Update the status of a single domain record.
Setting MIRROR requires the project to have proven that it controls one of its own domains: the verification token is published either as a DNS TXT record on the registrable domain or as a <meta> tag on its home page. Ownership is proven from your BotBye account — the API carries no endpoint for it. Until that proof is on file the call answers 403 protection_phishing_domain_verification.project_domain_not_verified; setting WHITELISTED is always allowed.
Accepted permissions
Account → Phishing Projects → UpdateToken scope
Account Phishing Projects Action
Personal access token. Create it in your BotBye account under Profile → Personal Access Tokens, tick the scopes the endpoints you call require (see each endpoint’s Token scope), and send the token in the X-Api-Key request header. A token works only for the account it was created in.