Emails

The target of the signed link in a verification email, which carries its token as ?token=; that token is the authorization, and there is no Cowliss credential on these routes. The GET only offers the verification and the POST performs it, because link scanners fetch every URL they find, so the address verifies only on the POST. Tokens are single-use and expire after 48 hours; an invalid, expired, or already-spent token is a 400. Both routes answer HTML pages a human lands on, not the envelope.

GET /v1/public/verify

Verification confirmation page (public)

Auth: None: verifies the caller’s own signature/token.

Query parameters

{
  "token": "string"
}

Field	Type	Required	Constraints
token	string	no

Errors follow the shared envelope and code table.

POST /v1/public/verify

Verify an email address (public)

Auth: None: verifies the caller’s own signature/token.

Query parameters

{
  "token": "string"
}

Field	Type	Required	Constraints
token	string	no

Errors follow the shared envelope and code table.