⌘ K
OpenAPI

BUILD

Email verification

Email ownership verification is bounded, enumeration-resistant, and separate from authentication.

POST/api/auth/enrollment/start

Start verified-email enrollment

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/enrollment/start'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

browser session

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/api/auth/enrollment/verify-email

Verify the six-digit email code

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/enrollment/verify-email'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

enrollment token

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/api/auth/enrollment/resend-email

Request a replacement verification email

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/enrollment/resend-email'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

enrollment token

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Important boundaries

  • Verification codes are generated server-side and stored only as a keyed proof.
  • Responses do not reveal whether an email already belongs to an account.
  • Resend cooldowns and attempt limits return safe 429 classifications.
  • A verified email alone cannot create a session.