Set operations confirmation settings

Set Operations Confirmation Settings

This endpoint allows partners to configure whether sensitive operations require a one-time password (OTP) confirmation step. Enabling OTP confirmation adds an extra layer of security by requiring users to verify high-risk actions before they are executed. This setting applies at the account level and takes effect immediately upon a successful response.

Endpoint

POST /settings/opsConfirmation

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you want to enforce or relax OTP verification for operations such as transfers, card management, or other sensitive account actions. This is particularly relevant for business customers who want to apply additional authorization controls to their accounts or subprofiles. Toggle this setting as part of your onboarding flow or in response to a user's security preferences.

Request Body

Field	Type	Required	Description
withOneTimePassword	boolean	No	When `true`, operations will require a one-time password confirmation. When `false`, OTP confirmation is disabled.

{
  "withOneTimePassword": true
}

Response

200 OK

A 200 status code indicates the confirmation settings were updated successfully. No response body is returned.

Error Codes

Code	When it happens
400	Missing required fields or validation error
401	Token missing, expired, or invalid
403	Insufficient permissions
404	Resource not found
500	Internal server error

Common Mistakes

Sending the request without a valid Bearer token will result in a 401 error — ensure the token is obtained and refreshed within its 10-minute lifetime.
Omitting the withOneTimePassword field entirely may result in no change being applied; always explicitly set the boolean value to true or false.
Sending a non-boolean value (e.g., a string "true") for withOneTimePassword will cause a 400 validation error — use a JSON boolean literal.

Related Endpoints

POST /api/auth/v2 — Obtain a Bearer authentication token
POST /api/auth/refresh — Refresh an existing Bearer token before it expires

Example

curl -X POST https://api.banking.netevia.dev/settings/opsConfirmation \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "withOneTimePassword": true
  }'