Disable OTP for Customer Operations
The Disable OTP endpoint removes the One-Time Password requirement from a specific customer profile, enabling that profile to complete transactions and operations without entering a one-time code. This action is gated by authorization checks to ensure only permitted users can modify OTP settings. The change takes effect immediately upon a successful response.
Endpoint
POST /netevia/disableotp/{profileId}
Authentication
Bearer token required. Obtain via:
POST https://api.banking.netevia.dev/api/auth/v2Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.
When to use
Use this endpoint when a customer profile has been verified through alternate means and the OTP step needs to be removed for operational efficiency. This is common in back-office workflows where a partner administrator is managing profile settings on behalf of a customer. Only invoke this endpoint after confirming the requestor has the necessary authorization level for the target profile.
Path Parameters
| Parameter | Type | Required | Description |
|---|---|---|---|
| profileId | integer (int32) | Yes | The unique numeric identifier of the customer profile for which OTP should be disabled. |
Response
200 OK
The response may return either a boardingresponse or an openfinancialaccountresponse. Both share a common set of fields; the latter includes an additional financialAccountId field.
| Field | Type | Description |
|---|---|---|
| profileId | integer (int32) | The ID of the customer profile that was updated. |
| success | boolean | Indicates whether the OTP disable operation succeeded. |
| errors | string (nullable) | Error message if the operation failed; null on success. |
| changeLog | array (nullable) | List of change log entries describing what was modified. |
| changeLog[].requestType | integer (int32) | Numeric code representing the type of banking request that was logged. |
| changeLog[].changes | string (nullable) | Human-readable description of the change that was applied. |
| financialAccountId | string (nullable) | Present only in openfinancialaccountresponse; the associated financial account ID if applicable. |
{
"profileId": 100234,
"success": true,
"errors": null,
"changeLog": [
{
"requestType": 5,
"changes": "OTP disabled for profile 100234"
}
]
}Error Codes
| Code | When it happens |
|---|---|
| 400 | Missing required fields or validation error |
| 401 | Token missing, expired, or invalid |
| 403 | Insufficient permissions to disable OTP for the specified profile |
| 404 | The specified profileId does not exist |
| 500 | Internal server error |
Common Mistakes
- Providing a
profileIdthat belongs to a profile the authenticated user does not have permission to manage, resulting in a 403 error. - Sending the request with an expired Bearer token; tokens expire after 10 minutes and must be refreshed before use.
- Expecting a request body — this endpoint uses only the path parameter and requires no JSON body.
Related Endpoints
POST /netevia/enableotp/{profileId}— Re-enables OTP for a customer profilePOST /api/auth/v2— Obtain a Bearer token for authenticationPOST /api/auth/refresh— Refresh an existing Bearer token
Example
curl -X POST https://api.banking.netevia.dev/netevia/disableotp/100234 \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json"