I'm not entirely sure what you mean by this
When I receive the request I want to verify the third party domain from which it originated - to ensure someone is not submitting requests pretending to be another domain.
For example, here's the HTTP request that my browser made to load this page:
GET /questions/196706/verify-the-requesting-domain HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:64.0) Gecko/20100101
Accept-Encoding: gzip, deflate
Cookie: ... snip ....
Nothing in there indicates which domain my web browser is coming from. I'm not even sure I know what that means.
Maybe you mean that your API will be accessed from pages served from other domains and you want to mine the
Either way, the client-server architecture of HTTP means that there is no security here; the client can literally put whatever it wants in the request and the server has no way to verify if it's "correct". Whether it's using HTTP or HTTPS makes no difference here.
Consider the following cURL command which shows that I can craft an HTTP request with any header text I want, and then send it to any server I want:
curl -X GET -H "Accept: text/html" -H "Referer: https://my.domain.com/somepage" https://someHostName/someEndpoint
Solution: Mutual-auth (aka "client auth") TLS
It sounds like the solution you're looking for is mutually-authenticated TLS, which is designed precisely to force the client to prove its identity before the server will open a connection.
This would involve issuing certificates to your clients (just like you do with your server), and then configuring your server to only accept incoming connections from trusted certificates.