Spend an email verification token
Single use. Unknown, expired, already spent and belonging to a disabled account are one outcome and one status code: the consuming UPDATE is the check, so there is nothing to distinguish even if the handler wanted to.
Single use. Unknown, expired, already spent and belonging to a disabled account are one outcome and one status code: the consuming UPDATE is the check, so there is nothing to distinguish even if the handler wanted to.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/console/v1/email-verifications" \ -H "Authorization: Bearer apf_v2_tu_credencial" \ -H "Content-Type: application/json" \ -d '{ "token": "stringst" }'Create an account and its first organization POST POST
Answers 202 with the same body whether or not the address was already registered, and pays the same Argon2id cost either way, so neither the response nor its duration is an oracle for who has an account. The registrant becomes the OWNER of a new organization -- the only way to become an OWNER other than being promoted by one. The organization starts with no companies; the registrant attaches one through POST /console/v1/organizations/{organizationId}/companies, which migration 000065 added. This sentence used to say the opposite -- that attaching was deliberately impossible -- and it is the fourth copy of that claim found after the route shipped, which is what a fact repeated in prose costs when nothing compares prose to paths.
Log in POST POST
Sets the session cookie. When the account has TOTP enrolled and no totpCode was supplied -- or the code was replayed -- the answer is 401 MFA_REQUIRED and NO cookie; resend the same body with the code. There is no intermediate ticket, because a ticket is a second session-shaped secret with its own theft story. Every failure below a correct password is one indistinguishable 401 that costs one Argon2id verification, including for an address that was never registered.