Create Validation Email (Resend)

Create a new account-validation email for a user and send it by email. The validation link travels only via email; it is NOT returned in the response.

This is the recovery endpoint for users who signed up but did not receive (or lost) the original validation email. The anonymous password-reset endpoint cannot help them — it filters on validated=true, which an unvalidated user is by definition not.

No authentication or role is required. The endpoint is self-service: an unvalidated user cannot authenticate, so any auth requirement would make the endpoint useless to its intended caller.

Anti-enumeration: the response is always the same generic acknowledgement, regardless of whether the user exists, is already validated, the rate limit was hit, or the SMTP send failed. The only way to find out what actually happened is the server log.

Rate-limit: 3 attempts per email per hour (Redis-backed). Over-limit requests still receive the same 201 acknowledgement.

The endpoint only operates on users whose provider is the local identity provider (local_identity_provider prop). OIDC / SSO users never have a validation-email flow and are not eligible.

The validation token is the same one minted at signup (reuses AuthUser.uniqueId). Multiple resends produce the same link, not competing tokens — clicking any of the delivered emails works.

Email configuration (portal_external_url, SMTP, sender address) must be set up correctly for delivery to succeed. See /status (Email section) and POST /obp/v7.0.0/management/self-test-emails for diagnostics.

User Authentication is Optional. The User need not be logged in.