self-serve
The emailed link's landing page. **Opening it changes nothing** (review of #1339, H1): mail security scanners and a single stray click open links, so a link that confirmed on GET could confirm a key a stranger asked for. The page shows the request (the app it said it came from, or that it named none, the time and the device class; no location is recorded) and confirms or refuses only on an explicit button, which POSTs to [`confirm_key`] or [`deny_key`].
Links carry the token in the fragment (#t=), which never reaches this server; the page's script reads it. Links sent before carry ?token= and land on the same page. With Accept: application/json (an agent relaying a link) the answer is the same facts as POST /v1/keys/verify/details, and nothing is consumed either.
get/v1/keys/verify
Request
- Base URL: https://api.mapmap.ai
- URL: https://api.mapmap.ai/v1/keys/verify
- Auth: none declared
Query parameters
tokenstring
Token of a link sent before the fragment form; current links carry it as #t=, which the page reads
Response
The confirmation page (HTML), or with Accept: application/json and a token the request facts. Nothing is confirmed or consumed
Changes
No recorded changes to this operation across all 1 revision of this API.