---
title: "Auth Age Check"
method: GET
path: "/api/auth/age-check"
tags: ["billing", "team"]
---

# Auth Age Check

`GET /api/auth/age-check`

## Request

- Base URL: `https://www.oxfordledge.com` (the document declares no server; this is the origin it was published from)
- URL: `https://www.oxfordledge.com/api/auth/age-check`
- Auth: none declared

Server-side age verification (COUNSEL-C5).

2026-05-28 (H-14 SECURITY_AUDIT P3): response shape narrowed to
{minor, blocked, consent_required} ONLY — no exact `age`. The
prior {"age": <int>} payload made this endpoint a DOB-oracle
(~365 requests via binary search confirm any birthdate). Audit
trail hash upgraded from Python `hash()` (non-cryptographic,
trivially-reversible across a 36k-day search space) to
sha256(dob).hexdigest(). Audit §H-14 lines 209-215.

Returns {minor: bool, consent_required: bool, blocked: bool}

Called pre-registration from the DOB field in the signup modal, so
cannot require auth. Rate-limited per IP (10/min) to block DOB
enumeration / date-oracle attacks. CISO P1-1.

## Query parameters

- `dob` string

## Response `200`

Successful Response

- AuthActionResponse: Loose response_model for auth routes (signin/register/oauth callbacks). Multi-shape success vs error envelopes; FE branches on specific keys via the public typed wrappers.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api.md) · [All operations](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/oxfordledge/apis/oxford-ledge-api/revisions/e832a1260f0b?raw)