---
title: "Finish claiming a provisional workspace"
method: POST
path: "/v1/orgs/{org_id}/claim/verify"
---

# Finish claiming a provisional workspace

`POST /v1/orgs/{org_id}/claim/verify`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/orgs/{org_id}/claim/verify`
- Auth: HTTP bearer

Second half of the claim: org-key authed, with a timing-safe check of
the emailed OTP (3 attempts per challenge). Attaches an existing
account by email or creates one — a new account requires a password so
the claimed identity can sign back in. The claim is atomic; the API
key and every dossier minted before the claim survive. 10 requests per
minute.

## Path parameters

- `org_id` string, uuid, required

## Request body

- OrgClaimVerifyRequest
  - `owner_email` string, email, required
  - `otp_code` string, required
  - `password` string: Required only when the email has no existing account — it becomes sign-in.
  - `name` string

## Response `200`

Workspace claimed; a signed account session cookie is set

- OrgClaimVerifyResponse
  - `claimed` boolean, required
  - `org` object, required
    - `id` string, uuid
    - `name` string, nullable
  - `user` object, required
    - `id` string
    - `email` string, email
    - `name` string, nullable
  - `existing_user` boolean
  - `next` object: Workspace and onboarding paths for the newly attached owner.

## Other responses

- `400`: Structured API error
- `401`: OTP invalid, expired, or attempt cap reached
- `404`: Structured API error
- `409`: Already claimed, or the OTP was already used
- `503`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)