> ## Documentation Index > Fetch the complete documentation index at: https://docs.baselayer.com/llms.txt > Use this file to discover all available pages before exploring further. # Replace your application's audiences and allowed origins > Stores both lists, each sorted, in place of the current ones. Each value must already be canonical; one that is not is refused, never rewritten. Send the `ETag` of the lists you edited as `If-Match`; if another write changed them first, the replace is refused and nothing changes. Warnings never refuse a replace. Changing `allowed_origins` also needs the `acceptance_origins:update` permission. The change applies to presentations and browser checks after it. A body that fails validation is a 422; then, in order: no `If-Match` is a 428, an application that no longer exists a 404, a stale `If-Match` a 412, and an `allowed_origins` change without the permission a 403. ## OpenAPI ````yaml /api-reference/openapi.json put /acceptance/domains openapi: 3.1.0 info: title: baselayer-api-service version: 0.1.0 servers: - url: https://api.baselayer.com/ security: [] paths: /acceptance/domains: put: tags: - Acceptance summary: Replace your application's audiences and allowed origins description: >- Stores both lists, each sorted, in place of the current ones. Each value must already be canonical; one that is not is refused, never rewritten. Send the `ETag` of the lists you edited as `If-Match`; if another write changed them first, the replace is refused and nothing changes. Warnings never refuse a replace. Changing `allowed_origins` also needs the `acceptance_origins:update` permission. The change applies to presentations and browser checks after it. A body that fails validation is a 422; then, in order: no `If-Match` is a 428, an application that no longer exists a 404, a stale `If-Match` a 412, and an `allowed_origins` change without the permission a 403. operationId: acceptance_domains_replace parameters: - name: if-match in: header required: false schema: anyOf: - type: string - type: 'null' description: The `ETag` of the lists the body was edited from. title: If-Match description: The `ETag` of the lists the body was edited from. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/v1.AcceptanceDomainsRequest' application/vnd.baselayer.v1+json: schema: $ref: '#/components/schemas/v1.AcceptanceDomainsRequest' responses: '200': description: The stored lists and their warnings. content: application/json: schema: $ref: '#/components/schemas/v1.AcceptanceDomains' application/vnd.baselayer.v1+json: schema: $ref: '#/components/schemas/v1.AcceptanceDomains' headers: ETag: description: >- A hash of both sorted lists, quoted; send it back as `If-Match` to replace them. schema: type: string '403': description: >- The body changes `allowed_origins` without `acceptance_origins:update`; `metadata.reason` names the permission. content: application/json: schema: $ref: '#/components/schemas/Error' title: ForbiddenAccessNoPermission description: >- Forbidden access. The authentication credentials don't have appropriate permissions to access or affect the resource. examples: - type: forbidden_access_no_permission code: 30 message: >- Forbidden access. The authentication credentials don't have appropriate permissions to access or affect the resource. metadata: {} '404': description: The application no longer exists. content: application/json: schema: $ref: '#/components/schemas/Error' title: ResourceNotFound description: Could not locate the resource for the given URI. examples: - type: resource_not_found code: 1 message: Could not locate the resource for the given URI. metadata: {} '412': description: '`If-Match` does not name the current lists.' content: application/json: schema: $ref: '#/components/schemas/Error' title: DomainsStale description: >- The audiences or allowed origins have changed since the version you edited. Read them again and reapply your change. examples: - type: domains_stale code: 7232 message: >- The audiences or allowed origins have changed since the version you edited. Read them again and reapply your change. metadata: {} '422': description: The request is invalid. content: application/json: schema: $ref: '#/components/schemas/Error' title: ValidationFailed description: The request is invalid. examples: - type: validation_failed code: 7112 message: The request is invalid. metadata: {} '428': description: The request has no `If-Match`. content: application/json: schema: $ref: '#/components/schemas/Error' title: IfMatchRequired description: >- A replace needs an If-Match header naming the version you edited. examples: - type: if_match_required code: 7220 message: >- A replace needs an If-Match header naming the version you edited. metadata: {} security: - APIKeyHeader: [] components: schemas: v1.AcceptanceDomainsRequest: additionalProperties: false description: The two lists a replace stores, sorted, in place of the current ones. properties: audiences: description: >- Where credentials can be presented (a key-binding JWT's `aud`): each exactly as canonicalized, a bare lowercase domain or `https://`. Stored and returned sorted. items: maxLength: 253 type: string maxItems: 50 title: Audiences type: array allowed_origins: description: >- Where baselayer.js may run: `https://[:port]`, or `http` on localhost, 127.0.0.1 or [::1]; lowercase, with no path and no default port. Stored and returned sorted. items: maxLength: 267 type: string maxItems: 50 title: Allowed Origins type: array required: - audiences - allowed_origins title: AcceptanceDomainsRequest (v1) type: object v1.AcceptanceDomains: description: Where credentials can be presented and where baselayer.js may run. properties: audiences: description: >- The audiences a key-binding JWT's `aud` must be one of, sorted ascending. items: type: string title: Audiences type: array allowed_origins: description: The origins a browser check accepts a page from, sorted ascending. items: type: string title: Allowed Origins type: array warnings: description: >- Computed from the two lists on every response and never stored: `origin_without_audience` for each origin whose host no audience names, bare or as `https://`. items: $ref: '#/components/schemas/v1.DomainWarning' title: Warnings type: array required: - audiences - allowed_origins - warnings title: AcceptanceDomains (v1) type: object Error: properties: type: type: string title: Type description: >- Stable snake_case name of the error. Branch on this, never on `message`. code: type: integer title: Code description: Integer catalog code of the error. message: type: string title: Message description: For a person reading a log; not stable and not localized. metadata: additionalProperties: true type: object title: Metadata description: Context documented per `type`. request_id: anyOf: - type: string - type: 'null' title: Request Id description: The `X-Request-ID` of the failed request. type: object required: - type - code - message title: Error description: The one body of every error a KYA route answers. v1.DomainWarning: description: Something in the two lists that is allowed but probably not meant. properties: code: $ref: '#/components/schemas/v1.DomainWarningCode' description: What the warning flags. origin: description: The allowed origin concerned. title: Origin type: string message: description: For a person reading it; not stable. title: Message type: string required: - code - origin - message title: DomainWarning (v1) type: object v1.DomainWarningCode: description: What a domains warning flags. Values may be added. enum: - origin_without_audience title: DomainWarningCode type: string securitySchemes: APIKeyHeader: type: apiKey in: header name: X-API-Key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.