.
`400`	`domains` is empty, contains more than 100 entries, or contains a malformed value.
`403`	Caller is a self-service client, or the app token lacks the Manage client's settings permission.