---
title: "Guest Email"
method: POST
path: "/auth/guest-email"
tags: ["auth"]
---

# Guest Email

`POST /auth/guest-email`

## Request

- Base URL: `https://api.helloaxel.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.helloaxel.com/auth/guest-email`
- Auth: HTTP bearer

A guest gives one email at Book and goes straight into checkout.

Needs the guest's anonymous session. Creates the Users row for this same
Supabase id with the email UNVERIFIED and no phone, so checkout works at
once; tickets and receipts go to this email. Users binds the address as
the account's email login. Nothing is mailed by this save, so it does
not consume the allowance for sending verification codes.

A repeat call answers the same; an email guest may correct the address
before verifying it. 409 ``email_exists`` when the email belongs to another
account, with ``login_with``: "phone" (log in with the phone code; most
accounts), "email" (log in with an email code) or null (that account has
not verified anything; ask for another email); then resume the flight. 403
``guest_disabled`` when ParamStore ``guest_checkout.enabled`` is off.

## Request body

- GuestEmailRequest: The one email a guest gives at Book (no phone, no code).
  - `email` string, email, required
  - `tracking` RegistrationTrackingData: Tracking data sent FROM THE FRONTEND during registration.
    - `meta` MetaTrackingData: Meta-specific tracking data sent from the frontend.
      - `fbp` string, nullable
      - `fbc` string, nullable
      - `event_id` string, nullable
    - `attribution` AttributionData: First, latest, and separately preserved latest paid attribution.
      - `first_touch` AttributionTouch: A single captured attribution touch.
        - `attribution_version` integer
        - `captured_at` string, date-time, nullable
        - `landing_path` string, nullable
        - `referrer_path` string, nullable
        - `capture_state` 'observed_no_referrer', nullable
        - `utm_source` string, nullable
        - `utm_medium` string, nullable
        - `utm_campaign` string, nullable
        - `utm_content` string, nullable
        - `utm_term` string, nullable
        - `utm_id` string, nullable
        - `utm_adgroup` string, nullable
        - `utm_asset_group` string, nullable
        - `utm_creative` string, nullable
        - `utm_content_id` string, nullable
        - `utm_placement` string, nullable
        - `fbclid` string, nullable
        - `twclid` string, nullable
        - `ttclid` string, nullable
        - `oppref` string, nullable
        - `gclid` string, nullable
        - `gbraid` string, nullable
        - `wbraid` string, nullable
        - `partnership_code` string, nullable
        - `transaction_id` string, nullable
        - `creative_id` string, nullable
      - `last_touch` AttributionTouch: A single captured attribution touch.
        - `attribution_version` integer
        - `captured_at` string, date-time, nullable
        - `landing_path` string, nullable
        - `referrer_path` string, nullable
        - `capture_state` 'observed_no_referrer', nullable
        - `utm_source` string, nullable
        - `utm_medium` string, nullable
        - `utm_campaign` string, nullable
        - `utm_content` string, nullable
        - `utm_term` string, nullable
        - `utm_id` string, nullable
        - `utm_adgroup` string, nullable
        - `utm_asset_group` string, nullable
        - `utm_creative` string, nullable
        - `utm_content_id` string, nullable
        - `utm_placement` string, nullable
        - `fbclid` string, nullable
        - `twclid` string, nullable
        - `ttclid` string, nullable
        - `oppref` string, nullable
        - `gclid` string, nullable
        - `gbraid` string, nullable
        - `wbraid` string, nullable
        - `partnership_code` string, nullable
        - `transaction_id` string, nullable
        - `creative_id` string, nullable
      - `last_paid_touch` AttributionTouch: A single captured attribution touch.
        - `attribution_version` integer
        - `captured_at` string, date-time, nullable
        - `landing_path` string, nullable
        - `referrer_path` string, nullable
        - `capture_state` 'observed_no_referrer', nullable
        - `utm_source` string, nullable
        - `utm_medium` string, nullable
        - `utm_campaign` string, nullable
        - `utm_content` string, nullable
        - `utm_term` string, nullable
        - `utm_id` string, nullable
        - `utm_adgroup` string, nullable
        - `utm_asset_group` string, nullable
        - `utm_creative` string, nullable
        - `utm_content_id` string, nullable
        - `utm_placement` string, nullable
        - `fbclid` string, nullable
        - `twclid` string, nullable
        - `ttclid` string, nullable
        - `oppref` string, nullable
        - `gclid` string, nullable
        - `gbraid` string, nullable
        - `wbraid` string, nullable
        - `partnership_code` string, nullable
        - `transaction_id` string, nullable
        - `creative_id` string, nullable
    - `event_source_url` string, nullable
  - `timezone` string, nullable

## Response `200`

Successful Response

- GuestEmailResponse: The guest now has an account under the same id; continue to checkout.
  - `status` 'created'
  - `email` string, email, required: The email tickets and receipts go to.
  - `account_created` boolean: True only on the call that created the account: that call is the sign-up, sent to Meta, Google and X under the request's tracking.meta.event_id, which the web reuses for its sign_up push. False on a repeat call.

## Other responses

- `403`: guest_disabled, guest_only or account_banned
- `409`: email_exists: the email belongs to another account; login_with says how it signs in (phone, email or null)
- `422`: Validation Error

## Changes

> 68 revisions in range; 1 not diffed.

- **2026-10-19** `76e08e393f15`: 1 info
  - removed the non-success response with the status `429`
- **2026-10-15** `ba2f26081946`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/helloaxel/apis/client-api-gateway/changes/auth/guest-email/post.md)

---

[API](https://skmtc.dev/helloaxel/apis/client-api-gateway.md) · [All operations](https://skmtc.dev/helloaxel/apis/client-api-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/helloaxel/apis/client-api-gateway/revisions/8824999a7a0a?raw)