# Authenticate email link

Authenticate a user using the email magic link you sent them. Upon clicking the email link, a code was returned to your redirect URI as the `code` query parameter. This API validates this code and returns user tokens.

Endpoint: POST /v1/auth/link/email/authenticate
Security: ClientAccessToken

## Request fields (application/json):

  - `resource` (string)
    Resource URI the authentication request is attempting to access, which is reflected in the audience (`aud` claim) of the access token. This must be configured as resource for the application.

  - `claims` (object)
    Used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the [OIDC Standard](https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter). For supported claims and how to request custom claims, see the [ID Token Reference](https://developer.transmitsecurity.com/openapi/id_token_reference/).
    Example: {"id_token":{"roles":null}}

  - `claims.id_token` (object)

  - `claims.access_token` (object)

  - `org_id` (string)
    Organization ID, used for member login in B2B scenarios

  - `client_attributes` (object)
    Client attributes

  - `client_attributes.user_agent` (string)

  - `client_attributes.ip_address` (string)

  - `device_id` (string)
    Identifier of the device from which the authentication request originates

  - `session_id` (string)
    Used to associate the authentication with an existing session (such as for MFA). If unspecified, a new session is created and the session ID is returned.

  - `code` (string, required)
    The code received from the magic link

  - `request_id` (string)
    The request ID. This is a mandatory parameter if you’ve previously requested to generate a request ID when sending OTP or email link.

## Response 200 fields (application/json):

  - `access_token` (string, required)
    User access token for accessing endpoints on behalf of the authenticated user.

  - `id_token` (string)
    ID token that identifies the user.

  - `refresh_token` (string)
    Refresh token used to refresh an expired access token.

  - `token_type` (string, required)
    Bearer.

  - `expires_in` (number, required)
    Expiration time of the access token in seconds.

  - `session_id` (string, required)
    ID of the session in which the authentication occurs.

  - `signing_artifacts` (any)
    Cryptographic data required to independently verify a transaction approval outside Mosaic. Returned when `approval_data` is provided for a supported transaction-signing flow; fields vary by authenticator.

  - `signing_artifacts.public_key` (string, required)
    Public key used to verify the signature.

  - `signing_artifacts.signature` (string, required)
    Signature generated by the passkey authenticator.

  - `signing_artifacts.credential_id` (string, required)
    Identifier of the passkey credential used for the approval.

  - `signing_artifacts.webauthn_session_id` (string, required)
    Identifier of the WebAuthn authentication session.

  - `signing_artifacts.authenticator_data` (string, required)
    Base64url-encoded data returned by the passkey authenticator as part of the WebAuthn assertion.

  - `signing_artifacts.client_data_json` (string, required)
    Base64url-encoded client data from the WebAuthn authentication response.

  - `signing_artifacts.raw_challenge` (string, required)
    Raw pre-hash challenge used to bind the signature to the approval data.

  - `signing_artifacts.signature` (string, required)
    Signature generated for the transaction-signing challenge.

  - `signing_artifacts.challenge` (string, required)
    Challenge used to generate the signature and bind it to the approval data.

  - `signing_artifacts.algorithm` (object, required)
    Parameters required to verify the signature.

  - `signing_artifacts.algorithm.name` (string, required)
    Signature algorithm used to verify the signature, for example `ecdsa` or `rsa-pss`.

  - `signing_artifacts.algorithm.hash` (string)
    Hash algorithm used to verify the signature, for example `sha-256`.

  - `signing_artifacts.algorithm.saltLength` (number)
    Length, in bytes, of the salt used by RSA-PSS.

  - `signing_artifacts.algorithm.namedCurve` (string)
    Elliptic curve used by ECDSA, for example `P-256`.