Accounts

Retrieve latest account verification code

Retrieving a verification code is the same irreversible first-access event as revealing credentials. Its policy is determined by this saved account's created_at timestamp against the immutable managed_pricing_new_customer_cutover_at value, never by the workspace action-pricing cohort or August 14 grace deadline. A saved account created before the cutoff permanently keeps the prior API contract: 0 credits, no new versioned acknowledgment body required, no TokPortal detachment, existing task access remains available, and support plus ban coverage end after access. A saved account created at or after the cutoff follows the managed policy: normally 150 credits, or the stored $10 legacy / $15 new per-30-day rate when Account Owning is already admin-approved. Managed access permanently detaches the account, makes it read-only, and ends TokPortal Coverage, task access, analytics updates, support, ban protection, replacement, refunds, compensation and credit restoration. For a new-policy account, missing explicit acceptance fails with 428 and returns the exact account-specific terms, price and policy version. A changed quote returns 409 before any debit or reveal. Reaching the Account Owning eligibility threshold only submits an admin review request; it never activates the agreement automatically. While approval is pending, reveal remains available for 150 credits on a post-cutoff account. Do not send Idempotency-Key: this response contains a verification secret and is never stored in the replay ledger. A request that includes the header is rejected before any ledger claim, reveal, debit, or inbox access with IDEMPOTENCY_KEY_NOT_ALLOWED_FOR_SENSITIVE_RESPONSE (400). After an uncertain transport result, fetch the safe account state before deciding whether to call this endpoint again without the header.

post/accounts/{id}/verification-code

Request

  • Base URL: https://app.tokportal.com/api/ext
  • URL: https://app.tokportal.com/api/ext/accounts/{id}/verification-code
  • Auth: API key in header X-API-Key

Path parameters

idstring uuid required

Saved account ID.

Headers

X-TokPortal-Dry-Run'true' | '1' | 'yes'

Send true (or 1/yes) to SIMULATE this call instead of executing it. A dry run performs the full validation and pricing path of the real operation and stops before the first write: no credits are debited, no rows are created, no webhooks fire, and no operator ever sees it. The response has the same shape and status as the real call and adds dry_run: true, dry_run_notice, and — on credit-spending operations — credits_would_charge carrying the real price. Errors are identical to the real call, which is the point: this is how you learn what an operation will do before paying for it. Rate limits are consumed normally, a supplied Idempotency-Key is ignored rather than burned, and identifiers returned by a dry run are synthetic (see DRY_RUN_ID_IN_LIVE_REQUEST).

Request body

acknowledge_support_forfeittrue required

Set to true to confirm, on behalf of the account owner, acceptance of the exact disclosure identified by policy_version. Required on first credential or verification-code access and ignored after the account has already been revealed.

policy_versionstring required

The exact current policy version returned in error.details.policy_version by HTTP 428 or 409. A missing version returns 428. A supplied non-empty stale or mismatched version returns CREDENTIAL_REVEAL_QUOTE_CHANGED (409), with the current disclosure and expected_credit_cost, before any debit or reveal.

Response

Verification code result.

Changes

No recorded changes to this operation across all 1 revision of this API.