---
title: "Resend a sender confirmation"
method: POST
path: "/account/authorized-senders/{senderId}/resend-confirmation"
tags: ["Account"]
---

# Resend a sender confirmation

`POST /account/authorized-senders/{senderId}/resend-confirmation`

## Request

- Base URL: `https://inkseal.net/api/v1`
- URL: `https://inkseal.net/api/v1/account/authorized-senders/{senderId}/resend-confirmation`
- Auth: HTTP bearer

Mails a fresh confirmation link to a `pending` address a workspace person has already approved, and invalidates the previous one.

This emails a real person, so send an `Idempotency-Key` and do not loop on it. Only a `pending` grant can be resent to: an `active` one answers `409` `invalid_state`, because re-issuing would drop it back to `pending`. A grant with `awaitingApproval: true` answers `403` `forbidden`: a credential cannot send the first link, because sending it is the approval, and only a workspace owner or admin can give that from the dashboard.

## Headers

- `Idempotency-Key` string

## Response `200`

The grant, still `pending`, and whether the confirmation email went out.

- object
  - `data` object, required
    - `sender` AuthorizedSender, required: One address the mail agent will accept documents from. The grant belongs to the workspace, and it authorizes nothing until a workspace person has approved it and the mailbox it names has confirmed it.
      - `id` string, required: The grant's public identifier.
      - `email` string, email, required: The address mail must come from. Matching is case-insensitive, and one address can hold only one grant per workspace.
      - `kind` 'owner' | 'alias' | 'delegate', required: `owner` is the workspace owner's own address, authorized by construction and neither enrollable nor revocable here. It authorizes only while it is still the owner's address; one left by a former owner or an old address authorizes nothing and can be revoked. `alias` is another address of someone already in the workspace, `delegate` is somebody else acting for it; the two carry identical trust and differ only as a label for the humans reading the list.
      - `status` 'pending' | 'active' | 'revoked', required: `pending`: not yet confirmed, so mail from this address is still refused. Either a confirmation link was mailed and has not been used, or, when `awaitingApproval` is true, no link exists yet. `active`: confirmed, and mail from it is processed. `revoked`: it was trusted once and is not now.
      - `confirmationSentAt` string, date-time, nullable, required: When the most recent confirmation link was mailed.
      - `expiresAt` string, date-time, nullable, required: While `pending`, the deadline for using the confirmation link. Cleared on confirmation, so an active grant ordinarily carries none.
      - `lastUsedAt` string, date-time, nullable, required: When a message from this address was last accepted, or null if never.
      - `awaitingApproval` boolean, required: True when this non-owner grant has no recorded workspace person approving it. No confirmation can activate it until an owner or admin approves in the dashboard. Legacy active rows lacking an approver also authorize nothing and require review.
      - `createdAt` string, date-time, required
      - `updatedAt` string, date-time, required
    - `confirmationEmailSent` boolean, required: Whether the confirmation email was accepted for delivery. False means the grant exists and is `pending` but nothing was mailed; call the resend operation to try again.

## Other responses

- `401`: The credential is missing, malformed, unknown, expired, revoked, or past its rotation grace window. Code: `unauthorized`. Every authentication failure is deliberately indistinguishable.
- `403`: The credential is valid but may not do this. Codes: `insufficient_scope` (the route's scopes are not all held; `details` names `requiredScopes` and `missingScopes`), `forbidden` (the capability check on the resolved resource failed), `scope_escalation` (a grant wider than the caller's own was requested).
- `404`: The resource does not exist, was deleted, or belongs to another workspace. Code: `not_found`. The three cases are answered identically on purpose, so a 404 never confirms that an identifier exists elsewhere.
- `409`: The resource's state forbids this transition, or another request owns the work. Codes: `invalid_state`, `invalid_status`, `credential_state`, `limit_exceeded`, `envelope_missing`, `not_retryable`, `owner_unavailable`, `workspace_unavailable`, `detection_not_completed`, `document_in_use`, `version_conflict`, `document_processing`, `document_processing_failed`, `normalized_pdf_unavailable`, `pages_not_rendered`, `document_not_ready`, `idempotency_in_progress` (which also carries `Retry-After`), `payment_replayed` (a USDC payment signature presented twice), `payment_pending` (a USDC settlement whose outcome is not yet known).
- `422`: The request parsed but its content is not acceptable. Codes: `validation_error` (envelope configuration, with an `issues` array in `details`), `invalid_envelope`, `envelope_not_ready`, `document_page_limit`, `idempotency_key_reuse`.
- `429`: A limit was reached. Codes: `rate_limited` (the credential's per-bucket HTTP limit, or the per-workspace detection throttle), `workspace_limit_exceeded` (a workspace content or send limit; `details.limit` names it), `daily_budget_exceeded` (the workspace's daily detection budget). The four rate-limit headers are sent on this response and on no successful one, so a client cannot read its remaining budget without being refused. Retrying after `Retry-After` is always safe: a rate-limit refusal happens before the handler runs.
- `503`: A dependency the request needs is unreachable and nothing was changed. Codes: `queue_unavailable` (a background job could not be enqueued; retry the call), `billing_unavailable` (Stripe would not open a checkout session; nothing was charged, retry the call), `service_unavailable` (the rate-limit store is down, so the request was refused before running).

---

[API](https://skmtc.dev/inkseal/apis/inkseal-api.md) · [All operations](https://skmtc.dev/inkseal/apis/inkseal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/inkseal/apis/inkseal-api/revisions/c440c981d578?raw)