Consume an e-mail confirmation link.

POST 
/v1/auth/confirm

Marks the account e-mail verified. Single-use, 24 h expiry; a newer link supersedes older ones. 400 token_invalid covers every failure (unknown / expired / used / wrong purpose) — the endpoint is not a token oracle. No session is minted.

No authentication is required for this endpoint.

Request

Responses

200

E-mail verified.

400

Request was malformed or failed validation. The error.code field carries the machine-readable reason; common values include invalid_request, invalid_json, invalid_order_id, invalid_instrument_id, invalid_credential_id, invalid_resolution, and operation-specific codes documented per endpoint.

429

Too many attempts inside the fixed rate-limit window (10 attempts / 5 minutes per key). Retry in a few minutes.

500

Unexpected server error. Includes a correlation_id; report it when filing a bug.