Exchange the invited email's code for a proof.

POST

/api/v1/invitations/email-verification/verify

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/v1/invitations/email-verification/verify \
  --header 'Content-Type: application/json' \
  --data '{ "token": "example", "verification_id": "example", "code": "example" }'

Checks the code sent to the invited email (five attempts per code) and returns a proof, valid for 15 minutes, that passkey and authenticator-app signup starts take as invitation_email_proof.

Request Body ^required

Media type application/json

object

token

required

string

>= 32 characters

verification_id

required

string

code

required

string

/^\d{6}$/

key

additional properties

Example ^generated

{
  "token": "example",
  "verification_id": "example",
  "code": "example"
}

Responses

200

The code was right.

Media type application/json

object

invitation_email_proof

required

string

/^[A-Za-z0-9_-]{43}$/

expires_in

required

integer

Example

{
  "expires_in": 900
}

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

429

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}