Send the email OTP
Sends or resends the verification OTP for a pending email. A user token calls this on behalf of the signed-in user. The returned otp tells the step that the OTP confirms and where it went. Returns 404 when the contact does not exist. Returns 409 when a change to another primary email is in progress. Confirm the OTP next.
Authorization
oauth2 Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.
In: header
Path Parameters
Unique identifier of the email contact.
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/user/settings/emails/550e8400-e29b-41d4-a716-446655440000/otp/send"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "value": "jane@example.com", "otp": { "step": "OWNER_AUTHORIZATION", "sent_to": "EMAIL", "steps": 2, "digits": 6 }, "is_primary": true, "validated": true, "validated_at": "2026-01-15T09:20:00Z", "requires_verification": true, "verification_locked": true, "verification_locked_at": "2026-01-20T16:45:00Z", "created_at": "2026-09-01T10:15:30Z"}{ "code": "BAD_REQUEST", "description": "Bad Request"}{ "code": "UNAUTHORISED", "description": "Unauthorised"}{ "code": "FORBIDDEN", "description": "Forbidden"}{ "code": "BAD_REQUEST", "description": "Invalid input"}{ "code": "BAD_REQUEST", "description": "Invalid input"}{ "code": "RATE_LIMIT_EXCEEDED", "description": "Too Many Requests"}{ "code": "INTERNAL_ERROR", "description": "Internal Server Error"}Confirm the email OTP POST
Confirms the OTP for the step named by `step` and validates the contact. A user token calls this on behalf of the signed-in user. When another OTP is still due, the email stays unvalidated and `otp` describes the next OTP. Returns 404 when the contact does not exist, and 409 when the email is already registered on another profile.
Set the caller's primary email POST
Starts making a validated email the caller's global primary email and sends the first OTP; the returned `otp` tells where it went. While an OTP is pending, a new call sends no other OTP: use `otp/send`. With no non-closed current account, one OTP authorizes the change through the existing validated primary contact. With one, the change instead uses that current account to verify the owner and the new email; the primary changes only after the account provider confirms it, and pending onboarding is exposed as resumable status. A user token calls this on behalf of the signed-in user. Returns 404 when the email is not a contact on the caller's profile, and 409 when a previous primary-contact change is still synchronizing.