---
title: "Verify a Right Token by hash-matching its verificationCode (no auth)"
method: POST
path: "/api/rightos/tokens/{tokenId}/verify"
tags: ["tokens"]
---

# Verify a Right Token by hash-matching its verificationCode (no auth)

`POST /api/rightos/tokens/{tokenId}/verify`

## Request

- Base URL: `https://rightos.i-s3.com`
- URL: `https://rightos.i-s3.com/api/rightos/tokens/{tokenId}/verify`
- Auth: none required

Hash-compares the presented verificationCode. The result is recorded in the verification log. Rate limited against brute force: 10/min per IP+token, 60/min per IP.

## Path parameters

- `tokenId` string, required

## Request body

- object
  - `verificationCode` string, required

## Response `200`

Verification outcome

- object
  - `result` 'success' | 'failed' | 'expired' | 'cancelled' | 'already_used' | 'not_yet_valid'
  - `token` RightToken: Public Right Token. The secretHash is never exposed by any endpoint.
    - `id` string
    - `organizationId` string
    - `locationId` string
    - `title` string
    - `description` string
    - `startTime` string, date-time
    - `endTime` string, date-time
    - `priorityNumber` integer: Daily issue sequence at this location (includes cancelled/used/expired). Not the live queue position — see queuePosition
    - `queuePosition` integer: Position in the active queue at issuance (issued + verified, not expired). ADR-0024
    - `status` 'issued' | 'verified' | 'used' | 'cancelled' | 'expired'
    - `transferCount` integer: Number of times transferred. 0 = original holder.
    - `createdAt` string, date-time
    - `usedAt` string, date-time
    - `cancelledAt` string, date-time
    - `transferredAt` string, date-time

## Other responses

- `429`: Rate limit exceeded (HTTP 429). See Retry-After header. Limits: verify/transfer = 10/min per IP+token and 60/min per IP; signup = 5/hour per IP.

---

[API](https://skmtc.dev/i-s3/apis/rightos-right-api.md) · [All operations](https://skmtc.dev/i-s3/apis/rightos-right-api/llms.txt) · [OpenAPI document](https://skmtc.dev/i-s3/apis/rightos-right-api/revisions/10020536e345?raw)