Change Personal Email Address with OTP
This endpoint allows personal customers to update their registered email address by verifying their identity with a one-time password (OTP). The OTP must be obtained prior to calling this endpoint and is used to confirm that only the account owner can authorize the change. Keeping email addresses current ensures uninterrupted delivery of account notifications and communications.
Endpoint
POST /api/account/changeEmailOtp
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Use this endpoint when a personal customer needs to change the email address associated with their account. Because email is used for account notifications and security alerts, the OTP verification step ensures that only the legitimate account holder can make this update. This endpoint is not available for business customers — use the appropriate business account email change flow for those profiles.
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
| string (email) | Yes | The new email address to register for the account. Minimum length: 1 character. | |
| oneTimeCode | string | Yes | The 6-digit OTP sent to the customer for identity verification. Must match the pattern ^\d{6}$. |
| secureOperationType | string (enum) | Yes | The type of secure operation used to generate the OTP. Use "ShortMessageCode" for SMS-based OTP. Allowed values: ShortMessageCode, TimeBasedCode, LegacyTimeBasedCode. |
{
"email": "[email protected]",
"oneTimeCode": "654321",
"secureOperationType": "ShortMessageCode"
}Response
200 OK
A successful 200 response indicates the email address has been updated. The response body is empty on success.
Error Codes
| Code | When it happens |
|---|---|
| 400 | Missing required fields, invalid email format, or OTP does not match the 6-digit pattern |
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions or action not permitted for the authenticated customer type |
| 404 | Customer account not found |
| 500 | Internal server error |
Common Mistakes
- Sending an
oneTimeCodethat is not exactly 6 digits — the field enforces the pattern^\d{6}$and will reject codes of any other length or format. - Using this endpoint for business customers — it is scoped to personal customers only; business account email changes require a different flow.
- Not requesting an OTP before calling this endpoint — the
oneTimeCodemust be generated via a prior OTP request; calling this endpoint without a valid, unexpired OTP will result in an error. - Setting
secureOperationTypeto a value that does not match the method used to deliver the OTP (e.g., sendingTimeBasedCodewhen the customer received an SMS code).
Related Endpoints
POST /api/account/changeEmail— Change email address without OTP (if applicable for lower-security flows)POST /api/auth/v2— Obtain a Bearer token for authenticationPOST /api/auth/refresh— Refresh an expiring Bearer token
Example
curl -X POST https://api.banking.netevia.dev/api/account/changeEmailOtp \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"email": "[email protected]",
"oneTimeCode": "654321",
"secureOperationType": "ShortMessageCode"
}'Success