# What changed on this domain's DMARC configuration, and when

`GET /v1/domain-auth/domains/{domain}/timeline`

- Authentication: required (Bearer token)
- Required scope: `api.domain_auth.view`

The notable moments in one domain's DMARC life, newest first: policy
changes, record edits that did NOT move the policy, source decisions,
acknowledgements, and the customer's own notes.

**The unit here is an EVENT, not a stored annotation, and the difference
matters.** One real change usually produces two stored rows. A live-DNS
poll sees the new record and records it with the exact text either side
and a tight timestamp; a day or two later the receivers' aggregate
reports arrive describing the same day, and the report-derived detector
reconstructs the same transition with the policy alone and a date
bucketed to midnight UTC. Both rows are correct and both are kept.

This endpoint folds them, so one change is one event. Nothing is hidden
by the folding: every event lists its `sightings`, naming the annotation
id, the origin and the timestamp behind each. Read `anchor_origin` to
know which sighting supplied `occurred_at` and the record text — a `dns`
anchor means a poll timestamp, a `reports` anchor means a day bucket,
and the second is the only kind available for a change made before the
domain was onboarded.

Two annotations fold into one event when they share a kind, share the
same `old_policy` → `new_policy` pair, come from different origins, and
fall within three days of each other. Notes, acknowledgements and source
decisions never fold: each is a separate act by a separate person.

**This surface carries no email addresses.** The dashboard's timeline
names the colleague who published a change or wrote a note; this one
does not, because `api.domain_auth.view` promises no personal data and a
read-only DMARC token should not double as a way to enumerate an org's
staff. Read `anchor_origin` to tell a moment a person created (`user`)
from one a detector observed.

## Path parameters

- `domain` (string, required) — The domain, by NAME (`acme.com`). A UUID is also accepted. Matched case-insensitively, and scoped to the calling org — a domain belonging to another org is a 404, never a 403.

## Example request

```bash
curl 'https://api.sendops.dev/v1/domain-auth/domains/string/timeline' \
  -H "Authorization: Bearer $SENDOPS_API_KEY"
```

## Responses

### 200 — The domain's timeline, newest event first

Content type: `application/json`

```json
{
  "events": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "kind": "policy_change",
      "anchor_origin": "dns",
      "occurred_at": "2026-05-17T20:00:00Z",
      "observed_at": "2026-05-17T20:00:00Z",
      "old_policy": "",
      "new_policy": "",
      "old_record": "string",
      "new_record": "string",
      "tightening": true,
      "weakening": true,
      "note": "string",
      "sightings": [
        {
          "annotation_id": "00000000-0000-0000-0000-000000000000",
          "origin": "dns",
          "occurred_at": "2026-05-17T20:00:00Z",
          "observed_at": "2026-05-17T20:00:00Z",
          "has_record_text": true
        }
      ]
    }
  ],
  "annotations": 0
}
```

### 401 — Missing, malformed, or unknown API key

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 403 — Key lacks the required scope or plan limit violated

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 404 — Resource not found

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 429 — Per-org rate limit exceeded

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```

### 500 — Unexpected server-side failure. The `code` is `internal_error`. The
`request_id` field can be quoted to SendOps support to investigate.

Content type: `application/problem+json`

```json
{
  "type": "https://example.com",
  "title": "string",
  "status": 0,
  "detail": "string",
  "code": "invalid_key",
  "request_id": "string",
  "retry_after": 0,
  "retention_days": 0,
  "scope": "string",
  "resource": "string",
  "errors": [
    {
      "field": "string",
      "reason": "string"
    }
  ],
  "attribute_id": "00000000-0000-0000-0000-000000000000",
  "content_hash": "string",
  "differs": [
    "string"
  ]
}
```