Account Unlock and OTP Validation

This endpoint validates a One-Time Password (OTP) that was previously sent to the user for unlocking their account. When a user submits the OTP received via mobile or email, Netevia verifies it and, if valid, unlocks the account and restores access. If the OTP is invalid or expired, an error is returned to prevent unauthorized account recovery.

Endpoint

POST /api/auth/ValidateUnlockOtp

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint after calling the account unlock initiation flow, which sends an OTP to the user's registered mobile number or email address. This endpoint completes the unlock sequence by confirming the user-submitted OTP. It is the final step required before the user can log in again following a lockout.

Request Body

Field	Type	Required	Description
nickName	string	Yes	The user's account nickname (username) for the locked account. Minimum length: 1.
code	string	Yes	The One-Time Password (OTP) received by the user via mobile or email. Minimum length: 1.

{
  "nickName": "john.doe",
  "code": "847293"
}

Response

200 OK

A 200 response confirms that the OTP was valid and the account has been successfully unlocked. The user may now proceed to log in.

{
  "message": "Account successfully unlocked."
}

Error Codes

Code	When it happens
400	Missing required fields (`nickName` or `code`) or OTP has expired or is invalid
401	Token missing, expired, or invalid
403	Insufficient permissions to perform this operation
404	Account associated with the provided `nickName` not found
500	Internal server error

Common Mistakes

Submitting an expired OTP — OTPs are time-limited; if the code has expired, the unlock OTP must be re-requested before calling this endpoint again.
Omitting the nickName field — both nickName and code are required; sending only the OTP without identifying the account will result in a 400 error.
Reusing a previously validated OTP — each OTP is single-use; once successfully validated, the same code cannot be reused to unlock the account again.

Related Endpoints

POST /api/auth/v2 — Obtain a Bearer authentication token
POST /api/auth/refresh — Refresh an existing Bearer token
POST /api/auth/LockoutUser — Initiate the account unlock flow and trigger OTP delivery to the user

Example

curl -X POST https://api.banking.netevia.dev/api/auth/ValidateUnlockOtp \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "nickName": "john.doe",
    "code": "847293"
  }'