Skip to content
Cloudflare API
Start here
API Reference
Registrar
Transfer In

Initiate Transfer

POST/accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in

Starts a domain transfer-in workflow. This is typically a billable operation — successful transfers charge the account’s default payment method, except for extensions with zero transfer pricing (e.g. UK extensions). All successful domain transfers are non-refundable.

How transfers work

Domain transfers move a domain from another registrar to Cloudflare. Transfers typically take 1-10 days due to ICANN-mandated approval windows.

Prerequisites

  • The domain must already have a zone in the Cloudflare account (added through the dashboard or zone API).
  • The zone must have DNSSec disabled.
  • For billable transfers (i.e. extensions with non-zero transfer pricing), the account must have a billing profile with a valid default payment method. Set this up at https://dash.cloudflare.com/{account_id}/billing/payment-info.
  • The domain must be unlocked at the current registrar.
  • An authorization/EPP code from the current registrar is required, except for UK extensions — see Auth code below.

Auth code

An authorization code (also called EPP code, transfer key, or auth-info code) is required for most extensions, with the exception of UK extensions. Obtain this from your current registrar’s control panel.

The auth code in the request body must be base64-encoded per RFC 4648 §4 (standard alphabet, no line breaks).

Response behavior

Successful transfer initiation returns 202 Accepted. Validation or initiation failures return the documented 4XX responses. Poll GET /accounts/{account_id}/registrar/registrations/{domain_name}/transfer-in-status to track progress.

Premium domains

Premium domain transfers are not currently supported by this API. Please use the dashboard for now.

Billing

The account’s default payment method is charged upon successful transfer completion, unless the extension has zero transfer pricing (e.g. UK extensions). The transfer adds time to the domain’s existing expiration date (typically 1 year).

Security
API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Path ParametersExpand Collapse
account_id: string

Identifier.

maxLength32
domain_name: string

Provides a fully qualified domain name (FQDN), including the extension (e.g., example.com, mybrand.app). The domain name uniquely identifies a registration. Cloudflare permits only one registration per domain, making the domain name a natural idempotency key for registration requests.

Header ParametersExpand Collapse
Prefer: optional string
Body ParametersJSONExpand Collapse
auth_code: optional string

The EPP/authorization code from your current registrar, base64-encoded per RFC 4648 §4. Obtain this from your current registrar’s control panel. Required for all extensions, except for UK.

formatbyte
auto_renew: optional boolean

Enable or disable automatic renewal after transfer. Defaults to false if omitted.

contact_extensions: optional map[unknown]

Registry-specific contact extension values for the registrant. GET /accounts/{account_id}/registrar/extensions/{extension} documents the required keys and allowed values for each extension in the transfer_schema.properties.contact_extensions object.

Examples include .us nexus fields, .uk registrant type fields, and .ca legal type fields. Include this object only when the extension’s transfer schema defines contact_extensions.

contacts: optional object { administrator, billing, registrant, technical }

Provides contact data for the registration request.

The per-extension schema from GET /accounts/{account_id}/registrar/extensions/{extension} defines the accepted contact roles. Every currently supported extension requires only contacts.registrant from API callers. Callers may provide additional roles such as technical, administrator, and billing when the extension schema includes them. When a registry requires an omitted role, Cloudflare may derive that contact from contacts.registrant.

When the request omits either the entire contacts object or contacts.registrant, the system uses the account’s default address book entry as the registrant contact. The account owner must configure this default at https://dash.cloudflare.com/{account_id}/domains/registrations, where they can create or update the address book entry and accept the required agreement. Dashboard settings currently provide the only way to manage address book entries.

Without either a default address book entry or a registrant contact, the registration request fails validation.

administrator: optional object { email, phone, postal_info, fax }

Optional administrator contact. Accepted only when the extension schema includes this role. When the registry requires an omitted contact, Cloudflare may derive it from contacts.registrant.

email: string

Email address for the registrant. Used for domain-related communications from the registry, including ownership verification and renewal notices.

formatemail
phone: string

Phone number in E.164 format: +{country_code}.{number} without spaces or dashes. Examples: +1.5555555555 (US), +44.2071234567 (UK), +81.312345678 (Japan).

postal_info: object { address, name, organization }

Postal/mailing information for the contact. The name field is the complete contact name in one string. Some registries require a complete personal name, including a family or last name where applicable, but this API does not accept separate first-name and last-name fields for registration contacts.

address: object { city, country_code, postal_code, 2 more }

Physical mailing address for the registrant contact.

city: string

City or locality name.

country_code: string

Two-letter country code per ISO 3166-1 alpha-2 (e.g., US, GB, CA, DE).

postal_code: string

Postal or ZIP code.

state: string

State, province, or region. Use the standard abbreviation where applicable (e.g., TX for Texas, ON for Ontario).

street: string

Street address including building/suite number.

