---
title: "Request Verification"
method: POST
path: "/me/email-verifications"
---

# Request Verification

`POST /me/email-verifications`

## Request

- Base URL: `https://api.xhostd.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.xhostd.com/me/email-verifications`
- Auth: none declared

Mail one confirmation link for the caller's account.

The checks run in a fixed order: ``email:bind`` (403), the address
shape (400), then under the ``users`` row lock the account's
verified email (409), the account's 60-second window (429), and
then, under the address lock, the address's two caps (429). A new
link deletes the account's unconsumed ``email_bind`` rows, so one
link at a time works. Every refusal precedes the write, so the
closure can raise.

The scope gate sits here and not on the confirmation, because this
is the route that chooses the address. A bound address is what a
Google sign-in matches on, so it opens a console session carrying
``billing:write`` and ``console:session``. The scope keeps that out
of reach of every bearer that did not come from a key:
``POST /ssh-keys`` refuses to register the key that mints it for an
address-less account unless the caller holds the scope already, the
boundary design/AUTH.md states.

## Headers

- `authorization` string, nullable

## Request body

- VerificationRequest
  - `email` string, required

## Response `200`

Successful Response

- VerificationResponse
  - `status` 'sent', required
  - `expires_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/xhostd/apis/xhostd-public.md) · [All operations](https://skmtc.dev/xhostd/apis/xhostd-public/llms.txt) · [OpenAPI document](https://skmtc.dev/xhostd/apis/xhostd-public/revisions/bf439c4d1789?raw)