Send email verification code

POST /v1/security/email-code

Triggers POST /auth/email/code upstream so the user can receive a fresh verification code. Disable/unbind TOTP flows pair the authenticator code with this email code, and withdraws on accounts without an authenticator use it as their only second factor. emailType is required and must be one of enableAuthApp, disableAuthApp, unlinkGoogle, withdrawal — the scope is part of the key the code is stored under, so a code minted under the wrong one can never be verified. The destination address is read from the authenticated account and is never taken from the request.

Request body

{ "emailType": "disableAuthApp" }

Response body

{ "success": true }

Notes

400 email_type_invalid — unknown or missing template scope. 409 account_email_unavailable — the account has no address to send to. 429 captcha_required — upstream declined after several requests in a short window; wait and retry. Upstream also drops mail silently past an hourly per-address ceiling, which no response field distinguishes from a real send — the resend cooldown in the UI is the only mitigation.