---
title: "Verify a magic link → mint a control-plane session"
method: POST
path: "/agent/v1/control-plane/session/email/verify"
tags: ["ControlPlane"]
---

# Verify a magic link → mint a control-plane session

`POST /agent/v1/control-plane/session/email/verify`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/session/email/verify`
- Auth: none declared

Consume the magic-link token (verifies the email), resolve or create the owning principal, claim any pending invites, and mint a principal-bound control-plane session (amr=email).

## Request body

- object
  - `token` string, required

## Response `200`

Session minted

- object

## Other responses

- `401`: Invalid or expired link (INVALID_AUTH)

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)