---
title: "Entra Assurance Verify"
method: POST
path: "/v1/auth/entra/email-assurance/verify"
tags: ["auth"]
---

# Entra Assurance Verify

`POST /v1/auth/entra/email-assurance/verify`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/auth/entra/email-assurance/verify`
- Auth: none declared

Spend the mailed token with the resume secret presented alongside it.

The only route that moves a ceremony to ``mailbox_verified``, and it requires BOTH secrets.
That is what makes a stolen mailbox and a stolen tab each useless on their own.

## Request body

- EntraAssuranceVerifyRequest: Both secrets together, which is the only shape that proves the mailbox.
  - `resume_token` string, required
  - `mailed_token` string, required

## Response `200`

Successful Response

- EntraAssuranceStatusResponse: What the waiting page renders. Carries no secret and nothing about any account.
  - `status` string, required
  - `expires_at` string, date-time, required
  - `support_ref` string, required
  - `resend_available` boolean, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)