Sending a verification code

Send Verification Code

This endpoint initiates the delivery of a one-time verification code to the authenticated user through SMS, email, or in-app messaging. The code is tied to a specific action context defined by the shortMessageType parameter, enabling two-factor authentication (2FA) for sensitive operations. After receiving the code, the user must submit it to the corresponding verification check endpoint to complete the action.

Endpoint

POST /api/CodeVerification/send

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint whenever a user action requires additional identity confirmation, such as approving a financial transaction, resetting a password, linking an external account, or initiating an Earned Wage Access (EWA) request. Call this endpoint first to dispatch the code, then call POST /api/CodeVerification/check with the received code to complete the verification flow. Rate limiting is enforced to prevent abuse; avoid calling this endpoint multiple times in rapid succession for the same action.

Request Body

Accepted values for shortMessageType:

{
  "shortMessageType": "APPROVE_TRANSACTION"
}

Response

200 OK

A successful response indicates that the verification code was generated and dispatched to the user's registered contact method.

{
  "status": "success",
  "message": "Verification code sent successfully."
}

Error Codes

Common Mistakes

• Passing an unrecognized string for shortMessageType — only the exact enum values listed above are accepted; the field is case-sensitive (e.g., ApproveLinkedAccount not APPROVE_LINKED_ACCOUNT).
• Not following up with POST /api/CodeVerification/check — calling this endpoint alone does not complete the verification flow; the dispatched code must be submitted to the check endpoint.
• Repeatedly calling this endpoint before the previous code expires — this may trigger rate limiting (HTTP 429) and invalidate previously sent codes.
• Omitting the Authorization header or using an expired token — ensure the Bearer token is refreshed before calling this endpoint.

Related Endpoints

• POST /api/CodeVerification/check — Submit the received verification code to confirm the action
• POST /api/auth/v2 — Obtain a Bearer token for authentication
• POST /api/auth/refresh — Refresh an expiring Bearer token

Example

curl -X POST https://api.banking.netevia.dev/api/CodeVerification/send \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "shortMessageType": "APPROVE_TRANSACTION"
  }'