Validate OTP Using Contact Details

Validate a One-Time Password (OTP) that was generated using the Generate OTP Using Contact Details API.

This API verifies an OTP generated for a mobile number and/or email address without requiring a registered User ID.

Endpoint

PUT /v1/otp-using-contact-details

Authentication

Authorization: Bearer <access_token>

Request Body

Example Request

{
  "otpUuid": "6c677c1e-e78e-4e19-a77c-1ee78efe1998",
  "otpValue": "1f40fc92da241694750979ee6cf582f2..."
}

Field Details

otpUuid

The unique identifier returned by the Generate OTP Using Contact Details API. It associates this validation request with a previously generated OTP.

otpValue

The OTP entered by the user. Hash the OTP using the same hashSpec that was used when generating the OTP.

Success Response

The API returns HTTP 200 for both successful and failed validation attempts.

Validation Successful

{
  "otpUuid": "6c677c1e-e78e-4e19-a77c-1ee78efe1998",
  "validationStatus": "SUCCESS",
  "expiryTs": 1739964200556,
  "jwt": "<JWT>",
  "jwtStatus": "GENERATED"
}

Validation Failed

{
  "otpUuid": "6c677c1e-e78e-4e19-a77c-1ee78efe1998",
  "validationStatus": "FAILED",
  "attemptsLeft": 8,
  "expiryTs": 1740050600556
}

Error Responses

Example - Invalid OTP

{
  "timestamp": "2025-02-20T09:00:26IST",
  "status": 422,
  "error": "Invalid data",
  "message": "Invalid OTP",
  "path": "/v1/otp-using-contact-details"
}

Example - OTP UUID Not Found

{
  "timestamp": "2025-02-20T09:27:25IST",
  "status": 404,
  "error": "Data not present.",
  "message": "otpUuid not found",
  "path": "/v1/otp-using-contact-details"
}

Best Practices

• Store the otpUuid returned during OTP generation until validation is complete.
• Use the same hashSpec for hashing the OTP value.
• Handle both SUCCESS and FAILED responses, even though both return HTTP 200.
• Generate a new OTP when attemptsLeft reaches zero.
• Verify that jwtStatus is GENERATED before using the returned JWT.

Related APIs

• Generate OTP Using Contact Details
• Check OTP Status