---
title: "Confirm a customer's email verification code"
method: POST
path: "/customers/{customerId}/verify-email/confirm"
tags: ["Contact Verification"]
---

# Confirm a customer's email verification code

`POST /customers/{customerId}/verify-email/confirm`

Submit the one-time code the customer received by email to mark their email
as `VERIFIED`. On success, `contactVerification.email` becomes `VERIFIED`.

Both email and phone must be `VERIFIED` before the customer can begin KYC.

In sandbox, the code is always `123456`.

## Request body

- ContactVerificationConfirmRequest — Request body for confirming an email or phone verification challenge.
  - `code` string, required — The one-time verification code the customer received via email or SMS. In sandbox, the code is always `123456`.

## Response `200`

Email verified.

- Customer
  - `id` string — System-generated unique identifier
  - `platformCustomerId` string, required — Platform-specific customer identifier
  - `customerType` 'INDIVIDUAL' | 'BUSINESS', required — Whether the customer is an individual or a business entity
  - `endUserTermsConsent` EndUserTermsConsent
    - `acceptedAt` string, date-time, required — Date and time when the customer accepted the End User Terms.
    - `ipAddress` string, required — IP address of the device the customer used when accepting the terms.
    - `termsVersion` string, required — Version identifier of the accepted Grid End User Terms.
    - `acceptanceMethod` 'CHECKBOX' | 'CLICK_TO_ACCEPT', required — Method the customer used to affirmatively accept the End User Terms.
  - `region` string — Country code (ISO 3166-1 alpha-2) representing the customer's regional identity and regulatory jurisdiction.
  - `currencies` string[] — List of currency codes enabled for this customer.
  - `email` string, email — Email address for the customer.
  - `phoneNumber` string — Phone number for the customer in strict E.164 format.
  - `umaAddress` string, required — Full UMA address (always present in responses, even if system-generated). This is an optional identifier to route payments to the customer.
  - `createdAt` string, date-time — Creation timestamp
  - `updatedAt` string, date-time — Last update timestamp
  - `isDeleted` boolean — Whether the customer is marked as deleted
  - `contactVerification` ContactVerification — Email and/or phone verification state for the customer. This object is **only present when the customer's regulatory jurisdiction requires contact verification** (e.g. EU customers). For customers who have no such requirement, this object is omitted entirely — no action is needed. Each channel is reported independently: only the channels the customer's provider actually requires are present. A provider may require both email and phone, just one of them, or — when the object is absent — neither. Every channel that **is** present must reach `VERIFIED` before the customer can begin KYC. Drive each present channel with `POST /customers/{customerId}/verify-email` and/or `POST /customers/{customerId}/verify-phone` (and their `/confirm` sub-routes).
    - `email` 'PENDING' | 'VERIFIED' — Status of an individual contact-verification channel (email or phone). `PENDING` means verification is required but not yet completed; `VERIFIED` means the channel has been confirmed.
    - `phone` 'PENDING' | 'VERIFIED' — Status of an individual contact-verification channel (email or phone). `PENDING` means verification is required but not yet completed; `VERIFIED` means the channel has been confirmed.

## Other responses

- `400` — Invalid or expired code
- `401` — Unauthorized
- `404` — Customer not found
- `409` — The customer's payment provider does not require contact verification, or the email is already verified.
- `500` — Internal service error

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/versions/526036c12609/schema)