name: string

Full legal name of the contact, including all required name components for an individual or authorized representative. Some registries require a complete personal name that includes a family or last name where applicable. Provide the complete name in this single field, for example Ada Lovelace; do not send separate first-name or last-name fields.

organization: optional string

Organization or company name. Optional for individual registrants.

fax: optional string

Fax number in E.164 format (e.g., +1.5555555555). Optional. Most registrations do not require a fax number.

billing: optional object { email, phone, postal_info, fax }

Optional billing contact. Accepted only when the extension schema includes this role. When the registry requires an omitted contact, Cloudflare may derive it from contacts.registrant.

email: string

Email address for the registrant. Used for domain-related communications from the registry, including ownership verification and renewal notices.

formatemail
phone: string

Phone number in E.164 format: +{country_code}.{number} without spaces or dashes. Examples: +1.5555555555 (US), +44.2071234567 (UK), +81.312345678 (Japan).

postal_info: object { address, name, organization }

Postal/mailing information for the contact. The name field is the complete contact name in one string. Some registries require a complete personal name, including a family or last name where applicable, but this API does not accept separate first-name and last-name fields for registration contacts.

address: object { city, country_code, postal_code, 2 more }

Physical mailing address for the registrant contact.

city: string

City or locality name.

country_code: string

Two-letter country code per ISO 3166-1 alpha-2 (e.g., US, GB, CA, DE).

postal_code: string

Postal or ZIP code.

state: string

State, province, or region. Use the standard abbreviation where applicable (e.g., TX for Texas, ON for Ontario).

street: string

Street address including building/suite number.

name: string

Full legal name of the contact, including all required name components for an individual or authorized representative. Some registries require a complete personal name that includes a family or last name where applicable. Provide the complete name in this single field, for example Ada Lovelace; do not send separate first-name or last-name fields.

organization: optional string

Organization or company name. Optional for individual registrants.

fax: optional string

Fax number in E.164 format (e.g., +1.5555555555). Optional. Most registrations do not require a fax number.

registrant: optional object { email, phone, postal_info, fax }

Optional registrant contact. If omitted, the account’s default address book entry is used instead.

email: string

Email address for the registrant. Used for domain-related communications from the registry, including ownership verification and renewal notices.

formatemail
phone: string

Phone number in E.164 format: +{country_code}.{number} without spaces or dashes. Examples: +1.5555555555 (US), +44.2071234567 (UK), +81.312345678 (Japan).

postal_info: object { address, name, organization }

Postal/mailing information for the contact. The name field is the complete contact name in one string. Some registries require a complete personal name, including a family or last name where applicable, but this API does not accept separate first-name and last-name fields for registration contacts.

address: object { city, country_code, postal_code, 2 more }

Physical mailing address for the registrant contact.

city: string

City or locality name.

country_code: string

Two-letter country code per ISO 3166-1 alpha-2 (e.g., US, GB, CA, DE).

postal_code: string

Postal or ZIP code.

state: string

State, province, or region. Use the standard abbreviation where applicable (e.g., TX for Texas, ON for Ontario).

street: string

Street address including building/suite number.

name: string

Full legal name of the contact, including all required name components for an individual or authorized representative. Some registries require a complete personal name that includes a family or last name where applicable. Provide the complete name in this single field, for example Ada Lovelace; do not send separate first-name or last-name fields.

organization: optional string

Organization or company name. Optional for individual registrants.

fax: optional string

Fax number in E.164 format (e.g., +1.5555555555). Optional. Most registrations do not require a fax number.

technical: optional object { email, phone, postal_info, fax }

Optional technical contact. Accepted only when the extension schema includes this role. When the registry requires an omitted contact, Cloudflare may derive it from contacts.registrant.

email: string

Email address for the registrant. Used for domain-related communications from the registry, including ownership verification and renewal notices.

formatemail
phone: string

Phone number in E.164 format: +{country_code}.{number} without spaces or dashes. Examples: +1.5555555555 (US), +44.2071234567 (UK), +81.312345678 (Japan).

postal_info: object { address, name, organization }

Postal/mailing information for the contact. The name field is the complete contact name in one string. Some registries require a complete personal name, including a family or last name where applicable, but this API does not accept separate first-name and last-name fields for registration contacts.

address: object { city, country_code, postal_code, 2 more }

Physical mailing address for the registrant contact.

city: string

City or locality name.

country_code: string

Two-letter country code per ISO 3166-1 alpha-2 (e.g., US, GB, CA, DE).

postal_code: string

Postal or ZIP code.

state: string

State, province, or region. Use the standard abbreviation where applicable (e.g., TX for Texas, ON for Ontario).

street: string

Street address including building/suite number.

name: string

Full legal name of the contact, including all required name components for an individual or authorized representative. Some registries require a complete personal name that includes a family or last name where applicable. Provide the complete name in this single field, for example Ada Lovelace; do not send separate first-name or last-name fields.

organization: optional string

Organization or company name. Optional for individual registrants.

fax: optional string

Fax number in E.164 format (e.g., +1.5555555555). Optional. Most registrations do not require a fax number.

privacy_mode: optional "off" or "redaction"

WHOIS privacy mode to apply after transfer completes. Defaults to the extension’s default privacy mode (typically redaction).

