---
title: "Confirm US work authorization, finishing sign-up"
method: POST
path: "/api/me/work-authorization"
---

# Confirm US work authorization, finishing sign-up

`POST /api/me/work-authorization`

## Request

- Base URL: `https://www.toma.com`
- URL: `https://www.toma.com/api/me/work-authorization`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`

When identityVerificationEnabled is true, sign-up step 3, after a verified identity: the member confirms they live in the United States and are authorized to work there. Signing up is then done (Me.signUp null) and the account opens up.

## Request body

- object
  - `usWorkAuthorized` true, required

## Response `200`

The member, signed up.

- Me
  - `id` string, required: The account id. Public page: /members/{id}.
  - `email` string, required
  - `name` string, required
  - `photoUrl` string, nullable, required
  - `linkedinUrl` string, nullable, required: The LinkedIn profile linked to this account.
  - `profile` MemberProfile, required: A member's profile fields; empty strings (and a null state) for what they haven't filled in.
    - `headline` string
    - `about` string
    - `skills` string[]
    - `city` string
    - `state` string, nullable: Two-letter US state code or DC.
    - `stateName` string, nullable
    - `website` string, nullable
    - `resume` string: The member's experience and education in Markdown, at most 20,000 characters: "## Experience" (one "### Task Title · Company" per role, a dates line, and "-" bullets), then "## Education". Leave out the name, headline, location, summary, and skills (they are profile fields, added when the resume is shown), and email addresses and phone numbers (posters and the members they hire get each other's contact details only after hiring). Empty until written or imported; creating tasks and applying both need it.
    - `usWorkAuthorized` boolean: They confirmed they live in the United States and are authorized to work there.
    - `updatedAt` string, date-time
  - `missing` string[], required: What they still have to add before they can create tasks or apply; empty when complete.
  - `identityVerificationEnabled` boolean, required: Whether sign-up requires identity verification and US work authorization. Disabled by default.
  - `discordCommunityUrl` string, uri, required: The Toma Discord community invite, available only in authenticated member responses.
  - `signUp` object, nullable, required: When identityVerificationEnabled is true, a new member signs up on /welcome by confirming or skipping LinkedIn, verifying identity, and confirming US work authorization. Until they finish, every other member route answers 403 "Finish signing up first." With verification disabled, admitted members finish automatically without a LinkedIn step. Null once finished. Invite-only admission still applies.
    - `step` 'linkedin' | 'identity' | 'work', required: The sign-up step to do next.
    - `identity` 'none' | 'started' | 'review' | 'verified' | 'failed' | 'expired' | 'duplicate', required: The identity check (government ID and selfie); duplicate when the ID already verified another account.
    - `verifiedName` string, nullable, required: The name on the verified ID.

## Other responses

- `400`: usWorkAuthorized isn't true.
- `401`: No valid session or API key.
- `409`: The earlier steps aren't done, or the member already finished signing up.
- `413`: The request body exceeds 2097152 bytes.

---

[API](https://skmtc.dev/toma/apis/toma-api.md) - [All operations](https://skmtc.dev/toma/apis/toma-api/llms.txt) - [OpenAPI document](https://skmtc.dev/toma/apis/toma-api/revisions/b4e56e1db5a2?raw)