---
title: "Email Send"
method: POST
path: "/api/auth/email/send"
---

# Email Send

`POST /api/auth/email/send`

Mint + send a 6-digit OTP to `payload.email`.

Anti-enumeration: the response is identical whether or not the
address belongs to a registered, activated user. We still skip the
Resend call (and the per-account quota burn) for missing /
unactivated accounts — there's no point delivering codes nobody
asked for — but the caller can't tell from the response.

Rate limits mirror /api/auth/sms/send:
  - per-email cooldown: 1 OTP / 60s. Within-window requests reuse
    the existing code (no fresh send) but return {sent:true}.
  - per-IP cooldown across emails: 1 send / 60s / IP, to stop a
    single attacker from sweeping the table.

## Request body

- EmailSendIn
  - `email` string, required
  - `language` string

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/omicos/apis/omicos-server.md) · [All operations](https://skmtc.dev/omicos/apis/omicos-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/omicos/omicos-server/revisions/a00b94573ffe/schema)