Validates a verification code previously sent to the user for a specific action context.
Validate a Verification Code
This endpoint validates a verification code that was previously sent to the user via POST /api/CodeVerification/send. The code is checked against a specific action context defined by the shortMessageType parameter. If the code is valid and has not expired, the API returns a confirmation that allows the associated action to proceed.
Endpoint
POST /api/CodeVerification/check
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Use this endpoint as the second step in any multi-factor authentication (MFA) or action-confirmation flow after calling /api/CodeVerification/send. It is required before completing sensitive operations such as login, password reset, transaction approval, linking an external account, or authorizing an Earned Wage Access request. Always pair this call with a prior successful send so the verification code exists server-side to match against.
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
code | string | Yes | The 6-digit numeric verification code entered by the user. Must match pattern ^\d{6}$. |
shortMessageType | string | Yes | The action context for which the code was issued. See accepted values below. |
Accepted values for shortMessageType:
| Value | Description |
|---|---|
UNKNOWN | Unspecified or default type |
APPROVE_TRANSACTION | Approval required for a financial transaction |
APPROVE_PAYEE | Approval for adding or modifying a payee |
ApproveLinkedAccount | Approval to link an external account |
RestorePassword | Verification for a password reset flow |
AttemptLogin | Verification for a login attempt |
TransferPoints | Authorization to transfer reward or loyalty points |
SetEwaRequest | Approval for an Earned Wage Access (EWA) request |
ContactInfoUpdateRequest | Verification for updating contact information |
Auth | General authentication verification |
{
"code": "742839",
"shortMessageType": "RestorePassword"
}Response
200 OK
| Field | Type | Description |
|---|---|---|
isCodeValid | boolean | Indicates whether the submitted verification code is valid. true means the code matched and the action may proceed; false means the code was incorrect or expired. |
{
"isCodeValid": true
}Error Codes
| Code | When it happens |
|---|---|
| 400 | Missing required fields, malformed JSON, code does not match the 6-digit pattern, or the code is invalid/expired |
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions to perform the verification check |
| 404 | No pending verification code found for the given context |
| 429 | Too many incorrect attempts — verification temporarily blocked |
| 500 | Internal server error during the verification process |
Common Mistakes
- Submitting a code that was never sent: always call
POST /api/CodeVerification/sendfirst and ensure it returned success before calling this endpoint. - Using a
shortMessageTypevalue that does not match the one used in the original send request — the check will fail even if the numeric code is correct. - Providing a
codevalue that is not exactly 6 digits; the schema enforces the pattern^\d{6}$and non-matching values return 400. - Retrying after too many failed attempts without waiting for the lockout window to expire, which results in a 429 response.
- Reusing an already-validated code — once a code is successfully verified it is consumed and cannot be used again.
Related Endpoints
POST /api/CodeVerification/send— Sends a verification code to the user for a specified action context; must be called before this endpoint
Example
curl -X POST https://api.banking.netevia.dev/api/CodeVerification/check \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"code": "742839",
"shortMessageType": "RestorePassword"
}'Bad Request
Not Found