POST/v1/keys/self/verify

Auth	An API key, as `Authorization: Bearer snk_…` or `?api_key=snk_…`. Not metered: it draws no quota and no credit. Needs a full key; a browser (`maps`) key is refused.
Price	Not metered: no quota, no credit.

What it does

The code is bound to the key it was mailed for: a code from key A never confirms key B. It lasts identity::KEY_CODE_TTL_MIN minutes, works once, and dies after identity::MAX_KEY_CODE_ATTEMPTS wrong guesses. Every attempt, right or wrong, spends a per-key, per-IP and per-address daily budget (the address's is skipped on the owner's own network) and, while a code is out, a global hourly ceiling. A key that is already verified (its link was clicked first) still accepts its live code once: the answer is the same verified, with a session.

Call it

bash

curl -fsS -X POST "https://api.mapmap.ai/v1/keys/self/verify" \
  -H "Authorization: Bearer $MAPMAP_KEY" \
  -H "Content-Type: application/json" \
  -d '{"code":"string"}'

Request body

application/json · ConfirmKeyCodeRequest

Field	Type	Required	Description
code	string	yes	The 6-digit code from the verification mail.

Example: A request assembled from this schema's own field examples, enums, defaults and types; not a recorded call

json

{
  "code": "string"
}

Responses

200This key is verified (now, or already). Only the address's sole live key, on an address with no account, is confirmed by code; session then signs it in to the console (signed_in: true, absent without a console)

Field	Type	Required	Description
email	string	yes	The address of the account: the caller has just proved it reads this mailbox.
monthly_quota	integer	yes	Requests allowed per calendar month from now on (a plan bought before confirming is honoured, not the free tier).
session	string	no	A console session for that account (`sns_…`), as `POST /v1/console/session` mints from an emailed sign-in link. The website stores it in an httpOnly cookie on its own origin; it is never an API credential. Absent when the deployment has no console (`SN_CONSOLE_URL` unset).
session_expires_at	string	no	RFC 3339 expiry of `session`.
signed_in	boolean	yes	`true` when `session` was minted; `false` only when the deployment has no console (the key is still confirmed).
state	string	yes	Always `verified`.

Example: A response assembled from this schema's own field examples, enums, defaults and types; not a recorded call

json

{
  "email": "string",
  "monthly_quota": 0,
  "signed_in": false,
  "state": "string"
}

400verify-code: the code is not accepted. reason is wrong (with attempts_left), locked (too many wrong tries: send a new code), expired (expired, used, replaced or never sent) or, after a right code only, use-link (an existing account, or another live key on the address: confirm with the link)