Redeem an emailed link or code. A known address signs in; a new one gets an account first. Either way the session broker finishes the login.
POST
/auth/email/verify
const url = 'https://api.siteqwality.com/auth/email/verify';const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"token":"example","challenge_handle":"example","code":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.siteqwality.com/auth/email/verify \ --header 'Content-Type: application/json' \ --data '{ "token": "example", "challenge_handle": "example", "code": "example" }'Request Body required
Section titled “Request Body required ” Media type application/json
POST /auth/email/verify: either token, or challenge_handle with code.
object
token
string | null
challenge_handle
string | null
code
string | null
Example generated
{ "token": "example", "challenge_handle": "example", "code": "example"}Responses
Section titled “ Responses ”Authenticated (with redirect_path when one was kept), or MFA required
Media type application/json
One of:
A session from a login, plus where the frontend should land.
object
session_token
required
string
session_jwt
required
string
member
required
Full member info returned on every authentication response.
object
name
string | null
email
required
string
organization_id
required
string
roles
required
Array<string>
is_new_account
True only when this authentication created a new account.
boolean
redirect_path
Sanitized at start; absent on the doors that never take one.
string | null
Answer of any login endpoint when the member has confirmed TOTP. The
frontend checks mfa_required before reading an AuthResponse.
object
mfa_required
required
Always true; the discriminator against AuthResponse.
boolean
pending_token
required
sqm1_..., valid 10 minutes for 5 attempts.
string
methods
required
Array<string>
redirect_path
string | null
Example
{ "methods": [ "totp" ]}challenge_invalid, code_invalid (with attempts_remaining) or code_locked
partner_managed
rate_limited
Internal server error
auth_unavailable