# Verify a list of resources using a one-time password

Completes the verification process for a list of resources.
This endpoint can be used to challenge *Outgoing Wire Transfers* & *Sends*.
If the outcome of the verification is successful, the resource is executed.
If not verified challenge expires after 5 minutes and the number of incorrect OTP attempts is limited to reduce the risk of fraud.
*Note that on the Sandbox Environment, text messages are not sent and the `verificationCode` is always "123456".*

Endpoint: POST /challenges/{scaChallengeId}/otp/{channel}/verify
Version: v3
Security: auth_token, api-key

## Path parameters:

  - `scaChallengeId` (string, required)
    The unique identifier of the SCA challenge.

  - `channel` (string, required)
    The unique identifier for the channel.

## Header parameters:

  - `idempotency-ref` (string)
    A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.

## Request fields (application/json):

  - `verificationCode` (string, required)
    A randomly generated one-time use code.

  - `resourceType` (string, required)
    The operation type upon which an SCA Challenge is being contested.
    Enum: "outgoing_wire_transfers", "sends", "linked_account_declaration", "correspondent_bank_transfers"

## Response 400 fields (application/json):

  - `message` (string)
    When present helps to identify and fix the problem.

  - `syntaxErrors` (object)
    Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.

  - `syntaxErrors.invalidFields` (array)

  - `syntaxErrors.invalidFields.params` (array)

  - `syntaxErrors.invalidFields.fieldName` (string)

  - `syntaxErrors.invalidFields.error` (string)
    Enum: "REQUIRED", "HAS_TEXT", "REQUIRES", "SIZE", "RANGE", "IN", "NOT_IN", "REGEX", "EXACTLY", "AT_LEAST", "AT_MOST", "ALL_OR_NONE"

## Response 403 fields (application/json):

  - `errorCode` (string)
    Enum: "INSUFFICIENT_PERMISSIONS"

## Response 409 fields (application/json):

  - `errorCode` (string)
    Enum: "STATE_INVALID", "CHANNEL_NOT_SUPPORTED", "CHANNEL_NOT_REGISTERED", "VERIFICATION_CODE_EXPIRED", "VERIFICATION_CODE_INVALID", "CHALLENGE_LIMIT_EXCEEDED", "ONE_CHALLENGE_LIMIT_REMAINING"

## Response default fields (application/json):

  - `code` (string)

  - `message` (string)