# Lock a domain (https://developer.godaddy.com/en/docs/api-users/manage-domains/lock)

***

title: Lock a domain
description: Read and toggle the registry transfer-lock state on a domain you own. Unlock only when a transfer or registrant change requires it.
agentNotes:
permissions: \["Domain Owner"]
scopes: \["domains.domain:read", "domains.domain:update"]
rateLimit: "Rate-limited per credential per window. Go to /docs/api-users/rate-limits for current values."
idempotent: true
destructive: false
failureRecovery: "Idempotent — locking an already-locked domain is a no-op. Prefer GET-before-PATCH to confirm current state on error retries."
related:
apis:

* title: "Domains v1 — Update domain"
  href: "/docs/references/rest/domains/v1/manage-domain-settings"
  guides:
* title: "Update contacts"
  href: "/docs/api-users/manage-domains/update-contacts"
  concepts:
* title: "Handle errors"
  href: "/docs/api-users/errors"

***

## Overview

Registry lock sets the `clientTransferProhibited` flag at the domain registry, preventing any registrar from initiating an outbound transfer without your explicit consent. Lock is enabled by default at registration and has no effect on DNS resolution, email delivery, or any service hosted on the domain. Disable it only for the duration of a transfer or registrant change, then re-enable it immediately.

Lock state is a field on the `DomainDetail` object, read with `GET /v1/domains/{domain}` and toggled with `PATCH /v1/domains/{domain}`.

Registry lock management isn't available in v3 yet. This page uses the v1 endpoint (`PATCH /v1/domains/{domain}`).

## Prerequisites

The following prerequisites are required before you manage registry lock:

* A GoDaddy account that owns the domain
* A [Personal Access Token](https://developer.godaddy.com/docs/api-users/auth) with `domains.domain:read` and `domains.domain:update` scopes

## Read lock state

Returns the full `DomainDetail` object. The `locked` boolean is `true` when `clientTransferProhibited` is set at the registry.

The following procedure reads the lock state for a domain.

* Run the following command:

```bash
curl -s "https://api.godaddy.com/v1/domains/example.com" \
  -H "Authorization: Bearer $GODADDY_PAT" \
  -H "Accept: application/json"
```

```json
{
  "domain": "example.com",
  "status": "ACTIVE",
  "locked": true,
  "renewAuto": true,
  "expires": "2026-03-15T00:00:00.000Z"
}
```

## Enable lock

Send `{"locked": true}` to the domain update endpoint. Returns `204 No Content`. Idempotent — locking an already-locked domain is a no-op.

The following procedure enables the registry transfer-lock on a domain.

* Run the following command for your preferred language:

```bash tab="curl"
curl -s -X PATCH "https://api.godaddy.com/v1/domains/example.com" \
  -H "Authorization: Bearer $GODADDY_PAT" \
  -H "Content-Type: application/json" \
  -d '{"locked": true}'
```

```js tab="Node"
const pat = process.env.GODADDY_PAT;
const res = await fetch("https://api.godaddy.com/v1/domains/example.com", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${pat}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ locked: true }),
});
console.log(res.status); // expect 204
```

```python tab="Python"
import os, requests

res = requests.patch(
    "https://api.godaddy.com/v1/domains/example.com",
    json={"locked": True},
    headers={
        "Authorization": f"Bearer {os.environ['GODADDY_PAT']}",
        "Content-Type": "application/json",
    },
)
print(res.status_code)  # expect 204
```

```go tab="Go"
package main

import (
    "bytes"
    "fmt"
    "net/http"
    "os"
)

func main() {
    body := bytes.NewReader([]byte(`{"locked": true}`))
    req, _ := http.NewRequest("PATCH",
        "https://api.godaddy.com/v1/domains/example.com", body)
    req.Header.Set("Authorization", "Bearer "+os.Getenv("GODADDY_PAT"))
    req.Header.Set("Content-Type", "application/json")
    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()
    fmt.Println(res.StatusCode) // expect 204
}
```

## Disable lock

Send `{"locked": false}` to release the transfer-lock. Returns `204 No Content`.

