# Resume

> Exchange a one-time resume token

**Endpoint:** `POST /v1/resume`  
**Access:** Public (no credentials needed)

Unclaimed drafts get a fresh guest credential (+ cookie). Tokens expire after 24h and work once; otherwise 410 `resume_link_expired`.

## cURL example

```bash
curl -X POST "https://api.verifiedinbox.ai/v1/resume" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "string"
  }'
```

## Request body

| Field | Type | Description |
|---|---|---|
| `token` *(required)* | `string` | One-time `rt_…` token from a resume link. |

```json
{
  "token": "string"
}
```

## Responses

### 200 OK

Where to continue.

```json
{
  "application_id": "0192a5e0-1234-7000-8000-000000000001",
  "guest_token": "string",
  "requires_sign_in": true,
  "step": "domain"
}
```

### 400 (invalid_request)

`invalid_request` — the request is malformed.

```json
{
  "error": {
    "code": "invalid_request",
    "message": "Please provide a valid domain name."
  }
}
```

### 422 (unprocessable)

`unprocessable` / `blocked_provider` — understood but can't be done (plain-English reason).

```json
{
  "error": {
    "code": "unprocessable",
    "message": "Shared mailbox providers like gmail.com cannot be verified."
  }
}
```

### 429 (rate_limited)

`rate_limited` — retry after `Retry-After` seconds (`details.retry_after_seconds`). `limit_reached` — a quota is used up; `details.limit` names it and `next_action` offers support.

```json
{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests. Please wait a moment and try again."
  }
}
```