# verify_signup_request

Start a Cloud Intelligence trial for an organization that is not yet a DoiT customer. These operations require no API key: they are rate limited, idempotent, and provision nothing until the organization's admin verifies the request. Agents create a request and hand the returned consentUrl to the admin; the admin verifies by entering the emailed code (or signing the request on the console), after which the tenant is provisioned and the request reports its customer id. Confirms ownership of the admin email by entering the 6-digit code that was emailed when the request was created (or resent). Success records consent and starts provisioning; the request moves to consented and then completed. Five wrong codes lock the current code; request a new one with resendSignupVerification.

Agent View of the PolicyLayer registry record for `verify_signup_request`. HTML page: https://policylayer.com/tools/doit/verify-signup-request

## Facts

- Tool: `verify_signup_request`
- Server: Doit (`@doitintl/doit-mcp-server`) — https://policylayer.com/tools/doit.md
- Install: `npx -y @doitintl/doit-mcp-server`
- Homepage: https://www.npmjs.com/package/@doitintl/doit-mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 3 (2 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | string | yes | The 6-digit code from the verification email. |
| `customerContext` | string | no | Scope the request to a specific customer by ID. Required for DoiT employees (whose token isn't tied to a single customer); omit for direct customer users. |
| `signupRequestId` | string | yes |  |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "verify_signup_request",
    "arguments": {
      "code": "<code>",
      "signupRequestId": "<signupRequestId>"
    }
  }
}
```

## Why verify_signup_request is rated Low

Even though verify_signup_request only reads data, uncontrolled read access leaks sensitive information and racks up API costs: an agent caught in a retry loop can make thousands of calls a minute without anyone noticing.

Risk signals: Accepts freeform code/query input (code) · Admin/system-level operation

## Use case

AI agents call verify_signup_request to retrieve information from Doit without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Doit:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "verify_signup_request": {}
  }
}
```

## Other tools on Doit (237)

- `cancel_async_operation` — Destructive — https://policylayer.com/tools/doit/cancel-async-operation.md
- `cancel_invite` — Destructive — https://policylayer.com/tools/doit/cancel-invite.md
- `confirm_action` — Destructive — https://policylayer.com/tools/doit/confirm-action.md
- `delete_account_role` — Destructive — https://policylayer.com/tools/doit/delete-account-role.md
- `delete_alert` — Destructive — https://policylayer.com/tools/doit/delete-alert.md
- `delete_allocation` — Destructive — https://policylayer.com/tools/doit/delete-allocation.md
- `delete_annotation` — Destructive — https://policylayer.com/tools/doit/delete-annotation.md
- `delete_ava_conversation` — Destructive — https://policylayer.com/tools/doit/delete-ava-conversation.md
- `delete_budget` — Destructive — https://policylayer.com/tools/doit/delete-budget.md
- `delete_cloudflow_connection` — Destructive — https://policylayer.com/tools/doit/delete-cloudflow-connection.md
- `delete_custom_theme` — Destructive — https://policylayer.com/tools/doit/delete-custom-theme.md
- `delete_customer_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-customer-geographic-access-scope.md
- `delete_customer_group` — Destructive — https://policylayer.com/tools/doit/delete-customer-group.md
- `delete_datahub_dataset` — Destructive — https://policylayer.com/tools/doit/delete-datahub-dataset.md
- `delete_datahub_datasets` — Destructive — https://policylayer.com/tools/doit/delete-datahub-datasets.md
- `delete_datahub_events_by_filter` — Destructive — https://policylayer.com/tools/doit/delete-datahub-events-by-filter.md
- `delete_folder` — Destructive — https://policylayer.com/tools/doit/delete-folder.md
- `delete_geographic_access_custom_region` — Destructive — https://policylayer.com/tools/doit/delete-geographic-access-custom-region.md
- `delete_insight_result` — Destructive — https://policylayer.com/tools/doit/delete-insight-result.md
- `delete_insight_results` — Destructive — https://policylayer.com/tools/doit/delete-insight-results.md
- `delete_label` — Destructive — https://policylayer.com/tools/doit/delete-label.md
- `delete_report` — Destructive — https://policylayer.com/tools/doit/delete-report.md
- `delete_role` — Destructive — https://policylayer.com/tools/doit/delete-role.md
- `delete_service_account` — Destructive — https://policylayer.com/tools/doit/delete-service-account.md
- `delete_service_account_token` — Destructive — https://policylayer.com/tools/doit/delete-service-account-token.md
- `delete_user` — Destructive — https://policylayer.com/tools/doit/delete-user.md
- `delete_user_geographic_access_scope` — Destructive — https://policylayer.com/tools/doit/delete-user-geographic-access-scope.md
- `id_of_asset` — Destructive — https://policylayer.com/tools/doit/id-of-asset.md
- `remove_ticket_tags` — Destructive — https://policylayer.com/tools/doit/remove-ticket-tags.md
- `async_run_inline` — Execute — https://policylayer.com/tools/doit/async-run-inline.md
- …and 207 more: https://policylayer.com/tools/doit.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=doit · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/doit