Link your account to a Coritan staff account

This page is for people who work at Coritan. Your staff account signs in to the admin console, and your own Coritan account signs in to coritan.com. Linking the two lets mailboxes that are shared with you as staff open in the webmail of your own account.

• A staff account that can sign in to the admin console.
• Your own Coritan account, with two-factor authentication on. Staff mail opens in this account, so it needs the second factor.

1. In the admin console, open your own account page and make a one-time link for your Coritan account. The link works once, for ten minutes. Making a new one cancels the old one.
2. Open the link in a browser where you are signed in to your own Coritan account. It opens the Security tab of Settings, with a Coritan staff card.
3. Select Link to my staff account.

A message confirms Linked. Mailboxes shared with you as staff now open in your webmail. The Coritan staff card names the staff account you linked, and those mailboxes appear among the mailboxes your webmail can open. If the staff account is later deactivated, the card says so, and staff mailboxes stop opening in your account.

1. In the sidebar, select Settings, then the Security tab.
2. In the Coritan staff card, select Unlink.

Staff mailboxes stop opening in your account. You can also remove the link from the admin console, and so can a colleague who manages staff accounts.

Turn on two-factor authentication first: staff mail opens in this account.

Link to my staff account stays greyed out until two-factor authentication is on. Turn it on, then open the link again.

That link has expired or was already used. Make a new one in the admin console.

The link is more than ten minutes old, was used already, or a newer link replaced it. Make a new one.

That staff account is no longer active.

The staff account was deactivated. Ask a colleague who manages staff accounts.

This account is already linked to another staff account.

Remove the other link first, from this card or from the admin console.

Too many requests for this action. Please wait and try again.

You tried more than ten links in an hour. Wait before the next try.

• Turn on two-factor authentication
• Open and share mailboxes in webmail

These endpoints take your access token. GET /auth/me/staff-link answers with the linked staff account, or {"linked": null}:

{"linked": {"name": "Alex", "email": "alex@example.com", "active": true}}

POST /auth/me/staff-link links the accounts. Send the staff_link value from the link as code:

curl -X POST https://api.coritan.com/api/v1/auth/me/staff-link \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"code": "code from the link"}'

It answers with the same shape as GET. A refusal answers 422 with {"detail": {"code": "...", "message": "..."}}, where code is invalid_code, inactive, mfa_required or already_linked and message is the sentence shown above. More than ten tries in an hour answers 429.

DELETE /auth/me/staff-link removes the link and answers {"linked": null}.