---
title: "Confirm a code and get the pass"
method: POST
path: "/api/sites/{slug}/capture/verify"
tags: ["site-controller"]
---

# Confirm a code and get the pass

`POST /api/sites/{slug}/capture/verify`

## Request

- Base URL: `https://api.pagegoat.com`
- URL: `https://api.pagegoat.com/api/sites/{slug}/capture/verify`
- Auth: HTTP bearer

Returns a pass to send as the `X-Pagegoat-Gate` header on later requests. Its lifetime is the site's re-verify window.

## Path parameters

- `slug` string, required

## Request body

- CaptureVerifyRequest: Confirm a code mailed to a visitor.
  - `email` string, required: The address the code was sent to.
  - `code` string, required: The six digits from the email.

## Response `200`

Correct — here is the pass.

## Other responses

- `401`: Wrong, expired or already-used code.
- `403`: This address is blocked.
- `404`: No such site, or it isn't capturing emails.
- `429`: Too many tries; wait it out.

---

[API](https://skmtc.dev/pagegoat/apis/pagegoat-api.md) · [All operations](https://skmtc.dev/pagegoat/apis/pagegoat-api/llms.txt) · [OpenAPI document](https://skmtc.dev/pagegoat/apis/pagegoat-api/revisions/3e87219680af?raw)