CAcausaprima

Request a sender email-ownership challenge

Changed on

Emails an 8-character verification code (and magic link) to the address. Always returns a uniform 202 — new, returning, throttled, and send-failed callers are indistinguishable (anti-enumeration). Sends are rate-limited per email (resend cooldown + hourly cap). The poll_secret authorizes the snapshot and event-stream endpoints for this challenge; to ask again for the same address, present it in x-scribo-verification-secret.

post/api/v1/scribo/email-verifications

Request

Headers

x-scribo-verification-secretstring

Optional. poll_secrets from your earlier requests for this address, comma-separated, at most ten. Inside the resend cooldown or over the per-IP limit no email is sent, and only a request presenting a pending challenge's secret gets that challenge back; anyone else gets a challenge_id the emailed code does not redeem.

Request body

emailstring email required

Response

Challenge accepted (uniform anti-enumeration shape)

challenge_idstring uuid required
poll_secretstring required

Secret for the snapshot and event-stream endpoints of this challenge, sent there as the x-scribo-verification-secret header. Treat it like a password and never put it in a URL. Every response carries one; only the request that created the challenge, or a later one presenting that secret, gets one those endpoints accept.

expires_atstring date-time required
next_request_allowed_atstring date-time required

Changes

  • a70793880b45Revision changes
    • info

      added the new optional header request parameter x-scribo-verification-secret

  • 26d0ac79c526Revision changes
    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

    • info

      added the required property to the response with the status