Skip to content
Authrim

Send a Direct Auth email code.

POST
/api/v1/auth/direct/email-code/send
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/v1/auth/direct/email-code/send \
  --header 'Content-Type: application/json' \
  --data '{ "client_id": "client_123", "email": "user@example.com", "code_challenge": "rfc7636-code-challenge", "code_challenge_method": "S256", "channel": "browser" }'

Creates an email-code challenge for Direct Auth after validating the client, channel, origin, and requested email identifier. For an eligible explicit email-verification Flow, a valid Email Verification Protocol presentation completes verification without sending a code; missing, unsupported, or invalid presentations use the normal mail-OTP response. The accepted response intentionally does not disclose whether the account exists or whether the delivery provider accepted the message.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
client_id
required
string
email
required
string format: email
code_challenge
required
string
code_challenge_method
required
string
Allowed values: S256
channel
required
string
Allowed values: browser native
scope
string
locale
string
invite_token
string
authorization_challenge_id
string
display_name
string
custom_fields
object
key
additional properties
human_verification_response
string
email_verification_token

Browser-provided Email Verification Protocol SD-JWT presentation. It is accepted only with the matching challenge and runtime interaction.

string
email_verification_challenge_id

Challenge identifier returned by the runtime email-verification endpoint.

string
runtime_interaction_id

Runtime Flow interaction to bind to either OTP or protocol verification.

string
Example 
{
  "client_id": "client_123",
  "email": "user@example.com",
  "code_challenge": "rfc7636-code-challenge",
  "code_challenge_method": "S256",
  "channel": "browser"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Accepted response that does not confirm account existence or provider delivery.

Media type application/json
One of:
object
attempt_id
required
string
expires_in
required
integer
masked_email
required
string
Example 
{
  "attempt_id": "attempt_123",
  "expires_in": 300,
  "masked_email": "u***r@example.com"
}

202

Section titled “202 ”

Account creation is durable but its active Lookup route is not ready yet.

Media type application/json
object
status
required
string
Allowed value: provisioning
provisioning_token
required
string
/^[A-Za-z0-9_-]{43}$/
status_endpoint
required
string
Allowed value: /api/v1/auth/account-provisioning/status
retry_after_ms
required
integer
>= 250 <= 2000
expires_in
required
integer
>= 1 <= 600
resume_user_id

Present for passkey signup only. The Login UI sends this continuation value back with the provisioning token so a retried request reuses the same account candidate.

string
key
additional properties
Example 
{
  "status": "provisioning",
  "status_endpoint": "/api/v1/auth/account-provisioning/status"
}

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}