---
title: "Status Page Domain Diagnostics"
description: "Live DNS and certificate check of one status-page custom domain: authoritative nameservers, TXT record seen, propagation, certificate state, last failed verification."
---

`GET /api/status-pages/domains/{id}/diagnostics`

Runs the checks live on every call and writes nothing. Use it when a domain does not verify or does not serve HTTPS.

## Access

Same read access as [Get Status Page Domain](/api/status-pages/get-status-page-domain).

## Example (cURL)

```bash
BASE_URL="https://uptimeify.io"
TOKEN="<your-api-token>"

curl -X GET "$BASE_URL/api/status-pages/domains/12/diagnostics" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Accept: application/json"
```

## Response

`200 OK`

```json
{
  "domainId": 12,
  "hostname": "status.acme.example",
  "status": "active",
  "checkedAt": "2026-10-29T09:30:00.000Z",
  "verification": {
    "recordFound": true,
    "recordName": "_verify-status.status.acme.example",
    "expected": "uptimeify-verify-abc123",
    "lookup": "records",
    "observed": ["uptimeify-verify-abc123"],
    "nameservers": { "zone": "acme.example", "hosts": ["ns1.dns-provider.example", "ns2.dns-provider.example"] },
    "authoritative": { "nameserver": "ns1.dns-provider.example", "lookup": "records", "observed": ["uptimeify-verify-abc123"] },
    "propagation": "propagated"
  },
  "certificate": {
    "state": "valid",
    "errorCode": null,
    "errorMessage": null,
    "issuer": "Let's Encrypt",
    "validFrom": "2026-10-01T00:00:00.000Z",
    "validTo": "2026-12-30T00:00:00.000Z",
    "daysUntilExpiry": 62
  },
  "lastVerificationError": null,
  "lastVerificationErrorAt": null
}
```

| Field | Description |
|-------|-------------|
| `verification` | The live TXT check, `null` when the domain has no verification token. Same fields as the `domainVerificationFailed` error data of the verify endpoint, plus `recordFound` (`true`: the token is published, verify would succeed). |
| `verification.nameservers` | The zone the hostname is delegated in and its authoritative nameservers; `null` if that could not be determined. |
| `verification.authoritative` | What one of those nameservers answered when asked directly, bypassing every cache; `null` if none could be asked. Only public nameserver addresses are queried. |
| `verification.propagation` | `propagated` (our resolver sees the token), `propagating` (your nameserver has it, our resolver not yet; retry after the TTL), `not_published` (not even your nameserver has it), `unknown` (no nameserver could be asked). |
| `certificate.state` | What a browser gets on `https://<hostname>`: `valid`, `invalid` (a certificate is served but fails verification, reason in `errorCode`), `handshake_failed` (no TLS handshake: the certificate may still be issuing, or the CNAME does not point to us yet), `unreachable` (`errorCode` `not_resolved` or `private_address`), `not_active` (the domain is not activated yet, no certificate is issued before that, nothing was probed). |
| `certificate.errorCode` | `expired`, `not_yet_valid`, `hostname_mismatch`, `untrusted`, `not_resolved`, `private_address` or `null`. |
| `lastVerificationError`, `lastVerificationErrorAt` | The last failed verification as stored on the domain, `null` after a successful one. |

## Common errors

- `400 Bad Request` (`invalidDomainId`) when the id is not a positive number
- `401 Unauthorized` when you are not logged in
- `403 Forbidden` when your role may not read status pages
- `404 Not Found` (`domainNotFound`) when the domain does not exist or belongs to another organization