curl -X GET https://api.gork.email/v1/messages/msg_908123acdf/verification \
-H "Authorization: Bearer gork_live_YOUR_KEY"
import { GorkClient } from "@gork/sdk"
const client = new GorkClient({ apiKey: process.env.GORK_API_KEY })
const verification = await client.messages.getVerification("msg_908123acdf")
if (verification.type === "otp") {
console.log("OTP code:", verification.otp?.code)
// → "728491"
}
from gork import GorkClient
client = GorkClient() # reads GORK_KEY / GORK_API_KEY
verification = client.get_message_verification("msg_908123acdf")
print(verification["otp"]["code"])
{
"data": {
"messageId": "msg_908123acdf",
"type": "otp",
"confidence": "high",
"otp": {
"code": "728491",
"expiresAt": "2026-09-08T13:04:56.789Z",
"providerHint": "github.com"
},
"evidence": {
"subject": "[GitHub] Please verify your device",
"keyword": "verification code"
}
}
}
Messages
Get Message Verification
Retrieve the OTP code or magic verification link detected in an inbound message.
GET
/
v1
/
messages
/
:id
/
verification
curl -X GET https://api.gork.email/v1/messages/msg_908123acdf/verification \
-H "Authorization: Bearer gork_live_YOUR_KEY"
import { GorkClient } from "@gork/sdk"
const client = new GorkClient({ apiKey: process.env.GORK_API_KEY })
const verification = await client.messages.getVerification("msg_908123acdf")
if (verification.type === "otp") {
console.log("OTP code:", verification.otp?.code)
// → "728491"
}
from gork import GorkClient
client = GorkClient() # reads GORK_KEY / GORK_API_KEY
verification = client.get_message_verification("msg_908123acdf")
print(verification["otp"]["code"])
{
"data": {
"messageId": "msg_908123acdf",
"type": "otp",
"confidence": "high",
"otp": {
"code": "728491",
"expiresAt": "2026-09-08T13:04:56.789Z",
"providerHint": "github.com"
},
"evidence": {
"subject": "[GitHub] Please verify your device",
"keyword": "verification code"
}
}
}
Gorkmail automatically analyzes every inbound email (after Agent Shield sanitization) for verification signals: one-time codes and verification links that services send during account signup, login, or password reset. This endpoint returns the structured result so your agent can complete verification without parsing raw email bodies.
Response
object
string
The message the verification was detected in (
msg_...).string
otp, magic_link, or otp_and_magic_link.string
high (trigger keyword adjacent to the code/link) or medium.object
object
curl -X GET https://api.gork.email/v1/messages/msg_908123acdf/verification \
-H "Authorization: Bearer gork_live_YOUR_KEY"
import { GorkClient } from "@gork/sdk"
const client = new GorkClient({ apiKey: process.env.GORK_API_KEY })
const verification = await client.messages.getVerification("msg_908123acdf")
if (verification.type === "otp") {
console.log("OTP code:", verification.otp?.code)
// → "728491"
}
from gork import GorkClient
client = GorkClient() # reads GORK_KEY / GORK_API_KEY
verification = client.get_message_verification("msg_908123acdf")
print(verification["otp"]["code"])
{
"data": {
"messageId": "msg_908123acdf",
"type": "otp",
"confidence": "high",
"otp": {
"code": "728491",
"expiresAt": "2026-09-08T13:04:56.789Z",
"providerHint": "github.com"
},
"evidence": {
"subject": "[GitHub] Please verify your device",
"keyword": "verification code"
}
}
}
Detection runs on sanitized content — prompt-injection payloads, zero-width characters, and hidden text are stripped by Agent Shield before verification analysis, so a cloaked or spoofed code cannot poison the result. Unsubscribe links and social share links are explicitly excluded from magic-link detection.
Returns
404 verification_not_found when the message has no detectable verification signal. Auto-replies (out-of-office etc.) never carry verification data.