Confirm Operation with One Time Code Authentication

The POST /api/verifyOneTimeCode endpoint validates a six-digit one-time code (OTP) submitted by a user to confirm a pending operation. This step is required for sensitive actions that demand multi-factor authentication before they are executed. If the code is invalid or expired, the operation is rejected and an error message is returned.

Endpoint

POST /api/verifyOneTimeCode

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint after a one-time code has been delivered to the user (for example, by SMS or email) as part of a multi-factor authentication flow. Call it to validate the code and authorize the associated operation before it is processed. It is especially relevant for high-sensitivity actions such as large transfers, account updates, or changes to security settings.

Request Body

Field	Type	Required	Description
oneTimeCode	string	Yes	The six-digit OTP received by the user. Must match the pattern `^\d{6}$` (exactly six numeric digits).

{
  "oneTimeCode": "482917"
}

Response

200 OK

A 200 response confirms that the one-time code was valid and the operation has been authorized. The response body is empty on success.

{}

Error Codes

Code	When it happens
400	Missing required fields, code format is invalid (not exactly six digits), or code is expired/incorrect
401	Token missing, expired, or invalid
403	Insufficient permissions
404	No pending operation found for the authenticated session
500	Internal server error

Common Mistakes

Submitting a code with fewer or more than six digits — the oneTimeCode field must match ^\d{6}$ exactly.
Reusing an already-consumed or expired OTP — each code is single-use and time-limited; request a new one if the previous code has lapsed.
Calling this endpoint without first triggering the MFA flow that generates and delivers the OTP to the user.
Omitting the oneTimeCode field from the request body, which results in a 400 validation error.

Related Endpoints

POST /api/auth/v2 — Obtain a Bearer token to authenticate API requests
POST /api/auth/refresh — Refresh an existing Bearer token before it expires

Example

curl -X POST https://api.banking.netevia.dev/api/verifyOneTimeCode \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "oneTimeCode": "482917"
  }'