> ## Documentation Index > Fetch the complete documentation index at: https://docs.trylath.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Every Lath operation is POST https://platform.trylath.com/, with a JSON body and `Authorization: Bearer `. `email.send` is POST /email/send. > Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step. > Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice. > A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed. > The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json. # auth.link.complete > Completes a magic-link sign-in from the hosted landing page using the link token as the credential. Returns where to send the user and a one-time code appended to it as lath_code, which their app exchanges for the session with auth.session.exchange; or, when a second factor is owed, an mfaToken the landing page finishes with auth.mfa.verify. ## OpenAPI ````yaml /api-reference/openapi.json post /auth/link/complete openapi: 3.1.0 info: title: Lath API version: 0.1.0 description: >- Every operation is one POST. The same set is reachable over MCP, the SDK and the CLI; nothing is dashboard-only. servers: - url: https://platform.trylath.com description: This deployment security: [] paths: /auth/link/complete: post: tags: - auth summary: auth.link.complete description: >- Completes a magic-link sign-in from the hosted landing page using the link token as the credential. Returns where to send the user and a one-time code appended to it as lath_code, which their app exchanges for the session with auth.session.exchange; or, when a second factor is owed, an mfaToken the landing page finishes with auth.mfa.verify. operationId: auth.link.complete parameters: - name: Idempotency-Key in: header required: false schema: type: string description: >- Replays the stored response for the same key and input; refuses different input. requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: challengeId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ token: type: string minLength: 20 maxLength: 64 userAgent: type: string maxLength: 400 required: - challengeId - token additionalProperties: false responses: '200': description: '{ activityId, result }. activityId is empty for reads.' content: application/json: schema: type: object properties: activityId: type: string description: The activity this call created, or empty for a read. result: $schema: https://json-schema.org/draft/2020-12/schema anyOf: - type: object properties: activityId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ redirectTo: type: string environmentId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ expiresInSeconds: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - activityId - redirectTo - environmentId - expiresInSeconds additionalProperties: {} - type: object properties: activityId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ environmentId: type: string format: uuid pattern: >- ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$ mfa: type: object properties: required: type: boolean const: true mfaToken: type: string expiresAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ methods: type: array items: type: string required: - required - mfaToken - expiresAt - methods additionalProperties: {} required: - activityId - environmentId - mfa additionalProperties: {} required: - activityId - result '400': description: invalid_input or invalid_json '401': description: unauthenticated '403': description: forbidden '404': description: not_found '409': description: 'conflict: idempotency_mismatch, email_taken, last_key' '413': description: body_too_large '429': description: rate_limited security: [] ````