Skip to content
ApiqDevelopers
API v1.64.0Open console
API referenceidentity

Confirm work email

POST/v1/activation/work-email:confirm
Idempotency-Key requiredAccepts bearer

Prove the work address with the e-mailed code — CAPPED flow only

email must be the address the latest code was sent to (400 VALIDATION details.field email otherwise) and code the 6 digits from that e-mail (400 VALIDATION details.field code when it is not six…Show moreemail must be the address the latest code was sent to (400 VALIDATION details.field email otherwise) and code the 6 digits from that e-mail (400 VALIDATION details.field code when it is not six digits). A wrong, expired, voided or never-sent code is 403 PERMISSION_DENIED details.reason STEP_UP_FAILED, and the 5th wrong attempt spends the code (STEP_UP_LOCKED until a new code is sent), as the terms code. On success the address is recorded as the tenant's verified work e-mail (ActivationState.workEmail.email and verifiedAt) and the guardrail is satisfied; the sign-in username does not change. Confirming the address already verified is a 200 with the first verifiedAt. On the NINE_STEP flow 409 CONFLICT details.reason FLOW_NOT_CAPPED. Human session only; Owner only (403 OWNER_ONLY). Idempotency-Key required. Audited (activation.work_email_verified, the address masked).

Headers

  • Idempotency-KeystringRequired
    Mandatory on mutations: **48h TTL**; replay with same body-hash returns the original response with Idempotency-Replayed true; same key + different body is 409 IDEMPOTENCY_CONFLICT; in-flight duplicate…Show moreMandatory on mutations: **48h TTL**; replay with same body-hash returns the original response with Idempotency-Replayed true; same key + different body is 409 IDEMPOTENCY_CONFLICT; in-flight duplicate is 409 IDEMPOTENCY_IN_PROGRESS.

Request bodyWorkEmailConfirmRequest

  • emailstring · emailRequired
    The address the latest code was sent to
  • codestringRequired
    The 6-digit code from the e-mail (15 minutes, at most 5 attempts)

Responses

  • 200The work e-mail, verifiedWorkEmail
  • 400VALIDATION — email is not the address the latest code went to (details.field email), or code is not six digits (details.field code)ApiErrorResponse
  • 401
    UNAUTHENTICATED — missing or expired token.Show moreUNAUTHENTICATED — missing or expired token. Declared on every operation because `security` is declared globally at the document root: every route is authenticated, so every route can answer 401.
    ApiErrorResponse
  • 403ApiErrorResponse
  • 405
    VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show moreVALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
    ApiErrorResponse
  • 409CONFLICT FLOW_NOT_CAPPED — the tenant is on the nine-step rail; or IDEMPOTENCY_CONFLICTApiErrorResponse
  • 413
    VALIDATION — the request body is larger than the surface's limit.Show moreVALIDATION — the request body is larger than the surface's limit. Not retryable as sent: shrink the body. Declared on every operation that takes a request body. details carries exactly one key, maxBodyBytes (integer): the limit that applies to this surface, in bytes.
    ApiErrorResponse
  • 414
    VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show moreVALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
    ApiErrorResponse
  • 415
    VALIDATION — a request body that is not JSON (application/json or application/*+json; a form body only on the OAuth token routes).Show moreVALIDATION — a request body that is not JSON (application/json or application/*+json; a form body only on the OAuth token routes). The public edge refuses it before the platform sees it (details.reason UNSUPPORTED_MEDIA_TYPE, details.source edge). Not retryable as sent: send Content-Type application/json. Declared on every operation that takes a JSON request body.
    ApiErrorResponse
  • 500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse
  • 501Not retryable; the nine-step rail of GET /v1/activation is unchanged.ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

400VALIDATION
Confirm the address the latest code was sent to.
not retryable
401UNAUTHENTICATED
The bearer token is expired. Re-authenticate and retry.
not retryable
403PERMISSION_DENIED
Reading wallets needs the finance:read permission.
not retryable
405VALIDATION
This method is not served.
not retryable
409CONFLICT
This tenant is on the nine-step activation; no work e-mail check is asked there.
not retryable
409IDEMPOTENCY_CONFLICT
Idempotency-Key 7f0c33d1-9a1e-4d2c-9f77-1c0f2b3a4d55 was used with a different body; never executed
not retryable
413VALIDATION
The request body is larger than this API accepts (262144 bytes).
not retryable
414VALIDATION
The request URI is longer than 8 KiB.
not retryable
415VALIDATION
Send application/json.
not retryable
500INTERNAL
An unexpected error occurred. Quote the traceId to support.
retryable
501NOT_IMPLEMENTED
The capped activation flow is not available on this deployment.
not retryable