Validate User Email
POST /obp/v7.0.0/users/email-validation
OBPv6.0.0-validateUserEmail No role required User
Validate a user's email address using the JWT token sent via email.
This is a self-service endpoint for users to confirm their email address as part of the sign-up process.
When a user registers and email validation is enabled (authUser.skipEmailValidation=false), they receive an email containing a validation link with a signed JWT token. The user (or a client application) then calls this endpoint with that token to complete validation.
This endpoint:
- Verifies the JWT signature and checks expiry
- Extracts the unique ID from the JWT subject
- Sets the user's validated status to true
- Resets the unique ID token (invalidating the link)
- Grants default entitlements to the user
Important: This is a single-use token. Once the email is validated, the token is invalidated. Any subsequent attempts to use the same token will return a 404 error (UserNotFoundByToken or UserAlreadyValidated).
The token is a signed JWT with a configurable expiry (default: 1440 minutes / 24 hours).
The server-side expiry can be configured with the email_validation_token_expiry_minutes property.
For administrative validation (without an email token), see the Validate a User endpoint (PUT /management/users/USER_ID).
User Authentication is Optional. The User need not be logged in.
JSON request body fields (1)
- token
JSON response body fields (6)
Example request body
{
"token": "eyJhbGciOiJIUzI1NiJ9..."
}Example success response
{
"user_id": "5995d6a2-01b3-423c-a173-5481df49bdaf",
"email": "user@example.com",
"username": "username",
"provider": "https://localhost:8080",
"validated": true,
"message": "Email validated successfully"
}Possible errors (4)
- OBP-10001: Incorrect json format.
- OBP-20106: User not found by token. The validation token is invalid or expired.
- OBP-20107: User email is already validated.
- OBP-50000: Unknown Error.