Skip to main content
ShumoulShumoul Developer Portalplatform.shumoul.com
Version: Latest

7. Account Activation

7.1 Endpoint​

POST api/Tenants/Verification
  • Controller: TenantsController ([Route("api/Tenants")], [AllowAnonymous]).
  • Request: TenantVerificationRequest { string TenantId, string VerificationToken }.
  • Handler: TenantService.VerifyAsync — compares request.VerificationToken against tenant.VerificationToken; on match calls tenant.SetVerified().

7.2 Token generation and delivery​

The verification token is the 6-digit OTP generated during registration (tenant.SaveVerificationToken(otp) — see Chapter 5 §5.5). In production it is delivered via the NewTenantRegisteredEvent handlers (WhatsApp OTP, SMS, email — see Chapter 5 §5.6). Never send real production emails/SMS during dev testing — in a dev/local environment, read the token directly from the tenant row instead (dev-safe activation), and never print or commit it in any report.

7.3 What activation does — and does not — do​

Verification sets tenant.IsVerified = true. It does not:

  • Provision the tenant's application database (see Chapter 8 for when that happens).
  • Log the user in or issue a JWT.
  • Trigger onboarding in any way.

7.4 Success response​

{ "data": true, "statusCode": 200, "succeeded": true, "messages": ["..."] }

7.5 Dev-safe verification approach used in this task​

Rather than exercising a real email/SMS channel, the verification token was read directly from the tenant's row in the dev database for the newly-registered tenant, then submitted to api/Tenants/Verification exactly as a real client would. This confirms the same code path a production client exercises, without touching any external notification channel or production credential.