Subject: Unable to obtain EPP/Auth code for domain custom domain transfer

Question

Subject: Unable to obtain EPP/Auth code for domain custom domain transfer

Thomas Kwaks 0

On this site https://azure.github.io/AppService/2021/09/22/2021-Managing-ASD#transfering-domain-out there is a description how to retrieve a transfer code for a custom domain. The problem is:

Using the

PUT https://management.azure.com/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP-NAME>/providers/Microsoft.DomainRegistration/domains/<DOMAIN-NAME>/transferout?api-version=2021-02-01

with multiple PowerShell environments I receive a Error: DomainResellerWebService_INVALID_BODY using a Invoke method

Request: Please provide the authorization (EPP) code for domain my custom domain to enable transfer to an external registrar.

Impact: Domain migration blocked pending auth code retrieval.

Aditya N 3,810 Reputation points Microsoft External Staff Moderator

2026-08-15T10:13:22.18+00:00

Hello @Thomas Kwaks

Please could you let us know if you had a chance to review the suggestion provided. Please feel free to let us know if you face any issues.
65928441 0 Reputation points

2026-08-21T14:42:28.8766667+00:00
hello@Thomas Kwaks

The DomainResellerWebService_INVALID_BODY error occurs because the Azure Domain Registration transferout API endpoint expects a valid JSON body payload with the PUT request, even if it's an empty object. When no payload parameter is supplied during the Invoke call, the underlying web service fails validation.

Here is how you can resolve this and retrieve your EPP/Authorization code immediately:

Solution 1: Pass an Empty JSON Payload in PowerShell

If you are using Invoke-AzRestMethod, explicitly pass -Payload "{}" to fulfill the request body requiremen

PowerShell

Invoke-AzRestMethod

Solution 2: Use Azure Cloud Shell

If local environment execution continues to fail:

Log into the Azure Portal and open Cloud Shell (top right icon).

Switch the environment mode to PowerShell.

Run the command with the -Payload "{}" parameter as shown above.

Solution 3: Retrieve via Azure Resource Explorer

Navigate to Azure Resource Explorer.

Locate your domain under subscriptions > resourceGroups > providers > Microsoft.DomainRegistration > domains.

Append /transferout?api-version=2021-02-01 to the path, select PUT, and submit.

Once executed, check the response JSON for the authCode property to proceed with your external registrar migration.The DomainResellerWebService_INVALID_BODY error occurs because the Azure Domain Registration transferout API endpoint expects a valid JSON body payload with the PUT request, even if it's an empty object. When no payload parameter is supplied during the Invoke call, the underlying web service fails validation.

Here is how you can resolve this and retrieve your EPP/Authorization code immediately:

Solution 1: Pass an Empty JSON Payload in PowerShell

If you are using Invoke-AzRestMethod, explicitly pass -Payload "{}" to fulfill the request body requirement:

PowerShell

Invoke-AzRestMethod

Solution 2: Use Azure Cloud Shell

If local environment execution continues to fail:

Log into the Azure Portal and open Cloud Shell (top right icon).

Switch the environment mode to PowerShell.

Run the command with the -Payload "{}" parameter as shown above.

Solution 3: Retrieve via Azure Resource Explorer

Navigate to Azure Resource Explorer

Locate your domain under subscriptions > resourceGroups > providers > Microsoft.DomainRegistration > domains.

Append /transferout?api-version=2021-02-01 to the path, select PUT, and submit.

Once executed, check the response JSON for the authCode property to proceed with your external registrar migration.

3 answers

Your answer

Aditya N 3,810 Reputation points Microsoft External Staff Moderator

2026-08-15T10:13:22.18+00:00

Hello @Thomas Kwaks

Please could you let us know if you had a chance to review the suggestion provided. Please feel free to let us know if you face any issues.

