Accept request

Accept Linked Account Request

This endpoint allows a bank client to approve a pending connection request to their financial account. The client must supply a valid one-time verification code — either sent via SMS or generated by a time-based authenticator — along with the user ID of the requester. Upon successful verification the connection is established and the requesting user gains access as a linked account holder.

Endpoint

POST /api/LinkedAccount/accept

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a bank client needs to confirm and finalize an incoming linked account request from another user. This is the second step in the linked-account pairing flow: after the requesting user submits their connection request (retrieved via GET /api/LinkedAccount/requests), the account owner calls this endpoint to approve it. A secure one-time code is required to prevent unauthorized approvals.

Request Body

Field	Type	Required	Description
`userId`	integer (int32)	No	The ID of the user requesting to connect. Obtain from the `GET /api/LinkedAccount/requests` response.
`oneTimeCode`	string	Yes	A 6-digit numeric verification code. Delivered via SMS (`ShortMessageCode`) or generated by a time-based authenticator (`TimeBasedCode`). Pattern: `^\d{6}$`.
`secureOperationType`	string (enum)	Yes	The type of security verification used. Allowed values: `ShortMessageCode`, `TimeBasedCode`, `LegacyTimeBasedCode`.

{
  "userId": 48291,
  "oneTimeCode": "847362",
  "secureOperationType": "ShortMessageCode"
}

Response

200 OK

Returns a success status indicating the linked account connection request was approved. No response body fields are returned beyond the HTTP 200 status.

{}

Error Codes

Code	When it happens
400	Missing required fields, invalid `oneTimeCode` format, incorrect verification code, or the connection request is no longer pending
401	Token missing, expired, or invalid
403	Insufficient permissions — token does not belong to the account owner
404	Specified `userId` not found in the pending requests list
500	Internal server error

Common Mistakes

Providing a oneTimeCode that does not match the 6-digit pattern (e.g., letters or fewer than 6 digits) will result in a 400 error.
Using a userId that is not present in the current pending requests list (from GET /api/LinkedAccount/requests) will cause the request to fail.
Mismatching the secureOperationType with the actual delivery method (e.g., specifying TimeBasedCode when the code was sent via SMS) will result in verification failure.
OTP codes are time-sensitive; submitting an expired code will return a 400 Bad Request.

Related Endpoints

GET /api/LinkedAccount/requests — Retrieve the list of pending linked account connection requests
POST /api/LinkedAccount/request — Submit a new linked account connection request
DELETE /api/LinkedAccount/{linkedAccountId} — Remove an existing linked account connection

Example

curl -X POST https://api.banking.netevia.dev/api/LinkedAccount/accept \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "userId": 48291,
    "oneTimeCode": "847362",
    "secureOperationType": "ShortMessageCode"
  }'