Back to API Practice

Security/Auth trainer

Email Verification API Practice

Practice verification emails, token expiry and reuse, resend behavior, safe enumeration handling, account activation, delivery failures, and audit trails.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated POST /api/auth/email-verification/confirm request, inspect the fake response, and turn it into test ideas.

No real email is sent. This is a client-side simulator with placeholder addresses and tokens.

Request

Build the request

POST/api/auth/email-verification/confirm

Request JSON

application/json
{
  "token": "verif_fake_123"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

Token lifecycle

Resend

Enumeration

Abuse prevention

Reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List verification email sent, valid token, expired/reused token, resend, unknown email generic response, rate limits, account activation, email provider outage, messages, audit logs, and metrics.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

Email Verification endpoint

Confirm account email ownership with single-use tokens, resend support, safe enumeration handling, and account activation.

Endpoint

POST/api/auth/email-verification/confirm

Purpose

Confirm account email ownership with single-use tokens, resend support, safe enumeration handling, and account activation.

Request fields

  • token: verification token from email link
  • email: optional email for resend/request flow
  • clientContext: optional browser/device metadata

Success response

200 OK

Request body

{
  "token": "verif_fake_123",
  "email": "alex@example.com"
}

Example response body

{
  "status": "verified",
  "accountStatus": "active",
  "message": "Email verified successfully."
}

Errors

  • 400 validation error
  • 401 invalid token
  • 409 already verified
  • 410 expired token
  • 429 rate limited
  • 503 email provider unavailable

Security notes

  • Tokens are never logged or sent to analytics
  • Resend and verify are rate limited
  • Account existence is not exposed
  • Audit logs avoid storing token values

Business rules

  • Verification email is sent to the correct mailbox
  • Resend creates a usable new token
  • Account remains pending until verification succeeds
  • Unknown email uses safe generic responses
  • Expired and reused links have clear behavior