> ## Documentation Index > Fetch the complete documentation index at: https://api-portal.etoro.com/llms.txt > Use this file to discover all available pages before exploring further. # Direct email verification (trusted partner) > **Rate limit:** 60 requests per 60 seconds. This is a **shared quota** — the same budget is consumed by a group of related endpoints, so calling any of them reduces what is left for the others (you cannot call each at the full rate independently). Endpoints sharing this quota: - `POST /api/v1/users/email/verifications` - `POST /api/v1/users/email/verifications/confirmations` --- Allows trusted partners to directly verify a user's email without OTP. **SECURITY - Partner Ownership Validation:** The system validates that the user was created by this partner (affiliateId match). A partner can ONLY verify emails for users originally created by that partner. ## OpenAPI ````yaml /api-reference/partners-openapi.json post /api/v1/users/email/verifications/direct-confirmations openapi: 3.0.1 info: title: eToro Api version: v1.342.0 description: >- eToro’s public API provides access to real-time financial data, trading insights, and account management features, allowing developers to integrate eToro’s services into their applications. With access to market prices, historical data, and social trading information, the API empowers users to enhance their trading strategies. Designed for security and scalability, the eToro API ensures smooth and reliable integration for a variety of financial applications. For more details on integrating with eToro's public WebSocket service, please refer to the dedicated [WebSocket documentation](./websocket/websocket-doc.html). ## Authentication Every request must be authenticated with exactly one of two options: an OAuth 2.0 access token (`Authorization: Bearer `), or the non-interactive credential pair (`x-api-key` + `x-user-key` headers). The two options are mutually exclusive — a request carrying both is rejected. Each operation lists the OAuth scopes that grant access as alternative security requirements: a bearer token needs only ONE of them, and the same permissions govern the credential pair. servers: - url: https://public-api.etoro.com description: eToro Public API - Partners security: - apiKeyAuth: [] userKeyAuth: [] - oauth2: [] tags: - name: OPS - name: KYC - name: Cash Accounts - name: FTD - name: Crypto Deposit - name: Crypto Withdrawals - name: Registration - name: Sub-Accounts - name: Email Verification - name: Trusted Partner - name: Phone Verification - name: Verification paths: /api/v1/users/email/verifications/direct-confirmations: post: tags: - Email Verification - Trusted Partner summary: Direct email verification (trusted partner) description: >- **Rate limit:** 60 requests per 60 seconds. This is a **shared quota** — the same budget is consumed by a group of related endpoints, so calling any of them reduces what is left for the others (you cannot call each at the full rate independently). Endpoints sharing this quota: - `POST /api/v1/users/email/verifications` - `POST /api/v1/users/email/verifications/confirmations` --- Allows trusted partners to directly verify a user's email without OTP. **SECURITY - Partner Ownership Validation:** The system validates that the user was created by this partner (affiliateId match). A partner can ONLY verify emails for users originally created by that partner. operationId: directEmailVerification parameters: - name: X-Request-ID in: header required: true schema: type: string format: uuid requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DirectEmailVerificationRequest' responses: '200': description: Email verified successfully content: application/json: schema: $ref: '#/components/schemas/DirectVerificationResponse' headers: RateLimit-Limit: description: >- Maximum number of requests allowed per window. This budget is SHARED across 3 endpoints (it is NOT per-endpoint): a request to any endpoint in the group spends the same budget. See this operation's description for the full list of endpoints sharing it. schema: type: integer example: 60 RateLimit-Remaining: description: Requests remaining in the current window for this quota. schema: type: integer RateLimit-Reset: description: Seconds until the current window resets. schema: type: integer RateLimit-Policy: description: Quota policy in the form `;w=`. schema: type: string example: 60;w=60 '400': description: >- Validation error or stale evidence. Error codes: GcidMustBePositive, AffiliateIdMustBePositive, RequestBodyRequired, EmailRequired, VerificationEvidenceRequired, PartnerReferenceIdRequired, PartnerReferenceIdTooLong, InvalidVerificationMethod, VerifiedAtRequired, ExternalProviderIdRequired, ExternalProviderIdTooLong, ExternalReferenceIdTooLong, AdditionalDetailsTooLong, VerificationEvidenceTooOld. content: application/json: schema: $ref: '#/components/schemas/ContactVrfB_ErrorResponse' '401': description: Missing or invalid API key. '403': description: 'Operation not permitted. Error code: UserNotOwnedByPartner.' content: application/json: schema: $ref: '#/components/schemas/ContactVrfB_ErrorResponse' '409': description: 'Conflict. Error codes: AlreadyHasVerifiedEmail, EmailAlreadyInUse.' content: application/json: schema: $ref: '#/components/schemas/ContactVrfB_ErrorResponse' '429': description: >- Too Many Requests — the shared rate limit (60 requests / 60s) was exceeded. headers: RateLimit-Limit: description: >- Maximum number of requests allowed per window. This budget is SHARED across 3 endpoints (it is NOT per-endpoint): a request to any endpoint in the group spends the same budget. See this operation's description for the full list of endpoints sharing it. schema: type: integer example: 60 RateLimit-Remaining: description: Requests remaining in the current window for this quota. schema: type: integer RateLimit-Reset: description: Seconds until the current window resets. schema: type: integer RateLimit-Policy: description: Quota policy in the form `;w=`. schema: type: string example: 60;w=60 Retry-After: description: Seconds to wait before retrying. schema: type: integer example: 60 security: - apiKeyAuth: [] userKeyAuth: [] - oauth2: - etoro-public:verification.trusted.email:write components: schemas: DirectEmailVerificationRequest: type: object required: - email - verificationEvidence properties: email: type: string format: email description: Email address to verify. example: user@example.com verificationEvidence: $ref: '#/components/schemas/VerificationEvidence' DirectVerificationResponse: type: object properties: success: type: boolean example: true data: type: object properties: verified: type: boolean description: Whether verification was successful. example: true verificationLevel: type: integer description: User's new verification level. example: 1 verifiedAt: type: string format: date-time description: Timestamp of verification (UTC). example: '2026-05-03T12:10:00Z' verificationSource: type: string description: Source of verification. example: partnerVerified partnerReferenceId: type: string description: Partner's reference ID echoed back. example: PARTNER-VRF-12345 ContactVrfB_ErrorResponse: type: object properties: success: type: boolean example: false error: type: object properties: code: type: string example: InvalidPhoneCountryCode message: type: string example: PhoneCountryCode must be a valid E.164 country code prefix. details: type: string nullable: true field: type: string nullable: true description: The field that failed validation (400 responses only). value: nullable: true description: The value that failed validation (400 responses only.) VerificationEvidence: type: object description: Evidence of the partner's verification process. required: - partnerReferenceId - verificationMethod - verifiedAt properties: partnerReferenceId: type: string description: Partner's internal reference ID for the verification. maxLength: 100 example: PARTNER-VRF-12345 verificationMethod: type: string description: Method used by partner to verify. enum: - sms - voiceCall - inPerson - videoCall - documentCheck - documentVerification - bankVerification - governmentDb - other example: sms verifiedAt: type: string format: date-time description: Timestamp when partner verified the data (UTC). example: '2026-05-01T10:00:00Z' externalProviderId: type: string description: >- External KYC provider identifier. Required when verificationMethod is documentVerification. maxLength: 50 example: onfido externalReferenceId: type: string description: Reference ID from the external KYC provider. maxLength: 100 example: onfido-check-abc123 additionalDetails: type: string description: Optional additional context about the verification. maxLength: 300 example: Verified during account opening with SMS OTP securitySchemes: apiKeyAuth: type: apiKey