TrieOH
IdentityXAPIAuthn

Resend the verification email

Mints a fresh verification link and emails it to the given address. Always returns 200 — unknown emails and already-verified accounts are silent no-ops, so the endpoint does not leak which emails are registered.

POST/auth/resend-verification

Mints a fresh verification link and emails it to the given address. Always returns 200 — unknown emails and already-verified accounts are silent no-ops, so the endpoint does not leak which emails are registered.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Request body for POST /auth/resend-verification.

Response Body

application/problem+json

application/problem+json

application/problem+json

curl -X POST "https://example.com/auth/resend-verification" \  -H "Content-Type: application/json" \  -d '{    "email": "user@example.com"  }'
Empty
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 400,
  "title": "Validation Failed"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 500,
  "title": "Internal Server Error"
}
{
  "detail": "string",
  "instance": "../dictionary",
  "errors": [
    {
      "field": "string",
      "message": "string"
    }
  ],
  "type": "http://example.com",
  "status": 503,
  "title": "Identity Unavailable"
}

Verify an email address POST

Redeems the single-use JWT carried by a verification email and marks the actor's email as verified. The token is HMAC-signed, purpose-scoped, expires after a short TTL, and is consumed on first use (jti anti-replay). Re-clicking a consumed link on an already-verified account succeeds (idempotent).

Request a password reset link POST

Mints a single-use password-reset link and emails it to the given address. Always returns 200 — unknown emails and passwordless (OAuth-only) accounts are silent no-ops, so the endpoint does not leak which emails are registered.