> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stableyard.fi/llms.txt
> Use this file to discover all available pages before exploring further.

# Confirm an account email verification

> Submit the six-digit email code to mark a UPA's email verified.

Consumes the six-digit OTP and atomically marks the UPA's email verified. A failed challenge cannot be reused. Once the email is verified, the UPA can [start KYC](/api-reference/kyc/create-kyc-session) and use entitled fiat payment rails.


## OpenAPI

````yaml openapi.json POST /v2/accounts/{accountId}/email/verification-challenges/{challengeId}/confirm
openapi: 3.1.0
info:
  title: Stableyard Partner API
  version: 2.0.0-staging
  x-stableyard-api-version: '2026-09-09'
  x-stableyard-supported-api-versions:
    - '2026-09-09'
  summary: Backend API for UPAs, Payments, activity, and optional financial products.
  description: >

    Use this API from a trusted partner backend with an app ID and app secret.


    ## Recommended integration


    1. Call `GET /v2/partners/config` to verify credentials and discover enabled
    capabilities.

    2. Create a UPA only when your product needs a persistent Stableyard
    account.

    3. Create a receive or send Payment with `POST /v2/payments`.

    4. Redirect a payer to the returned `paymentUrl` or pass the Payment
    credentials to an official Stableyard interface SDK.

    5. Process signed webhooks and fetch the Payment by ID for reconciliation.


    Checkout execution and account-bound browser endpoints are intentionally
    documented in the separate Interfaces & SDKs reference. Console endpoints
    are dashboard implementation details and are not part of the partner
    integration contract.
  x-stableyard-documentation-surface: partner
servers:
  - url: https://prod-api.stableyard.fi
    description: Production
  - url: https://staging-api-v2.stableyard.fi
    description: Staging
  - url: http://localhost:3001
    description: Local
security: []
tags:
  - name: Authentication
    x-displayName: API authentication
    description: Verify your app ID and app secret before calling UPA APIs.
  - name: Accounts
    x-displayName: UPA Accounts
    description: Create Universal Payment Accounts and manage account settings.
  - name: Deposit Addresses
    description: Create reusable receive addresses and verify inbound deposits.
  - name: Identity & KYC
    description: >-
      Verify the UPA email and run provider-neutral identity verification.
      Managed vaults and fiat payment rails use this same verified UPA identity.
  - name: Vaults
    description: >-
      Create Safe/Zodiac controlled stablecoin vaults and manage policy updates
      for accounts.
  - name: Payments
    description: >-
      Create escrow-first payments, issue partner-authenticated send
      instructions or executions, power public checkout, and reconcile
      collection through final account settlement.
  - name: Balances & Transactions
    description: >-
      Read Stableyard-posted financial activity. Balances are ledger projections
      of activity Stableyard processed; they are not live balances of externally
      controlled wallets.
paths:
  /v2/accounts/{accountId}/email/verification-challenges/{challengeId}/confirm:
    post:
      tags:
        - Identity & KYC
      summary: Confirm UPA email verification
      description: >-
        Consumes the six-digit OTP and atomically marks the canonical UPA email
        verified. Failed challenges cannot be reused. After verification, the
        UPA can start KYC and use entitled fiat payment rails.
      operationId: confirmAccountEmailVerification
      parameters:
        - name: accountId
          in: path
          required: true
          schema:
            type: string
            example: acct_123
          description: Canonical account id returned by the Accounts API.
        - name: challengeId
          in: path
          required: true
          schema:
            type: string
            pattern: ^account_email_[A-Za-z0-9_-]+$
        - name: Stableyard-Version
          in: header
          required: false
          schema:
            type: string
            enum:
              - '2026-09-09'
          description: >-
            Optional contract-version assertion. Omit it to use the app
            environment's pinned version. A different supported version is
            accepted only after that environment is explicitly migrated.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              required:
                - code
              properties:
                code:
                  type: string
                  pattern: ^[0-9]{6}$
                  example: '123456'
            examples:
              example:
                summary: Confirm UPA email verification request
                value:
                  code: '123456'
      responses:
        '200':
          description: Verified UPA email
          headers:
            Stableyard-Version:
              description: >-
                Effective date-based Stableyard API contract version for this
                response.
              schema:
                type: string
                enum:
                  - '2026-09-09'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccountEmailVerificationResponse'
              examples:
                example:
                  summary: Confirm UPA email verification 200 response
                  value:
                    contact:
                      id: account_contact_123
                      type: email
                      email: al***@example.com
                      status: pending_verification
                      verifiedAt: '2026-08-28T10:00:00.000Z'
                      verificationMethod: stableyard_email_otp
                      createdAt: '2026-08-28T10:00:00.000Z'
                      updatedAt: '2026-08-28T10:00:00.000Z'
                    challenge:
                      id: account_email_123
                      email: al***@example.com
                      status: pending
                      verificationMethod: stableyard_email_otp
                      attemptsRemaining: 0
                      expiresAt: '2026-08-28T10:00:00.000Z'
                      verifiedAt: '2026-08-28T10:00:00.000Z'
                    nextAction:
                      type: none
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '424':
          $ref: '#/components/responses/FailedDependency'
        '429':
          $ref: '#/components/responses/TooManyRequests'
      security:
        - partnerBasicAuth: []
components:
  schemas:
    AccountEmailVerificationResponse:
      type: object
      additionalProperties: false
      required:
        - contact
        - nextAction
      properties:
        contact:
          $ref: '#/components/schemas/AccountEmailContact'
        challenge:
          $ref: '#/components/schemas/AccountEmailChallenge'
        nextAction:
          oneOf:
            - type: object
              additionalProperties: false
              required:
                - type
              properties:
                type:
                  type: string
                  const: none
            - type: object
              additionalProperties: false
              required:
                - type
              properties:
                type:
                  type: string
                  const: enter_email_verification_code
            - type: object
              additionalProperties: false
              required:
                - type
              properties:
                type:
                  type: string
                  const: start_kyc_session
            - type: object
              additionalProperties: false
              required:
                - type
              properties:
                type:
                  type: string
                  const: request_new_email_verification
    AccountEmailContact:
      type: object
      additionalProperties: false
      required:
        - id
        - type
        - email
        - status
        - createdAt
        - updatedAt
      properties:
        id:
          type: string
          pattern: ^account_contact_[A-Za-z0-9_-]+$
          example: account_contact_123
        type:
          type: string
          const: email
        email:
          type: string
          example: al***@example.com
          description: Masked canonical UPA email.
        status:
          type: string
          enum:
            - pending_verification
            - verified
            - disabled
        verifiedAt:
          type: string
          format: date-time
        verificationMethod:
          type: string
          enum:
            - stableyard_email_otp
            - managed_policy_email_otp
            - partner_asserted
            - legacy_verified
        createdAt:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
    AccountEmailChallenge:
      type: object
      additionalProperties: false
      required:
        - id
        - email
        - status
        - attemptsRemaining
        - expiresAt
      properties:
        id:
          type: string
          pattern: ^account_email_[A-Za-z0-9_-]+$
          example: account_email_123
        email:
          type: string
          example: al***@example.com
          description: Masked email being verified.
        status:
          type: string
          enum:
            - pending
            - verified
            - expired
            - failed
        verificationMethod:
          type: string
          enum:
            - stableyard_email_otp
            - partner_asserted
        attemptsRemaining:
          type: integer
          minimum: 0
          maximum: 5
        expiresAt:
          type: string
          format: date-time
        verifiedAt:
          type: string
          format: date-time
    ErrorResponse:
      type: object
      additionalProperties: false
      required:
        - error
      properties:
        error:
          type: object
          additionalProperties: false
          required:
            - code
            - message
          properties:
            code:
              type: string
              minLength: 1
              maxLength: 128
              example: bad_request
            message:
              type: string
              minLength: 1
              maxLength: 1000
              example: The request is invalid
            details: {}
  responses:
    BadRequest:
      description: Bad request
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: BadRequest response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Unauthorized:
      description: Unauthorized
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Unauthorized response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Forbidden:
      description: The app secret does not include the required scope
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Forbidden response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    NotFound:
      description: Not found
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: NotFound response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    Conflict:
      description: Conflict
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: Conflict response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    FailedDependency:
      description: Required chain, network, or provider configuration is missing
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: FailedDependency response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
    TooManyRequests:
      description: >-
        Rate limit, payment-option limit, selection cooldown, or temporary abuse
        block
      headers:
        Stableyard-Version:
          description: >-
            Effective date-based Stableyard API contract version for this
            response.
          schema:
            type: string
            enum:
              - '2026-09-09'
        Retry-After:
          description: Seconds until the caller should retry.
          schema:
            type: integer
            minimum: 1
        RateLimit-Limit:
          description: Quota for the most constrained policy.
          schema:
            type: integer
            minimum: 1
        RateLimit-Remaining:
          description: Requests remaining in that policy window.
          schema:
            type: integer
            minimum: 0
        RateLimit-Reset:
          description: Seconds until that policy window resets.
          schema:
            type: integer
            minimum: 0
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            example:
              summary: TooManyRequests response
              value:
                error:
                  code: bad_request
                  message: The request is invalid
                  details: example
  securitySchemes:
    partnerBasicAuth:
      type: http
      scheme: basic
      description: >-
        HTTP Basic auth. Username is the Stableyard app ID. Password is the app
        secret. The optional Stableyard-Version request header must match the
        environment pin.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.