---
title: "Complete mailbox verification with registration authority or mailbox takeover"
method: POST
path: "/auth/email-verification/confirm"
---

# Complete mailbox verification with registration authority or mailbox takeover

`POST /auth/email-verification/confirm`

## Request

- Base URL: `https://api.eurobase.dev`
- URL: `https://api.eurobase.dev/auth/email-verification/confirm`
- Auth: none declared

## Request body

- union
  - object
    - `token` string, required
    - `action` 'session'
  - object
    - `token` string, required
    - `action` 'login', required
    - `email` string, required
    - `password` string, required
    - `authChallenge` string: ADR 0088: base64 JSON {algorithm, challenge, number, salt, signature} solving a challenge this client received for this action; valid once within five minutes. Accepted in the JSON body of every step-up route.
  - object
    - `token` string, required
    - `action` 'takeover', required
    - `password` string, required: Existing 16–64-character NFKC password policy

## Response `200`

Verified, or login_required without consumption. Login/takeover sets the browser session cookie; no identity or raw token is returned.

- EmailVerificationConfirmationResponse
  - `ok` boolean, required
  - `status` 'verified' | 'login_required', required

## Other responses

- `400`: Unusable verification token, invalid action/email or password policy violation
- `401`: Invalid login credentials
- `429`: Persistent confirmation limit or canonical failed-password step-up: retry the same login action with authChallenge when required; correct passwords never enter step-up.
- `503`: Verification or bounded password hashing unavailable; no successful change is reported

---

[API](https://skmtc.dev/eurobase/apis/eurobase-api.md) · [All operations](https://skmtc.dev/eurobase/apis/eurobase-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eurobase/apis/eurobase-api/revisions/5266a299d18a?raw)