# Lock, privacy and authorisation code

> Turn the transfer lock and WHOIS privacy on or off, and generate a new transfer authorisation code.

## POST /api/v1/domains/lock · POST /api/v1/domains/unlock

Turns the registrar transfer lock on or off. The lock prevents the domain being transferred away — leave it on unless the customer is actively moving the domain.

**Request — same body for both**

```json
{
  "domainName": "apiname.com"
}
```

:::note[Which operation you get is decided by the URL]
There is no `lockStatus` flag. `/lock` locks, `/unlock` unlocks. If your client sends a `lockStatus` field it is ignored.
:::

**Response — 204, no body**

Confirm the new state with `GET /api/v1/domains/info` and read `lockStatus`.

**Errors**

| Code | Meaning and fix |
| --- | --- |
| `DnaValidationError` | `domainName` missing. |
| `Dna.DomainService:Domain:10007` | Domain not found or not yours. |
| `Dna.DomainService:Domain:10016` | The domain's status does not permit the change. |
| `Dna.DomainService:Domain:10032` | **Unlock only.** Refused because an ownership change is pending. Finish that first. |
| `Dna.DomainService:Epp:10001` | The registry rejected it. |

## POST /api/v1/domains/privacy

Turns WHOIS privacy protection on or off. With privacy on, the registrant's personal data is replaced by a proxy in public records.

**Request**

```json
{
  "domainName": "apiname.com",
  "privacyStatus": true
}
```

| Field | Required | Notes |
| --- | --- | --- |
| `domainName` | required | Must be a whole domain, **not a subdomain**. |
| `privacyStatus` | required | `true` enables, `false` disables. **It must be present** — omitting it is an error, not a default. |

**Response — 204, no body**

:::note[Check support first]
Not every extension sells privacy. Read `isPrivacyAvailable` from the TLD catalogue before offering it, or you will get `Dna.DomainService:Tld:10001`.
:::

**Errors**

| Code | Meaning and fix |
| --- | --- |
| `DnaValidationError` | `privacyStatus` omitted or not a boolean, or `domainName` missing. |
| `Dna.DomainService:Domain:10046` | You sent a subdomain. Send the registrable domain. |
| `Dna.DomainService:Domain:1021` | Domain unknown or not yours. |
| `Dna.DomainService:Tld:10001` | This extension does not support WHOIS privacy. |

## PUT /api/v1/domains/auth

Generates a new transfer authorisation code and returns it.

**Request**

```json
{
  "domainName": "apiname.com"
}
```

**Response — 200**

```json
{
  "domainName": "apiname.com",
  "authCode": "mQ7#vR2-pL9xK4"
}
```

:::caution[The previous code stops working immediately]
If the customer already has the old code and is mid-transfer somewhere else, regenerating breaks it. Only regenerate when asked, or when you suspect the code has leaked. To read the existing code without changing it, use `GET /api/v1/domains/info` and read `authCode`.
:::

**Errors**

| Code | Meaning and fix |
| --- | --- |
| `Dna.DomainService:Domain:10007` | Domain not found or not yours. |
| `Dna.DomainService:Domain:10040` | The registry refused to change the code. |
| `Dna.DomainService:Domain:10035` | The generated code does not satisfy this TLD's length policy. Open a ticket. |
| `Dna.DomainService:Domain:10016` | The domain's status does not permit the change. |