---
title: "Confirm a guest comment code"
method: POST
path: "/v1/data/{artifactId}/comments/_guest/verify"
tags: ["Data"]
---

# Confirm a guest comment code

`POST /v1/data/{artifactId}/comments/_guest/verify`

## Request

- Base URL: `https://shareout.site`
- URL: `https://shareout.site/v1/data/{artifactId}/comments/_guest/verify`
- Auth: none required

Exchanges the code for `shareout_guest_{artifactId}`: an HttpOnly, SameSite=Strict cookie (12 h) holding an HMAC over the artifact id, the name and a keyed email hash, valid for this artifact only. Guests then post and reply through `POST …/comments` (`authorType: guest`); they cannot resolve, assign, react or approve. Five wrong tries burn a code.

## Request body

- object
  - `name` string, required
  - `email` string, email, required
  - `code` string, required

## Response `200`

`{ success: true, data: { guest: { name }, expiresIn } }` plus `Set-Cookie`

## Other responses

- `400`: `INVALID_CODE` or `VALIDATION_ERROR`
- `403`: `GUEST_COMMENTS_DISABLED`, or `FORBIDDEN` (Origin)
- `429`: `RATE_LIMIT_EXCEEDED`

## Changes

- **2026-10-16** `8c602e339d5d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/shareout/apis/shareout-rest-api/changes/v1/data/:artifactId/comments/_guest/verify/post.md)

---

[API](https://skmtc.dev/shareout/apis/shareout-rest-api.md) - [All operations](https://skmtc.dev/shareout/apis/shareout-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shareout/apis/shareout-rest-api/revisions/1e3f7fd34f6d?raw)