# Create user email verification code

GraphQL endpoint: `/user`

Generates a verification code (OTP) for an unverified email address. The verification code will be sent to the email address and can be used to verify ownership.

A partner company whose application the user is in can pass a `brandingToken` its backend minted (`POST /auth/otp-branding-token`, bound to this user or to the destination): the email then names that company as what the code is for. Without it the plain TNID message is sent.

## Query

```graphql
mutation (
  $emailId: ID!
) {
  createUserEmailVerificationCode (
    emailId: $emailId
  ) {
    expiresAt
    remainingOtpAttempts
    nextOtpAt
    otpStatus
  }
}

```

## Variables

```json
{
  "emailId": "00000000-0000-4000-8000-000000000001"
}
```

## Response

```json
{
  "data": {
    "createUserEmailVerificationCode": {
      "expiresAt": "2026-01-15T09:00:00.000000",
      "nextOtpAt": "2026-01-15T09:00:01.000000",
      "otpStatus": "OTP sent",
      "remainingOtpAttempts": 5
    }
  }
}
```