Email a single-use sign-in link
POST/admin/auth/magic-link
Answers 202 unconditionally — registered address or not, suspended
account or not, mail delivered or not. That uniformity is the endpoint's
security property: anything that varied with whether the address exists would
turn this into an account-enumeration API.
The consequence is worth stating plainly: undelivered mail is invisible from
here. A 202 means the request was accepted, never that anything arrived.
Request
Responses
- 202
- 400
- 429
Accepted — always
Malformed body, or email missing
too_many_requests — three per hour per address, three per hour per IP