---
title: "Get latest verification code / magic link"
method: GET
path: "/v1/inboxes/{inbox_id}/verification"
tags: ["Messages"]
---

# Get latest verification code / magic link

`GET /v1/inboxes/{inbox_id}/verification`

## Request

- Base URL: `https://api.deadsimple.email`
- URL: `https://api.deadsimple.email/v1/inboxes/{inbox_id}/verification`
- Auth: HTTP bearer

Agent self-onboarding in one call. Returns the one-time code (OTP) or magic link from the most recent inbound message in this inbox, so an agent can sign up for a service or complete 2FA without parsing email bodies — from any language, no MCP required. Non-blocking: it scans recent inbound mail and returns immediately (found=false if nothing has arrived yet), so poll it on a short interval after triggering the signup.

## Path parameters

- `inbox_id` string, required

## Query parameters

- `from_contains` string
- `since` string, date-time
- `window` integer

## Headers

- `X-Workspace-Id` string, uuid

## Response `200`

The extracted verification data, or found=false if none yet.

- object
  - `found` boolean
  - `verification_code` string, nullable
  - `magic_link_url` string, nullable
  - `expires_in` string, nullable
  - `message_id` string
  - `from_email` string
  - `received_at` string, date-time

## Other responses

- `402`: Payment required. The request had no API key and this route can be paid per call. The x402 requirements are in the PAYMENT-REQUIRED header and repeated in the body; routes priced at or above $0.50 (inbox creation) also carry a Stripe MPP challenge in WWW-Authenticate. A rejected or mismatched payment gets this same response again with error.reason explaining why. Responses are Cache-Control no-store and expose the payment headers to browsers.

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)