Verifying makes the Layout account

October 21, 2026APIBreaking

In production, the code a person reads back to POST /v1/users/:id/verify now makes their own Layout account, on the number they just proved. There is no join page for anyone you provision.

What changed

Verify answers active. A good code answers "status": "active" and "claimed": true, as sandbox already did, where production answered "status": "provisioned" and "claimed": false.
One person, many applications. When the number's only Layout account was made by another application's verify, provisioning answers next: "verify", as for a new number. The text reads Layout: 123456 connects Acme Assistant to your existing Layout account, and Acme Assistant can then place orders for you., and a good code connects you to that account. You learn nothing about the other application.
A person's own Layout sign-in is unchanged. When the person signs in to Layout on the number themselves, provisioning still answers awaiting_user_approval or connect, and verify still answers authorized: false with next: "connect".
New confirm step. A confirm for a person who has not verified with your application answers 403 build_only with error.next.step verify_required, and no url. sign_up_required and link_expired are no longer sent.
handoffUrl is not for people. It is still in the provisioning answer. Do not send anyone to it.

Why it matters

A person you provision orders from your product without ever opening a Layout page to join. A person several applications reach has one Layout account, with one card.

What to do

Verify everyone you provision with POST /v1/users/:id/verify/start and POST /v1/users/:id/verify, and stop sending handoffUrl.
Handle verify_required on a confirm by verifying the person, then confirming again.
Tell the person about Layout in your own words before the first code reaches them.

See Verify their phone and Introduce Layout first.

Breaking changes

Code that reads claimed: false after a production verify, or waits for the person to sign up to Layout, now sees claimed: true at once.
Code that branches on sign_up_required or link_expired no longer sees them. Branch on verify_required.

All changes