---
title: "Preview Verification"
method: POST
path: "/signup/verify/preview"
tags: ["signup"]
---

# Preview Verification

`POST /signup/verify/preview`

## Request

- Base URL: `https://app.zeno-works.ch` (the document declares no server; this is the origin it was published from)
- URL: `https://app.zeno-works.ch/signup/verify/preview`
- Auth: none declared

**Side-effect-free, and a POST so that it cannot be fired by a machine.**

Mail scanners and link prefetchers issue GETs on every URL in a message; a verification
that completed itself inside a security appliance is one the human never consented to.
Making the *preview* a POST as well is belt and braces — it costs nothing and it means
no route reachable from that mail can be triggered without a browser running our code.

Reads through `signup.preview_by_token`, which deliberately avoids `_live`: `_live`
derives expiry by stamping the row and flushing, and then returns the row it just
expired — so a dead link previews as a live one, *and* a scanner's fetch writes to the
database.

## Request body

- VerifyPreviewIn
  - `token` string, required

## Response `200`

Successful Response

- VerifyPreviewOut: What the page shows *before* anything is created. **The GET-equivalent is a POST.** Mail scanners, SafeLinks and link prefetchers issue GETs on every URL in a message. A preview reachable by GET is a preview a security appliance runs on the human's behalf — harmless while it stays read-only, and a disaster the first time somebody "tidies" the transition into it. A POST cannot be fired that way at all, which is why this shape exists rather than a path parameter.
  - `email` string, required
  - `client_name` string, required
  - `account_exists` boolean, required
  - `grants_key` boolean, required
  - `expires_at` string, date-time, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/zeno-works/apis/zeno-api.md) · [All operations](https://skmtc.dev/zeno-works/apis/zeno-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zeno-works/apis/zeno-api/revisions/1eb93dde146c?raw)