---
title: "validate"
method: POST
path: "/v1/validate"
tags: ["Login"]
---

# validate

`POST /v1/validate`

The second part of login involves validating using an MFA device

An access token with PRE\_AUTH authorities is required

## Headers

- `Authorization` string

## Request body

- AccessTokenValidationRequest
  - `otp` string, required — an OTP either sent via sms or generated by a registered MFA device

## Response `200`

User request has been validated

- AccessTokenResponse
  - `access_token` string — Bearer token used in headers to access secure endpoints
  - `token_type` string — the type of the token
  - `refresh_token` string — can be used to obtain a new access token
  - `expires_in` integer — The lifetime in seconds of the access token
  - `scope` string — the scope of the access token
  - `user_info` UserInfo
    - `user_id` string, uuid — the id of the user
    - `userType` 'BACKOFFICE' | 'PAYOR' | 'PAYEE'
    - `mfa_details` MFADetails
      - `mfa_type` 'SMS' | 'YUBIKEY' | 'TOTP', nullable — The type of the MFA device
      - `verified` boolean — true if the user has used the MFA device for login
  - `entityIds` string[] — If the user is a payee then the payeeId<P> If the user is a payor then the payorId

## Other responses

- `401` — Invalid access token. May be expired or invalid
- `403` — The authentication does not have permissions to access the resource This usually occurs when there is a valid authentication instance (client or user) but they do not have the required permissions

## Changes

- **2020-09-25** `dd71433847a6` — 2 breaking, 12 info
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `401`
  - the `errors/items/` response's property type/format changed from ``/`` to `object`/`` for status `403`
  - added the optional property `errors/items/errorCode` to the response with the `401` status
  - added the optional property `errors/items/errorCode` to the response with the `403` status
  - …10 more
- **2020-08-13** `75bb7af5ae63` — 1 info
  - added the new optional `header` request parameter `Authorization`
- **2020-01-28** `1b2abf26b5d6` — 5 breaking, 2 warning
  - the response's body type/format changed from `object`/`` to ``/`` for status `401`
  - the response's body type/format changed from `object`/`` to ``/`` for status `403`
  - the response property `user_info/mfa_details/mfa_type` became nullable for the status `200`
  - the `errors/items/` response's property type/format changed from `object`/`` to ``/`` for status `401`
  - …3 more
- **2019-12-11** `a0b19fa311c0` — 1 info
  - endpoint added
- **2019-07-15** `ced8e167a97c` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/changes/v1/validate/post.md)

---

[API](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis.md) · [All operations](https://skmtc.dev/velopaymentsapi/apis/velo-payments-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/velopaymentsapi/velo-payments-apis/revisions/05c3f09fc50a/schema)