Verify a global account email via a signed link
GET/api/account/email/verify/:id/:hash
Consumes a temporary SIGNED link (the SPA /verify-email page forwards the full signed query here so the signature stays valid). RLS-free / global — no tenant context. Idempotent: an already-verified account returns 200.
Request
Responses
- 200
- 403
The account email was verified (or already verified).
Invalid signature or tampered hash.