Check SMS Verification Code

This endpoint validates a one-time SMS code (OTP) that was previously sent to a user's registered phone number as part of a secured operation. It confirms whether the submitted code is correct and still valid, returning a simple boolean result. This is a key step in multi-factor verification flows such as linking external accounts or confirming sensitive account actions.

Endpoint

POST /api/CodeVerification/checkSms

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint after triggering an SMS code dispatch to verify that the user has correctly entered the one-time code received on their device. This is required during secured operations such as linking a new external account or authorizing high-risk transactions. The secureOperationType field identifies which verification flow the code belongs to, ensuring codes are validated against the correct context.

Request Body

{
  "userId": 100234,
  "oneTimeCode": "847261",
  "secureOperationType": "ShortMessageCode"
}

Response

200 OK

{
  "isCodeValid": true
}

Error Codes

Common Mistakes

• Submitting a oneTimeCode that is fewer or more than 6 digits, or contains non-numeric characters — the pattern ^\d{6}$ must be satisfied exactly.
• Using the wrong secureOperationType for the current flow — ensure the operation type matches the one used when the SMS code was originally dispatched.
• Not refreshing the Bearer token before the call — tokens expire after 10 minutes, causing a 401 error even with correct code data.
• Omitting the userId when it is needed to resolve the verification session — while not marked required in the schema, some flows may depend on it for session lookup.

Related Endpoints

• POST /api/CodeVerification/sendSms — Sends a one-time SMS code to the user's registered phone number to initiate a verification flow.
• POST /api/auth/v2 — Obtain a Bearer token for authenticating API requests.
• POST /api/auth/refresh — Refresh an expiring Bearer token.

Example

curl -X POST https://api.banking.netevia.dev/api/CodeVerification/checkSms \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": 100234,
    "oneTimeCode": "847261",
    "secureOperationType": "ShortMessageCode"
  }'