---
title: "Confirm an email attach (inbox + session possession)"
method: POST
path: "/agent/v1/control-plane/emails/verify"
tags: ["ControlPlane"]
---

# Confirm an email attach (inbox + session possession)

`POST /agent/v1/control-plane/emails/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/emails/verify`
- Auth: none declared

Consume the attach token from the confirmation link. The consuming session's principal must equal the principal the link was requested for (inbox possession AND session possession). On success the email is recorded as verified on that principal and pending invites addressed to it are claimed. 409 EMAIL_BELONGS_TO_OTHER_PRINCIPAL (with merge guidance) when another principal actively owns the email — disclosed only after possession is proven.

## Request body

- object
  - `token` string, required

## Response `201`

Email attached { status, email }

- object

## Other responses

- `401`: Invalid or expired confirmation link (INVALID_AUTH)
- `403`: Link belongs to a different account session
- `409`: EMAIL_BELONGS_TO_OTHER_PRINCIPAL — merge to consolidate

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)