# Verify a list of resources using a one-time password

Completes the verification process for a list of resources.
This endpoint can be used to challenge *Outgoing Wire Transfers* & *Sends*.
If the outcome of the verification is successful, the resource is executed.
If not verified challenge expires after 5 minutes and the number of incorrect OTP attempts is limited to reduce the risk of fraud.
*Note that on the Sandbox Environment, text messages are not sent and the `verificationCode` is always "123456".*

Endpoint: POST /challenges/{scaChallengeId}/otp/{channel}/verify
Version: v3
Security: auth_token, api-key

## Security:

  - `auth_token` (unknown)
    http bearer JWT

  - `api-key` (unknown)
    apiKey in header api-key

## Path parameters:

  - `scaChallengeId` (string, required)
    The unique identifier of the SCA challenge.

  - `channel` (string, required)
    The unique identifier for the channel.

## Header parameters:

  - `idempotency-ref` (string)
    A unique call reference generated by the caller that, taking into consideration the payload as well as the operation itself, helps avoid duplicate operations. Idempotency reference uniqueness is maintained for at least 24 hours.

## Request fields (application/json):

  - `verificationCode` (string, required)
    A randomly generated one-time use code.

  - `resourceType` (string, required)
    The operation type upon which an SCA Challenge is being contested.
    Enum: "outgoing_wire_transfers", "sends", "linked_account_declaration", "correspondent_bank_transfers"

## Response 204:

  - `204` (unknown)
    Success - No Content.

## Response 204 headers:

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response 400:

  - `400` (unknown)
    Bad Request Error - Your request is invalid.

## Response 400 fields (application/json):

  - `message` (string)
    When present helps to identify and fix the problem.

  - `syntaxErrors` (object)
    Is returned as part of an HTTP error response whenever a syntax error is detected. A list of the fields together with their syntax error will be provided.

  - `syntaxErrors.invalidFields` (array)

  - `syntaxErrors.invalidFields.params` (array)

  - `syntaxErrors.invalidFields.fieldName` (string)

  - `syntaxErrors.invalidFields.error` (string)
    Enum: "REQUIRED", "HAS_TEXT", "REQUIRES", "SIZE", "RANGE", "IN", "NOT_IN", "REGEX", "EXACTLY", "AT_LEAST", "AT_MOST", "ALL_OR_NONE"

## Response 400 headers (application/json):

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response 401:

  - `401` (unknown)
    Unauthorized - Your credentials or access token are invalid.

## Response 401 headers:

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response 403:

  - `403` (unknown)
    Forbidden - Access to the requested resource or action is forbidden.

## Response 403 fields (application/json):

  - `errorCode` (string)
    Enum: "INSUFFICIENT_PERMISSIONS"

## Response 403 headers (application/json):

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response 409:

  - `409` (unknown)
    Conflict

## Response 409 fields (application/json):

  - `errorCode` (string)
    Enum: "STATE_INVALID", "CHANNEL_NOT_SUPPORTED", "CHANNEL_NOT_REGISTERED", "VERIFICATION_CODE_EXPIRED", "VERIFICATION_CODE_INVALID", "CHALLENGE_LIMIT_EXCEEDED", "ONE_CHALLENGE_LIMIT_REMAINING"

## Response 429:

  - `429` (unknown)
    Too many requests.

## Response 429 headers:

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

  - `x-ratelimit-limit` (string, required)
    Example: `20, 10;w=60, 20;w=3600, 200;w=86400`
The first number (20) is the limit that has been exceeded.
The remaining numbers are the limits that are in force, with 'w' meaning 'window in seconds'. In this example `20;w=3600` was exceeded. 20 calls in 3600secs (1hr)

  - `x-ratelimit-reset` (integer, required)
    The number of seconds until the window is reset.

## Response 500:

  - `500` (unknown)
    Internal Server Error - There is a problem with the server. Please try again later.

## Response 500 headers:

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response 503:

  - `503` (unknown)
    Service Unavailable - The requested service is temporarily unavailable. Please try again later.

## Response 503 headers:

  - `request-ref` (string, required)
    A request identifier. Providing this reference when contacting our support team will help us investigate your query.

## Response default:

  - `default` (unknown)
    Error

## Response default fields (application/json):

  - `code` (string)

  - `message` (string)