app.org_domains
TableRow level security on
Domains an org claims (Section 12, Section 4.8.1, Section 4.8.3): custom Atlas and Gateway hosts, email sending domains, and verified domains that earn the verified badge and may allow automatic join with a default role. Verification state is written only by the platform verification service.
Primary key: id
| Column | Type | Nullable | Description |
|---|---|---|---|
| id | uuid | No | Primary key, UUID v7. |
| org_id | uuid | No | Owning org. A row never moves to another org.References app.organizations.id |
| hostname | text | No | Lowercase host name, for example gateway.example.com. |
| purpose | app.org_domain_purpose | No | What the domain is for. |
| verification_state | app.domain_verification_state | No | DNS verification state; changed only by app.record_domain_verification. |
| verification_token | text | No | Value the org publishes in a DNS TXT record to prove control. |
| verified_at | timestamp with time zone | Yes | When verification last succeeded; NULL unless Verified. |
| last_checked_at | timestamp with time zone | Yes | When the verification service last checked DNS. |
| auto_join_role_id | uuid | Yes | Role given to a person with a confirmed address at this verified domain who joins automatically; NULL turns automatic join off.References app.roles.id |
| deleted_at | timestamp with time zone | Yes | Soft delete time. A row with deleted_at set is ignored by every access helper. |
| created_at | timestamp with time zone | No | When the row was inserted. Set by the database. |
| created_by | uuid | Yes | Person who inserted the row, or null for a platform process. Set by the database.References app.people.id |
| updated_at | timestamp with time zone | No | When the row last changed. Set by the database. |
| updated_by | uuid | Yes | Person who last changed the row, or null for a platform process. Set by the database.References app.people.id |
| provisioning_status | app.domain_provisioning_status | No | Where the domain stands at its provider: Not Started, Requested, Pending DNS, Active, Failed or Released. Written only by the org-lifecycle worker (app.record_domain_provisioning). |
| provider_ref | text | Yes | The domain's identifier at its provider: the host name on the Vercel project, or the Resend domain id. |
| dns_records | jsonb | No | DNS records the org publishes for the provider, as the provider gave them: an array of {type, name, value, purpose} (for example the CNAME of an Atlas host, or the SPF, DKIM and DMARC records of a sending domain). |
| tls_ready | boolean | No | True once the provider issued the TLS certificate of an Atlas or Gateway host (Vercel issues it automatically after DNS verification). |
| provisioned_at | timestamp with time zone | Yes | When the provider first reported the domain active. |
| provisioning_error | text | Yes | Why the latest provisioning step failed, as the worker recorded it. |