The following procedure disables the registry transfer-lock on a domain.

Unlock only for as long as the transfer or registrant change requires. Once the operation completes, re-enable lock with `{"locked": true}`. High-value and production-serving domains should be locked at all other times.

* Run the following command for your preferred language:

```bash tab="curl"
curl -s -X PATCH "https://api.godaddy.com/v1/domains/example.com" \
  -H "Authorization: Bearer $GODADDY_PAT" \
  -H "Content-Type: application/json" \
  -d '{"locked": false}'
```

```js tab="Node"
const pat = process.env.GODADDY_PAT;
const res = await fetch("https://api.godaddy.com/v1/domains/example.com", {
  method: "PATCH",
  headers: {
    Authorization: `Bearer ${pat}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ locked: false }),
});
console.log(res.status); // expect 204
```

```python tab="Python"
import os, requests

res = requests.patch(
    "https://api.godaddy.com/v1/domains/example.com",
    json={"locked": False},
    headers={
        "Authorization": f"Bearer {os.environ['GODADDY_PAT']}",
        "Content-Type": "application/json",
    },
)
print(res.status_code)  # expect 204
```

```go tab="Go"
package main

import (
    "bytes"
    "fmt"
    "net/http"
    "os"
)

func main() {
    body := bytes.NewReader([]byte(`{"locked": false}`))
    req, _ := http.NewRequest("PATCH",
        "https://api.godaddy.com/v1/domains/example.com", body)
    req.Header.Set("Authorization", "Bearer "+os.Getenv("GODADDY_PAT"))
    req.Header.Set("Content-Type", "application/json")
    res, _ := http.DefaultClient.Do(req)
    defer res.Body.Close()
    fmt.Println(res.StatusCode) // expect 204
}
```

## When to unlock

Two operations require the lock to be off before they can proceed:

| Scenario                           | Detail                                                                                                                                           |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Outbound transfer**              | The receiving registrar cannot initiate the transfer until lock is disabled.                                                                     |
| **Registrant change on some TLDs** | A subset of ccTLDs require unlock before the registry accepts a registrant update. Check the TLD's registry policy before attempting the change. |

Lock is enabled by default at registration. Leave it on at all other times — it has no effect on DNS resolution, email delivery, or any service hosted on the domain.

## Request body

`PATCH /v1/domains/{domain}` accepts a `DomainUpdate` object. Only the fields you include are updated.

| Field         | Type      | Description                                                                                                                 |
| ------------- | --------- | --------------------------------------------------------------------------------------------------------------------------- |
| `locked`      | boolean   | Whether to engage the registry transfer-lock.                                                                               |
| `renewAuto`   | boolean   | Whether auto-renew is enabled. See [Renewals](https://developer.godaddy.com/docs/api-users/manage-domains/renewals).                                     |
| `nameServers` | string\[] | Authoritative nameservers (apex). See [DNS → Manage nameservers](https://developer.godaddy.com/docs/api-users/manage-domains/dns#manage-nameservers-v2). |
| `exposeWhois` | boolean   | Whether contact details appear in WHOIS. Overridden by `privacy`.                                                           |

## Common errors

| Status | Most likely cause                                                 |
| ------ | ----------------------------------------------------------------- |
| `400`  | Malformed request body.                                           |
| `403`  | Credential lacks write access to this domain.                     |
| `404`  | Domain doesn't exist or isn't owned by the authenticated account. |
| `409`  | Conflicting operation in progress (e.g. mid-transfer).            |
| `422`  | Invalid field value.                                              |

Full error envelope: [Errors](https://developer.godaddy.com/docs/api-users/errors).

## Reference

* [v1 domain settings — domain update (`PATCH /v1/domains/{domain}`)](https://developer.godaddy.com/docs/references/rest/domains/v1/manage-domain-settings)

## Next