---
title: "Join the business (verify the code)"
method: POST
path: "/join/{join_code}/accept"
tags: ["Public", "Join links"]
---

# Join the business (verify the code)

`POST /join/{join_code}/accept`

## Request

- Base URL: `https://api.purplegrain.com/api/v1`
- URL: `https://api.purplegrain.com/api/v1/join/{join_code}/accept`
- Auth: none declared

Checks the one-time code against the mobile. On success the account is
**created if new** (unusable random password, default grower — exactly like
an SMS invite or phone sign-in), the mobile is marked verified, and the
person becomes a member at the link's role. An existing account on that
number is signed in and added straight away; someone who is already a
member is left exactly as they were (a link never changes a role), and a
pending invitation they held is accepted. Returns the standard
first-party Doorkeeper token payload (same shape as
`POST /users/phone-sessions/verify`).

## Path parameters

- `join_code` string, required

## Request body

- object
  - `mobile` string, required: The same mobile the code was sent to.
  - `code` string, required: The 6-digit code from the SMS.

## Response `200`

Joined — Doorkeeper access token; includes `user_id`.

- DoorkeeperAccessTokenResponse: Access token issued by Doorkeeper. The same fields are returned from `POST /oauth/token` (RFC 6749). First-party endpoints (`POST /users/sign-in`, `POST /users/access-tokens`) add `user_id` for convenience.
  - `access_token` string, required: Opaque bearer token. Send as header Authorization: Bearer {token} on /api/v1/* routes.
  - `token_type` string, required
  - `expires_in` integer: Lifetime of the access token in seconds.
  - `refresh_token` string, nullable: Present when the client and grant type allow refresh tokens.
  - `scope` string: Granted scopes (space-separated).
  - `user_id` string, uuid, nullable: Only returned by first-party JSON endpoints (`/users/sign-in`, `/users/access-tokens`), not by `POST /oauth/token`.
  - `actor_id` string, uuid, nullable: The acting entity's id (first-party endpoints only). Equals `user_id` today; becomes the Organization id when a token is scoped to act for an organization.
  - `actor_type` 'User' | 'Organization', nullable: Polymorphic type of `actor_id` (first-party endpoints only).

## Other responses

- `403`: Forbidden — first-party only; refused to an API key or an assistant's token.
- `404`: The link cannot be used.
- `422`: Incorrect or expired code, or an invalid mobile.

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/4bedbc1c784c?raw)