Skip to main content

Initiate email-OTP identity verification from an external integration​

External-integration twin of PostHelpdeskVerifyEmailInitiate. Sends a one-time code to the identity's IdP-sourced verification email and returns a masked preview.

This is a ONE-DIRECTIONAL control and therefore weaker than the sensor mTOTP flow: the caller proves themselves to the operator, but the operator proves nothing to the caller. Integrations must present it as a fallback, not as an equivalent option.

Set delegation_mode + delegate_email to send the code to an approved delegate instead of the subject. Absent both, behaviour is unchanged.

Header Parameters
  • SlashID-OrgID string required

    The organization ID

    Example: af5fbd30-7ce7-4548-8b30-4cd59cb2aba1
Request Body required
  • identity_id string required

    The identity to verify via IdP-sourced email OTP. Obtained from the external verification-candidates listing.

  • connection_id string required

    The external identity connection ID (must have email-OTP verification enabled).

  • delegation_mode object

    How a delegate is selected for delegated verification. global_approved — pick from the org's approved delegate list. line_manager — the subject's line manager, resolved via the HRIS graph. unconstrained — any user eligible for the chosen verification method.

  • delegate_email email

    The delegate who receives the OTP. Validated server-side against delegation_mode (approved-list membership / line-manager match) and must resolve to a live identity in the verification source.

  • operator object required
  • email email required

    The human operating the integration (e.g. the ServiceNow agent). MUST be derived server-side by the integration (ServiceNow: gs.getUser().getEmail()), never supplied by its own client. Resolved to a SlashID console person holding a verifier role; 403 if it does not resolve or lacks the role.

  • assertion string required

    Possible values: [integration_asserted, idp_verified]

    How the operator identity was established. integration_asserted — the calling integration vouches for it under its own API credential; idp_verified — proven to SlashID directly. Recorded on every attempt so that a later move to per-agent authentication does not change what historical audit rows meant. Only integration_asserted is accepted today.

  • external_metadata object
  • source string required

    Possible values: [servicenow]

  • instance string

    ServiceNow instance name.

  • table string
  • record_id string

    sys_id of the Call or Incident. Frequently absent — verification commonly starts at call intake, on a record that has not been saved yet and therefore has no sys_id.

  • display_id string

    Human-facing record number, e.g. INC0012345.

Responses

Email-OTP verification initiated successfully

Schema
  • meta object
  • pagination object
  • limit integer
  • offset integer
  • total_count int64
  • cursor_pagination object

    Cursors are opaque. Follow the tokens the server returns; never construct, parse or modify one.

  • limit integer
  • next_cursor string

    Opaque token addressing the next page. Absent on the last page.

  • prev_cursor string

    Opaque token addressing the previous page. Absent on the first page.

  • last_cursor string

    Opaque token addressing the final page directly, so a client can jump to the end without a total count.

  • total_count int64

    Total number of matching items. Returned on the FIRST page only; clients cache it for the remainder of the walk.

  • errors object[]
  • httpcode integer
  • message string
  • result object
  • verification_id string

    Unique email-OTP verification identifier

  • masked_email string

    The target email address, masked for display (e.g. "a•••@corp.com")

  • expires_at date-time

    When this verification expires