---
title: "Request a new-address verification for the session's own account"
method: POST
path: "/api/v1/me/email"
tags: ["Auth"]
---

# Request a new-address verification for the session's own account

`POST /api/v1/me/email`

## Request

- Base URL: `https://app.lastping.dev`
- URL: `https://app.lastping.dev/api/v1/me/email`
- Auth: API key in cookie `lp_session`

**Session-only.** Sends a one-time verification link to `new_email`;
the account's email is **not** changed yet — completion happens when
the link is clicked. Answers 204 (no-op) when `new_email` is already
the caller's own verified address, with nothing sent.

An API-key request gets 403 `SESSION_ONLY`, never 404. Being a
write, it also requires the CSRF double-submit header: 403
`CSRF_REQUIRED` if `X-CSRF-Token` is missing or does not match the
`lp_csrf` cookie.

## Request body

- ChangeEmailRequest: Body for POST /api/v1/me/email. Unlike the equivalent dashboard form, this REST endpoint requires `current_password`: it is a directly-scriptable surface with no browser session UI in the loop, so it gets the same current-password re-proof POST /api/v1/me/password already requires for a comparable account change.
  - `new_email` string, email, required
  - `current_password` string, required

## Response `202`

Verification link sent to new_email. The account's email has not changed yet.

## Other responses

- `204`: new_email is already the caller's own verified address. Nothing was sent.
- `400`: `INVALID_EMAIL` — new_email failed format validation — or `WRONG_PASSWORD` — current_password did not match.
- `403`: The request used an API key rather than a session cookie (`SESSION_ONLY`), or the session request was missing a valid `X-CSRF-Token` header (`CSRF_REQUIRED`).
- `409`: `EMAIL_IN_USE` — new_email is already verified on another account.
- `429`: Too many requests. The per-principal fixed-window rate limit has been exceeded. Retry after the number of seconds indicated by the `Retry-After` response header. The problem body's `code` is `RATE_LIMITED`. It names this limiter specifically, so a client can tell it apart from the application-level throttles that also answer 429 with their own codes and their own, much longer, `Retry-After` values (`TEST_PING_RATE_LIMITED`, `TOO_MANY_ATTEMPTS`). Back off globally on `RATE_LIMITED`; back off on the one operation for the others. The principal is the API key for a key-authenticated request and the USER for a browser session, so every tab one person has open shares one budget.

---

[API](https://skmtc.dev/lastping/apis/lastping-management-api.md) · [All operations](https://skmtc.dev/lastping/apis/lastping-management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lastping/apis/lastping-management-api/revisions/bbc6eda91c46?raw)