Users

Confirm an email address change

Complete a pending email-address change by submitting the 6-digit code that was sent to the new address. On success: - The user's email address is updated immediately. - All existing sessions (other devices or browsers) are invalidated. - A fresh token pair is returned for the calling session so it remains active. - A `user.email.changed` webhook event is fired (project-scoped users only). **Attempt limit:** after 5 wrong submissions the pending request is voided. The user must submit a new request to try again. **Rate limit:** 10 requests per user (or IP) per 15 minutes.

AuthBearer (JWT)
GroupUsers
Rate limitSee Rate Limits
POST/api/users/email-change/confirm

SDK setup

Create a client and set credentials (JWT and/or API key) before calling the API. Match the authentication type shown above.

import { Configuration, UsersApi } from 'mudbase-sdk';

const configuration = new Configuration({
  basePath: 'https://cloud.mudbase.dev',
  accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfbW9yZ2FuX2RlIiwiZW1haWwiOiJtb3JnYW4uY2hlbkBub3J0aHdpbmQuZGV2IiwiZXhwIjoxODI1MTI5NjAwfQ.doc_preview_sig',
});

const users = new UsersApi(configuration);

Example request

Call this endpoint using the client from SDK setup. Use View HTTP for a raw cURL example.

const { data: result } = await users.confirmEmailChange(
  {
    code: "feed reboot"
  }
);

Playground

live

Test this endpoint with your own credentials. Your requests will be sent to the live API.

Use the auth endpoints to obtain a JWT.

No Request Yet

Send a request to see the full inspector

Authentication

Requires JWT
Note
Include your JWT in the Authorization: Bearer YOUR_TOKEN header (user-facing apps, RBAC). View authentication guide →

Request Body

json
{
  "code": "481923"
}

Responses

200Email updated. Use the returned token pair immediately.
json
{
  "message": "Email address updated successfully. Other sessions have been signed out.",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfZGVtbyJ9.sig_sample",
  "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfZGVtbyJ9.sig_sample",
  "expiresIn": 1800
}
400Bad request. The `code` field indicates the specific failure: | Code | Meaning | |------|---------| | `WRONG_CODE` | The submitted code is incorrect. Remaining attempts are noted in `error`. | | `MAX_ATTEMPTS` | 5 wrong submissions. The pending request is voided. | | `CODE_EXPIRED` | The 10-minute TTL has passed. Submit a new request. |
json
{
  "error": "program back up",
  "code": "WRONG_CODE"
}
401-
404`code: NO_PENDING_REQUEST` - no active email-change request exists for this user. Either none was submitted, or it was already confirmed. Note: a request voided by `MAX_ATTEMPTS` keeps its record with `codeAttempts >= 5` and returns `MAX_ATTEMPTS` (400) on subsequent confirm calls, not this code.
json
{
  "error": "program back up",
  "code": "NO_PENDING_REQUEST"
}
409`code: EMAIL_TAKEN` - the requested address was registered by another user in the same project between the request and confirm steps. The pending request is cancelled. Submit a new request with a different address.
json
{
  "error": "program back up",
  "code": "EMAIL_TAKEN"
}
429-

Errors

CodeMeaning
400Bad request. The `code` field indicates the specific failure: | Code | Meaning | |------|---------| | `WRONG_CODE` | The submitted code is incorrect. Remaining attempts are noted in `error`. | | `MAX_ATTEMPTS` | 5 wrong submissions. The pending request is voided. | | `CODE_EXPIRED` | The 10-minute TTL has passed. Submit a new request. |
401-
404`code: NO_PENDING_REQUEST` - no active email-change request exists for this user. Either none was submitted, or it was already confirmed. Note: a request voided by `MAX_ATTEMPTS` keeps its record with `codeAttempts >= 5` and returns `MAX_ATTEMPTS` (400) on subsequent confirm calls, not this code.
409`code: EMAIL_TAKEN` - the requested address was registered by another user in the same project between the request and confirm steps. The pending request is cancelled. Submit a new request with a different address.
429-
Run in PostmanDownload OpenAPI

Next

NEXT →API Reference OverviewBase URL, rate limits, pagination, and the full endpoint index.NEXT →AuthenticationAPI keys, Bearer tokens, and user sessions.NEXT →API PlaygroundSearch any endpoint and send a live request.
Edit this page on GitHub
Chat with us