Start here
Confirm a support request
/v1/support/confirm/{token}on https://api.auray.ai/v1The click that turns a waiting request into a conversation.
The click that turns a waiting request into a conversation. A request from an address that has not proved it controls its mailbox is held rather than ticketed — that is what makes an attacker need one controlled mailbox per ticket — and this is the other half. A GET because it is clicked from an email; idempotent, so a second click answers with the same reference rather than making another ticket.
#Authentication
No key needed — this document is public.
#Request
#Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
token | string | yes | The whole path segment, never a query parameter — a token in a query string lands in referrer headers and in analytics. 32 random bytes, base64url. |
#Example request
curl https://api.auray.ai/v1/support/confirm/…const res = await fetch("https://api.auray.ai/v1/support/confirm/…", {
method: "GET",
});
console.log(await res.json());import requests
r = requests.get(
"https://api.auray.ai/v1/support/confirm/…",
)
r.raise_for_status()
print(r.json())package main
import (
"fmt"
"io"
"net/http"
)
func main() {
req, err := http.NewRequest("GET", "https://api.auray.ai/v1/support/confirm/…", nil)
if err != nil {
panic(err)
}
res, err := http.DefaultClient.Do(req)
if err != nil {
panic(err)
}
defer res.Body.Close()
out, _ := io.ReadAll(res.Body)
fmt.Println(res.Status, string(out))
}<?php
$ch = curl_init("https://api.auray.ai/v1/support/confirm/…");
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
echo curl_getinfo($ch, CURLINFO_HTTP_CODE), " ", $response, PHP_EOL;require "net/http"
uri = URI("https://api.auray.ai/v1/support/confirm/…")
req = Net::HTTP::Get.new(uri)
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
puts res.code, res.bodyimport java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Main {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.auray.ai/v1/support/confirm/…"))
.GET()
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode() + " " + response.body());
}
}using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.auray.ai/v1/support/confirm/…");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");#Responses
#200 OK
Confirmed. held: true means the address proved itself and the message is still held for our support team — two different questions, and clicking a link answers only the first.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
status | string | no | — | One of "confirmed". |
reference | string | no | — | |
replayed | boolean | no | — | True on a second click of the same link. |
acknowledged | boolean | no | — | Whether the acknowledgement email was accepted for delivery. A false here does not mean the ticket failed. |
held | boolean | no | — |
Headers:
| Header | Description |
|---|---|
RateLimit-Limit | |
RateLimit-Remaining | |
RateLimit-Reset | Seconds until refill. |
X-Request-Id |
#404 Not Found
support_link_invalid — not one of ours, or revoked. The two answer identically on purpose.
The error body: error, message, docs (the entry that explains it) and request_id.
#410 Gone
support_link_expired — ours, and older than 72 hours.
The error body: error, message, docs (the entry that explains it) and request_id.
#429 Too Many Requests
support_rate_limited — too many attempts from this address.
The error body: error, message, docs (the entry that explains it) and request_id.
#503 Service Unavailable
support_disabled, support_not_configured or support_unavailable.
The error body: error, message, docs (the entry that explains it) and request_id.
#Status codes
| Status | Meaning |
|---|---|
200 | Confirmed. held: true means the address proved itself and the message is still held for our support team — two different questions, and clicking a link answers only the first. |
404 | support_link_invalid — not one of ours, or revoked. |
410 | support_link_expired — ours, and older than 72 hours. |
429 | support_rate_limited — too many attempts from this address. |
503 | support_disabled, support_not_configured or support_unavailable. |
Every refusal names its code, and every code is explained at Errors.