Verifying an address is not the same as verifying a person.

curl -X POST https://app.usenotix.dev/api/v1/verify/send \
  -H "Authorization: Bearer $NOTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "to": "user@example.com", "appName": "Acme", "clientIp": "203.0.113.10" }'

# 201 { "id": "ver_abc123", "status": "pending", "attemptsRemaining": 5,
#       "risk": { "score": 0, "level": "LOW", "reasons": [] } }

curl -X POST https://app.usenotix.dev/api/v1/verify/check \
  -H "Authorization: Bearer $NOTIX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "id": "ver_abc123", "code": "482913" }'

# 200 { "id": "ver_abc123", "verified": true, "status": "verified" }

import { Notix } from "notix-js";

const notix = new Notix(process.env.NOTIX_API_KEY);

// At sign-up: a code goes to the address. A disposable domain is refused
// here with 422 RISK_REFUSED, before any code exists.
const { data, error } = await notix.verify.send({
  to: form.email,
  appName: "Acme",
  clientIp: request.ip,
});
if (error) return respond(error);
session.verificationId = data.id;

// When the user types the code: the address is now known to reach a person.
const check = await notix.verify.check({ id: session.verificationId, code: form.code });
if (check.data?.verified) session.emailVerified = true;

import os
from notix import Notix

notix = Notix(os.environ["NOTIX_API_KEY"])

data, error = notix.verify.send(
    {"to": form["email"], "appName": "Acme", "clientIp": request.remote_addr}
)
if error:
    return respond(error)  # 422 RISK_REFUSED for a disposable domain
session["verification_id"] = data["id"]

check, error = notix.verify.check(
    {"id": session["verification_id"], "code": form["code"]}
)
if check and check["verified"]:
    session["email_verified"] = True