in: header name: x-api-key description: >- API key of the application. Only valid together with the x-user-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. The pair is granted the same permissions the operation's OAuth scopes describe. Demo credential for trying the API from these docs: `lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663` x-default: lhgfaslk21490FAScVPkdsb53F9dNkfHG4faZSG5vfjndfcfgdssdgsdHF4663 userKeyAuth: type: apiKey in: header name: x-user-key description: >- User-specific authentication key. Only valid together with the x-api-key header — the pair is an alternative to OAuth bearer authentication, never sent alongside it. Demo credential for trying the API from these docs: `eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_` x-default: >- eyJlYW4iOiJVbnJlZ2lzdGVyZWRBcHBsaWNhdGlvbiIsImVrIjoiOE5sZ2cwcW5EUVdROUFNWGpXT2lmOWktZnpidG5KcUlqWGJ3WHJZZkpZcldrbG90ZEhvLVBjSWhQaU8xU1ZtMW84aU1WZGZqN2xWNzFjLXFxLmcybXE1dnh4Q1hUT25xaWRUaTFlcEhmVk1fIn0_ oauth2: type: oauth2 description: >- eToro OAuth2 — send the access token as `Authorization: Bearer `. Each operation lists the scopes that grant access as separate `security` requirements (OpenAPI OR semantics): the caller's token only needs ONE of them — you do NOT need all of them. Mutually exclusive with the x-api-key/x-user-key credential pair: never send both. flows: authorizationCode: authorizationUrl: '' tokenUrl: '' scopes: etoro-public:demo:read: Grants access to the 'etoro-public:demo:read' scope. etoro-public:kyc:answers:read: Grants access to the 'etoro-public:kyc:answers:read' scope. etoro-public:kyc:answers:write: Grants access to the 'etoro-public:kyc:answers:write' scope. etoro-public:kyc:questions:read: Grants access to the 'etoro-public:kyc:questions:read' scope. etoro-public:kyc:read: Grants access to the 'etoro-public:kyc:read' scope. etoro-public:kyc:regulations:read: Grants access to the 'etoro-public:kyc:regulations:read' scope. etoro-public:kyc:write: Grants access to the 'etoro-public:kyc:write' scope. etoro-public:money.accounts:read: Grants access to the 'etoro-public:money.accounts:read' scope. etoro-public:money.accounts:write: Grants access to the 'etoro-public:money.accounts:write' scope. etoro-public:money.deposit.crypto:read: >- Grants access to the 'etoro-public:money.deposit.crypto:read' scope. etoro-public:money.deposit.crypto:write: >- Grants access to the 'etoro-public:money.deposit.crypto:write' scope. etoro-public:money.ftd:read: Grants access to the 'etoro-public:money.ftd:read' scope. etoro-public:money.ftd:write: Grants access to the 'etoro-public:money.ftd:write' scope. etoro-public:money.withdraw.crypto:read: >- Grants access to the 'etoro-public:money.withdraw.crypto:read' scope. etoro-public:money.withdraw.crypto:write: >- Grants access to the 'etoro-public:money.withdraw.crypto:write' scope. etoro-public:partner-default: Grants access to the 'etoro-public:partner-default' scope. etoro-public:partner:registration:read: >- Grants access to the 'etoro-public:partner:registration:read' scope. etoro-public:partner:registration:write: >- Grants access to the 'etoro-public:partner:registration:write' scope. etoro-public:real:read: Grants access to the 'etoro-public:real:read' scope. etoro-public:sub-accounts:delete: Grants access to the 'etoro-public:sub-accounts:delete' scope. etoro-public:verification.address:read: >- Grants access to the 'etoro-public:verification.address:read' scope. etoro-public:verification.address:write: >- Grants access to the 'etoro-public:verification.address:write' scope. etoro-public:verification.email:write: >- Grants access to the 'etoro-public:verification.email:write' scope. etoro-public:verification.personaldetails:read: >- Grants access to the 'etoro-public:verification.personaldetails:read' scope. etoro-public:verification.personaldetails:write: >- Grants access to the 'etoro-public:verification.personaldetails:write' scope. etoro-public:verification.phone:write: >- Grants access to the 'etoro-public:verification.phone:write' scope. etoro-public:verification.trusted.email:write: >- Grants access to the 'etoro-public:verification.trusted.email:write' scope. etoro-public:verification.trusted.phone:write: >- Grants access to the 'etoro-public:verification.trusted.phone:write' scope. etoro-public:verification:trusted:user:write: >- Grants access to the 'etoro-public:verification:trusted:user:write' scope. ````