Step-up challenges

Verify a one-time password to step up a token

Completes step-up by submitting the one-time password sent to the user.

On success the access token you are already using is raised to STEPPED_UP in place. No new token is returned, and no token needs swapping in your client. Retry the operation that required step-up with the same token.

Limits

The challenge expires after 5 minutes (VERIFICATION_CODE_EXPIRED) and the number of incorrect attempts is capped to reduce the risk of fraud. ONE_CHALLENGE_LIMIT_REMAINING is the warning before CHALLENGE_LIMIT_EXCEEDED; once exceeded, issue a fresh challenge with Send a one-time password to step up a token.

ALREADY_VERIFIED means the token is already stepped up, and STATE_INVALID means no challenge is in flight for this token.

:::note On sandbox, no text message is sent and verificationCode is always 123456. :::

post/stepup/challenges/otp/{channel}/verify

Request

  • Base URL: https://sandbox.weavr.io/multi
  • URL: https://sandbox.weavr.io/multi/stepup/challenges/otp/{channel}/verify
  • Auth: HTTP bearer and API key in header api-key

Path parameters

channel'SMS' required
  • SMS: The one-time-password is sent as a text message

The unique identifier for the channel.

Headers

idempotency-refstring
Example:transfer-2026-08-07-001

A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.

Request body

verificationCodestring required

A randomly generated one-time use code.

Example request

{
  "verificationCode": "654321"
}

Response

Success - No Content.

Changes

No recorded changes to this operation across all 1 revision of this API.