Verifying an email address

Verifying an email address from a verification link

Contents

• Overview
• Permissions and Authentication
• Headers
• HTTP Parameters
• Sample requests
• Sample response
• Possible error responses

Overview

• Call name: email-verify
• Endpoint URL: https://{API hostname}/auth/email-verify
• Request methods: POST
• Request Content-Types: application/json, application/x-www-form-urlencoded
• Response Content-Type: application/json
• Auth required: no

Completes the email verification link flow started by email-verify-request. The user does not need to be signed in: the verification token from the link is the proof of authorisation. On success the user's email_status is set to 1 (verified).

The token is single use and is valid for 3 days from the moment the verification email was requested. It is rejected if it is malformed, expired, has already been used, or if the chain's email_verification_method is no longer set to deeplink.

For an overview of both email verification flows, see Verifying user contact details.

Permissions and Authentication

This API call requires no session and no specific permissions. The verification token supplied in the nonce parameter is the proof of authorisation.

Headers

The following headers can/must be passed to the API call:

Parameter	Description
X-Spaaza-MyPrice-App-Hostname	(mandatory) The hostname of the app the user is affiliated with.
X-Spaaza-API-Version	(optional) The API version, see versioning.

HTTP Parameters

The following HTTP parameters can be passed to the API:

Parameter	Description
username	(string, mandatory) The username (email address) of the user whose email address is being verified.
nonce	(string, mandatory) The verification token from the link which was emailed to the user.

Sample requests

POST https://{API hostname}/auth/email-verify
Content-Type: application/json

{
    "username": "john.smith@example.com",
    "nonce": "2026-07-29T09:15:54Z9f2c1d0e8a7b6c5d4e3f2a1b0c9d8e7f"
}

POST https://{API hostname}/auth/email-verify
Content-Type: application/x-www-form-urlencoded

username=john.smith%40example.com&nonce=2026-07-29T09%3A15%3A54Z9f2c1d0e8a7b6c5d4e3f2a1b0c9d8e7f

Sample response

The response contains the user's user_info object, in the same form as returned by get-user, with email_status set to 1. Most user_info fields are omitted from the sample below for brevity.

{
    "result": {
        "code": 1,
        "status": "ok"
    },
    "results": {
        "result_type": "email-verify",
        "user_info": {
            "email_status": 1,
            "first_name": "John",
            "id": 3635922,
            "last_name": "Smith",
            "member_number": "500056883",
            "phone_number_status": 3,
            "user_id": 3635922,
            "username": "john.smith@example.com"
        }
    }
}

Possible error responses

The following represents a list of possible error responses for the email-verify endpoint:

Code	Name and Description	HTTP Status Code
3	http_vars_missing The username or nonce parameter is missing.	400
325	invalid_nonce The verification token is not valid, for example because it is malformed, its signature does not match, or the account is unknown.	400
326	expired_nonce The verification token has expired.	400
327	nonce_already_used The verification token has already been used.	400
559	email_verification_not_enabled The chain's email_verification_method is no longer set to deeplink.	400