Answer 1

The important fix is to send an explicit empty JSON body. The blog example shows a bare PUT, but in some PowerShell environments the backend can reject the request with:

DomainResellerWebService_INVALID_BODY


  ```powershell
  Try This:$subscriptionId = "<subscription-id>"
  $resourceGroupName = "<resource-group-name>"
  $domainName = "<your-domain.com>"
  Connect-AzAccount
  Set-AzContext -Subscription $subscriptionId
  $path = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.DomainRegistration/domains/$domainName/transferout?api-version=2021-02-01"
  $response = Invoke-AzRestMethod `
    -Method PUT `
    -Path $path `
    -Payload "{}"
  $response.Content | ConvertFrom-Json

The response should contain an authCode value. That is the EPP/authorization code needed by the new registrar.

If that still fails, try the raw ARM request with an explicit content type:

$token = Get-AzAccessToken -ResourceUrl "https://management.azure.com/"
$accessToken = if ($token.Token -is [securestring]) {
  [System.Net.NetworkCredential]::new("", $token.Token).Password
} else {
  $token.Token
}

$uri = "https://management.azure.com/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.DomainRegistration/domains/$domainName/transferout?api-version=2021-02-01"

Invoke-RestMethod `
  -Method Put `
  -Uri $uri `
  -Headers @{
    Authorization = "Bearer $accessToken"
    "Content-Type" = "application/json"
  } `
  -Body "{}"

Also make sure the domain name is the App Service Domain resource name, for example example.com, not www.example.com.

A few other things to check:

The domain may not be transferable within 60 days of new registration, registrar transfer, or registrant contact changes.
.uk domains are handled differently and usually require Azure Support to update the IPS tag.
If local PowerShell fails, try Azure Cloud Shell PowerShell to rule out local module or environment issues.

If the API still returns DomainResellerWebService_INVALID_BODY even with body {}, then it is likely a backend/domain-reseller issue and should be raised with Azure Support.The important fix is to send an explicit empty JSON body.

Thomas Kwaks 0 Reputation points

2026-08-13T08:54:17.76+00:00

both solutions return a DomainResellerWebService_INVALID_BODY even with a empty body, the domain reseller is Wildwest domains.com
Sreetheja Adusumilli 965 Reputation points Microsoft External Staff Moderator

2026-08-13T12:45:00.7566667+00:00

@Thomas Kwaks : We sincerely apologize to hear that the issue has not yet been resolved. Your satisfaction is important to us, and we are committed to working with you toward a resolution. Please share your email ID, feasible time to connect in Private Message.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 3

Aditya N 3,810 Microsoft External Staff Moderator

Hello @Thomas Kwaks

Thank you for reaching out Microsoft Q&A.

As you're using powershell, please could you use

Invoke-AzRestMethod -Path "/subscriptions/<SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP-NAME>/providers/Microsoft.DomainRegistration/domains/<DOMAIN-NAME>/transferout?api-version=2021-02-01" -Method PUT

Upon successful response, you can find the authcode under properties.

However please ensure that your domain lock should be off and domain registration has crossed 60 days.

Also please domain privacy is disabled as it is needed for domain transfer. You can find the attribute below

Azure Portal > App Service Domain > Advanced management (preview) > Domain privacy

Thomas Kwaks 0 Reputation points

2026-08-21T13:58:15.74+00:00

As you requested the Domain privacy is Disabled.

Recieved following Http Return value

StatusCode : 400

Content : {

   "Code": "DomainResellerWebService_INVALID_BODY",

   "Message": null,

   "Target": null,

   "Details": [

   {

   "Message": null

   },

   {

   "Code": "DomainResellerWebService_INVALID_BODY"

   },

   {

   "ErrorEntity": null

   }

   ],

   "Innererror": null

   }

<<<Moderator - PII removed>>>

Method : PUT

RequestUri : https://management.azure.com/subscriptions/{SubscriptionID}/resourceGroups/{ResourceGroupName}/providers/Microsoft.DomainRegistration/domains/{DomainName}/transferout?api-version=2021-02-01

Version : 1.1
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Saritha Bandaru 660 Reputation points Microsoft External Staff Moderator

2026-08-22T06:03:34.6166667+00:00

Hello @Thomas Kwaks We’ve been trying to reach you via private message. Could you please check your private messages and send us the requested details? Thanks
Aditya N 3,810 Reputation points Microsoft External Staff Moderator

2026-08-22T13:05:30.3833333+00:00

Hello @Thomas Kwaks

Please could you clarify if you have passed the correct values for "subscription", "resourceGroupName", "DomainName" in the above URI?

For checking the parameters, please could you provide the exact command you have used in private message.

Subject: Unable to obtain EPP/Auth code for domain custom domain transfer

Solution 1: Pass an Empty JSON Payload in PowerShell

Solution 2: Use Azure Cloud Shell

Solution 3: Retrieve via Azure Resource Explorer

Solution 1: Pass an Empty JSON Payload in PowerShell

Solution 2: Use Azure Cloud Shell

Solution 3: Retrieve via Azure Resource Explorer

3 answers

Your answer