create domains
Add one or more phishing-protected domain records to a project.
Domains the project already has are skipped: the response returns the ids of the newly created records only, in request order — an empty array when every domain was already present.
Each domain must be a bare hostname — example.com, not a URL: no scheme, path, port or trailing slash. A value that is not a domain answers 400 protection_domain.not_valid_domain naming it in context.domain, and the whole batch is rejected — no record from that request is created.
The site BotBye protects is the project’s own domain (PATCH /api/v1/{account_id}/projects/{project_id}), not a domain record — every record is a host of yours that is never flagged as a clone, and is stored and returned as WHITELISTED.
MIRROR is deprecated and kept only for existing integrations: it never ends up on a record. A record sent as MIRROR — which is also what a record without status is taken for — is stored WHITELISTED, and the host of the last MIRROR entry becomes the project’s domain, exactly as if the project were updated with it; the project’s previous domain stays on as a WHITELISTED record. New integrations send WHITELISTED and change the site on the project itself.
Accepted permissions
Account → Phishing Projects → CreateToken scope
Account Phishing Projects Action
Authentication
Personal access token. Create it in your BotBye account under Profile → Personal Access Tokens, tick the scopes the endpoints you call require (see each endpoint’s Token scope), and send the token in the X-Api-Key request header. A token works only for the account it was created in.
Path parameters
Request
Bare hostname — example.com. Not a URL.
WHITELISTED for a host of yours. MIRROR (deprecated, and the default when status is omitted) also makes the host the project’s domain — the record itself is still stored WHITELISTED.