Get Operations Confirmation Settings

This endpoint retrieves the operations confirmation settings configured for the authenticated user's account. The settings define which confirmation methods are enabled for sensitive operations such as transfers, payments, and payee management. Use this endpoint to read the current state of SMS (short message) and time-based OTP (Google Authenticator) confirmation flags before presenting or modifying security preferences.

Endpoint

GET /settings/opsConfirmation

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to display or audit the two-factor confirmation preferences for a user's account. It is typically called before a settings update flow to compare current values, or during onboarding to determine which confirmation channels have already been enabled. Partners can use the response to enforce security policies or guide users through enabling stronger confirmation methods.

Response

200 OK

{
  "shortMessageCodeEnabled": true,
  "timeBasedCodeEnabled": false,
  "timeBasedCodeLongSetEnabled": true
}

Error Codes

Common Mistakes

• Sending a Content-Type: application/json header is not required for GET requests and will not affect the response, but omitting Authorization will result in a 401 error.
• Interpreting a false value as "feature unavailable" — the flag indicates the confirmation method is currently disabled for the user, not that it is unsupported by the platform.
• Using an expired token; tokens have a 10-minute lifetime and must be refreshed via POST /api/auth/refresh before they expire.

Related Endpoints

• POST /api/auth/v2 — Obtain a Bearer token for authentication
• POST /api/auth/refresh — Refresh an existing Bearer token

Example

curl -X GET https://api.banking.netevia.dev/settings/opsConfirmation \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"