Mail and account security API
📝 TODO — this English page is a skeleton. The structure mirrors the Chinese page, which is fully written.
Email verification
| Method | Path | Description |
|---|---|---|
POST | /api/email/verify | Complete verification with a token (24-hour TTL, single use) |
POST | /api/email/resend | Resend the verification mail (requires a session token) |
Password reset
| Method | Path | Description |
|---|---|---|
POST | /api/email/forgot | Request a reset link (30-minute TTL) |
POST | /api/email/reset | Set a new password with the token |
forgot always returns the same success body whether or not the address is registered, so it cannot be used to enumerate accounts. Resetting a password revokes every existing session.
Transport
| Method | Path | Description |
|---|---|---|
GET | /api/mail/status | smtp when configured, otherwise file (logged to disk, not delivered) |
POST | /api/mail/test | Send a test email |