Release App Domain
DELETE /apps/{app_id}/domains/{hostname}
Release a claimed hostname.
Hostnames are globally unique across every app
(uq_developer_app_domains_hostname), so one typo permanently burned that
host for every builder on the platform with no public way to undo it. The
repository had get, list, claim and set_status, and no delete at all.
A HARD delete, not a revoked status. The uniqueness index does not care
about status, so a row left behind in any state keeps the host claimed while
looking to the builder like it was released.
OWNERSHIP IS CHECKED AGAINST THE STORED CLAIM, not just the app in the path.
_require_own_app proves the caller owns THIS app; the second check proves
the hostname belongs to that same app. Without it a builder could pass their
own app id and any hostname, and delete a competitor’s claim — the one thing
global uniqueness makes irreversible.
404 for an unknown host or one held by another app, never 403: a 403 would make a competitor’s claim discoverable by probing.
Idempotent within your own app: releasing a host you have already released is a 404, because after the first call the claim genuinely does not exist. The delete itself reports whether a row went, and both answers are correct.
Authorizations
Parameters
Path Parameters
Header Parameters
Responses
200
Successful Response
object
object
422
Validation Error