---
title: "Verify Code"
method: POST
path: "/api/candidate-accounts/verify"
tags: ["candidate-accounts"]
---

# Verify Code

`POST /api/candidate-accounts/verify`

## Request

- Base URL: `https://api.ruzora.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ruzora.com/api/candidate-accounts/verify`
- Auth: none declared

Exchange the code for a session.

The token is returned in the BODY, not set as a cookie here: the cookie
belongs to the frontend's own host (talent./developers. are host-only,
deliberately) and crm-api is on a different origin, so a Set-Cookie from
here would be a third-party cookie that modern browsers drop.

## Request body

- VerifyCodeBody: The code, plus whatever the signup form collected alongside it. `name` and `target_role` ride on VERIFY rather than on `request-code` for one reason: request-code must answer identically for a known and an unknown address, and a body that only a newcomer fills in is a shape an attacker can probe. By verify time the OTP has already proved the inbox, so there is nothing left to leak. Both are optional. The sign-in and magic-link modes of the page do not ask for them, the welcome-email claim path does not either, and a signup must never fail because a courtesy field was blank.
  - `email` string, email, required
  - `code` string, required
  - `name` string, nullable
  - `target_role` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api.md) · [All operations](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ruzora/apis/ruzora-candidate-crm-api/revisions/f9b8223f3ac4?raw)