OTP

Verify an OTP

Checks the code the user typed against the OTP request identified by requestId.

Scope required: otp:verify.

Outcomes.

Result	HTTP	What it means
Correct code	200	Request is now VERIFIED and is spent — it can never be verified again.
Wrong code, attempts left	422 VALIDATION_ERROR	details.attemptsRemaining tells you how many tries are left. Let the user retry.
Wrong code, last attempt	409 CONFLICT	Request is now FAILED. Send a new OTP.
Past expiresAt	409 CONFLICT	Request flips to EXPIRED on this call. Send a new OTP.
Already VERIFIED/EXPIRED/FAILED	409 CONFLICT	Terminal. Send a new OTP.
Unknown id, or an id belonging to another account	404 NOT_FOUND	Ids are scoped to your account.

attempts only increments when the code is actually compared — that is, on the 200 and the two wrong-code rows above. A call rejected for expiry, for an already-terminal request, or by the rate limiter does not consume an attempt.

Rate limit: 10 verify calls per OTP request per minute, returned as 422 BUSINESS_RULE_VIOLATION.

post/v1/otp/verify

Request

Base URL: https://api.dzverify.com
URL: https://api.dzverify.com/v1/otp/verify
Auth: API key in header X-API-Key

Request body

requestIdstring required

The id returned by /v1/otp/send.

codestring required

The 6-digit code the end-user typed.

Example request

{
  "requestId": "01HZX5N7M4J2K8Q4R0T5V7Y9AB",
  "code": "482910"
}

Response

OTP verified. The request is now VERIFIED and cannot be reused.

successtrue required

messagestring

Short status message (e.g. "OTP sent", "OTP verified").

Example response

{
  "data": {
    "id": "01HZX5N7M4J2K8Q4R0T5V7Y9AB",
    "recipient": "+213612345678"
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.