Stops Domain Protection monitoring for one of the tenant's registered domains. Distinct from /domain/delete-domain, which deletes a SENDING domain verified for phishing simulations; this only affects the owned-domain monitoring registry, and the two are different tables.

A SOFT delete. The registry row flips to removed and stays as the audit trail; the reports already received are kept (aggregates survive for the 13-month retention window); the pipeline refuses the domain's reporting address from the next report onward; and the fleet-wide lock on the domain is released, so another account can register it. Re-adding the domain later resets the row wholesale and mints a NEW reporting address, so a DNS record still carrying the old one stops routing until it is updated. A repeat call after a successful remove is a 404, not a second write.

To stop the dashboards and alerts without giving the domain up, call set-protected-domain-paused instead: that keeps the reporting address, the fleet claim and the history.

Requires an Enterprise subscription (ErrorCode ENTERPRISE_REQUIRED; not satisfied by Professional, and get-entitlements.isEnterpriseEntitled does not imply it for partner-managed or staff-trial tenants). Platform Admin or Super Admin and a paid plan.