One of the following:
"off"
"redaction"
ReturnsExpand Collapse
errors: array of object { code, message, source }
code: number
minimum1000
message: string
source: optional object { pointer }

Location of the invalid value that caused the error.

pointer: string

JSON Pointer to the invalid or missing request value.

messages: array of object { code, message, source }
code: number
minimum1000
message: string
source: optional object { pointer }

Location of the invalid value that caused the error.

pointer: string

JSON Pointer to the invalid or missing request value.

result: WorkflowStatus { completed, created_at, links, 4 more }

Status of an async registration workflow.

completed: boolean

Indicates whether the workflow reached a terminal state. A succeeded or failed state returns true; pending, in_progress, action_required, and blocked return false.

created_at: string
formatdate-time
state: "pending" or "in_progress" or "action_required" or 3 more

Describes the workflow lifecycle state.

  • pending: The workflow awaits processing.
  • in_progress: Processing started. Continue polling links.self. An internal deadline limits the duration of this state.
  • action_required: The workflow pauses for user action. See context.action for details. Stop automated polling until the user completes the required action.
  • blocked: A third party, such as the domain extension’s registry or a losing registrar, prevents progress. Continue polling because the block may resolve when the third party responds.
  • succeeded: Terminal state. The operation completed successfully. completed equals true. For registrations, context.registration contains the resulting registration resource.
  • failed: Terminal state. The operation failed. completed equals true. See error.code and error.message for the reason. Require user review before retrying.
One of the following:
"pending"
"in_progress"
"action_required"
"blocked"
"succeeded"
"failed"
updated_at: string
formatdate-time
context: optional map[unknown]

Provides workflow-specific data.

For domain-centric workflows, context.domain_name identifies the workflow subject.

error: optional object { code, message }

Provides error details when a workflow reaches the failed state. The workflow type (registration, update, etc.) and underlying registry response determine the specific codes and messages. Workflow error codes differ from immediate HTTP error errors[].code values in non-2xx responses. Surface error.message to the user for context.

code: string

Machine-readable error code identifying the failure reason.

message: string

Human-readable explanation of the failure. May include registry-specific details.

success: true

Whether the API call was successful.

Initiate Transfer

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/registrar/registrations/$DOMAIN_NAME/transfer-in \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -d '{
          "auth_code": "bml4b3M+Pj5hcmNoLWxpbnV4",
          "contact_extensions": {
            "application_purpose": "bar",
            "nexus_category": "bar"
          },
          "privacy_mode": "redaction"
        }'
{
  "errors": [],
  "messages": [],
  "result": {
    "completed": false,
    "context": {
      "domain_name": "example.com"
    },
    "created_at": "2025-10-27T10:00:00Z",
    "links": {
      "resource": "/accounts/abc/registrar/registrations/example.com",
      "self": "/accounts/abc/registrar/registrations/example.com/transfer-in-status"
    },
    "state": "pending",
    "updated_at": "2025-10-27T10:00:01Z"
  },
  "success": true
}
{
  "errors": [
    {
      "code": 10000,
      "message": "object at root is missing required properties: auth_code",
      "source": {
        "pointer": "/auth_code"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Auth code must be a base64 encoded string",
      "source": {
        "pointer": "/auth_code"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Domain not found",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "TLD Not supported by the API",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Domain registration term would exceed maximum",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "No registrant contact provided and no default address book entry found for this account."
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "A workflow already exists for this resource. Use GET status to check its progress."
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
Returns Examples
{
  "errors": [],
  "messages": [],
  "result": {
    "completed": false,
    "context": {
      "domain_name": "example.com"
    },
    "created_at": "2025-10-27T10:00:00Z",
    "links": {
      "resource": "/accounts/abc/registrar/registrations/example.com",
      "self": "/accounts/abc/registrar/registrations/example.com/transfer-in-status"
    },
    "state": "pending",
    "updated_at": "2025-10-27T10:00:01Z"
  },
  "success": true
}
{
  "errors": [
    {
      "code": 10000,
      "message": "object at root is missing required properties: auth_code",
      "source": {
        "pointer": "/auth_code"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Auth code must be a base64 encoded string",
      "source": {
        "pointer": "/auth_code"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Domain not found",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "TLD Not supported by the API",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "Domain registration term would exceed maximum",
      "source": {
        "pointer": "/domain_name"
      }
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "No registrant contact provided and no default address book entry found for this account."
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}
{
  "errors": [
    {
      "code": 10000,
      "message": "A workflow already exists for this resource. Use GET status to check its progress."
    }
  ],
  "messages": [],
  "result": null,
  "success": false
}