---
title: "Change the email with the token from the link sent to the new address. No credential. The token works once"
method: POST
path: "/v1/me/email/confirm"
---

# Change the email with the token from the link sent to the new address. No credential. The token works once

`POST /v1/me/email/confirm`

## Request

- Base URL: `https://api.evictionsapi.com`
- URL: `https://api.evictionsapi.com/v1/me/email/confirm`
- Auth: none required

## Request body

- object
  - `token` string, required

## Response `200`

The account view, with the new address, confirmed. Sessions are kept; password reset links sent to the old address stop working. An `Idempotency-Key` header is ignored.

- object
  - `user` object, required
    - `id` string, required
    - `name` string, nullable, required
    - `email` string, required
    - `role` 'customer' | 'attorney' | 'platform_admin', required: The kind of account. The person's role in an organization is the top-level `role`.
    - `emailConfirmed` boolean, required: Whether the person confirmed this address (with the emailed link, or by signing in with Google). Nothing depends on it: an unconfirmed account works the same.
    - `hasPassword` boolean, required: Whether the account has a password (an account made with Google has none until one is set).
    - `googleLinked` boolean, required: Whether a Google account is linked, so the person can sign in with Google.
  - `organization` object, nullable, required: The organization this session acts for; null when the person belongs to none.
    - `id` string, required
    - `name` string, required
    - `verified` boolean, required
    - `kind` unknown, required
    - `contactEmail` string, nullable, required
    - `contactPhone` string, nullable, required
    - `contactAddress` string, nullable, required
    - `billingEmail` string, nullable, required
  - `role` unknown, required
  - `permissions` string[], required: What the person may change in that organization. Reading needs no permission. Empty without an organization.
  - `organizations` object[], required: Every organization the person belongs to, oldest membership first.
    - `id` string, required
    - `name` string, required
    - `kind` unknown, required
    - `role` 'owner' | 'member' | 'viewer' | 'custom', required
    - `caseEmails` 'all' | 'mine' | 'none', required: Which of the organization's case emails the person gets: all, only cases they opened, or none (`PATCH /v1/me/organizations/:id`).
  - `modes` object, required: The modes this server offers. `test` is always true.
    - `test` boolean, required
    - `live` boolean, required

## Other responses

- `404`: `email_change_invalid`: the token is unknown, already used, replaced by a newer one or expired.
- `409`: `email_taken`: an account took that address meanwhile. Nothing changed.
- `413`: The request body is too large.
- `429`: `rate_limited`: at most 10 every 10 minutes from one address, counting `POST /v1/me/email` too. `Retry-After` gives the seconds to wait.

---

[API](https://skmtc.dev/evictionsapi/apis/evictions-api.md) · [All operations](https://skmtc.dev/evictionsapi/apis/evictions-api/llms.txt) · [OpenAPI document](https://skmtc.dev/evictionsapi/apis/evictions-api/revisions/28459213a1a3?raw)