> ## Documentation Index
> Fetch the complete documentation index at: https://developers.smsmanager.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify code

> Verifies the code entered by the user. On successful verification, returns all data needed
for backend verification including the phone number, token, code, timestamp, and HMAC proof 
(if account has verificationSecret configured).

The number of attempts is limited based on account configuration (default: 6).




## OpenAPI

````yaml /openapi/en/verify/verifyapi_v1.yaml post /v1/validations/{token}/verify
openapi: 3.1.0
info:
  title: SMS Validation API
  description: >
    Backend API for phone number validation via SMS and other channels. This API
    allows you to validate phone numbers

    by sending SMS verification codes and verifying them. 



    ## Rate Limiting

    The API implements multi-level rate limiting per account, country, and phone
    number.


    ## Offline Proof Verification

    If your tenant has a `verificationSecret` configured, the API returns an
    HMAC proof in the 

    validation response. This proof can be verified offline without calling the
    API (see `/v1/verify-proof` endpoint).
  version: 1.0.0
  contact:
    name: API Support
    email: support@smsmanager.com
servers:
  - url: https://verify-api.smsmanager.com
    description: Production server
security:
  - ApiKeyAuth: []
tags:
  - name: Validation
    description: Phone number validation operations
  - name: Tenant
    description: Tenant configuration endpoints
  - name: System
    description: System health and status endpoints
paths:
  /v1/validations/{token}/verify:
    post:
      tags:
        - Validation
      summary: Verify code
      description: >
        Verifies the code entered by the user. On successful verification,
        returns all data needed

        for backend verification including the phone number, token, code,
        timestamp, and HMAC proof 

        (if account has verificationSecret configured).


        The number of attempts is limited based on account configuration
        (default: 6).
      operationId: verifyCode
      parameters:
        - $ref: '#/components/parameters/ValidationToken'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerificationRequest'
            example:
              code: '123456'
      responses:
        '200':
          description: Code verified successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerificationResponse'
              example:
                verified: true
                phoneNumber: '1234567890'
                token: >-
                  61591bd88d8fbe7736bca535809d1216dd71cb0b5cbf2b07e5a08adfbeb5d35b
                code: '123456'
                timestamp: '2024-01-15T10:30:00Z'
                proof: >-
                  86dd8444ed76402c93ce62497cb29a0d7af7215261b8497cb355e617b13f4ef2
                verifiedAt: '2024-01-15T10:31:15Z'
        '400':
          description: Invalid code or validation expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                invalidCode:
                  summary: Invalid code with attempts remaining
                  value:
                    message: Invalid code
                    attemptsRemaining: 3
                expired:
                  summary: Validation expired
                  value:
                    message: Validation expired
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          description: Validation session not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Too many attempts
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                message: Too many attempts
        '500':
          $ref: '#/components/responses/InternalError'
components:
  parameters:
    ValidationToken:
      name: token
      in: path
      required: true
      description: The validation token returned from the start validation endpoint
      schema:
        type: string
        example: val_7af7215261b8497cb355e617b13f4ef2
  schemas:
    VerificationRequest:
      type: object
      required:
        - code
      properties:
        code:
          type: string
          description: The 6-digit verification code from SMS
          pattern: ^[0-9]{6}$
          example: '123456'
    VerificationResponse:
      type: object
      required:
        - verified
      properties:
        verified:
          type: boolean
          description: Whether the verification was successful
          example: true
        phoneNumber:
          type: string
          description: The verified phone number (only present if verified is true)
          example: '1234567890'
        token:
          type: string
          description: The validation token (only present if verified is true)
          example: 550e8400-e29b-41d4-a716-446655440000_abc123
        code:
          type: string
          description: >-
            The verification code that was verified (only present if verified is
            true)
          example: '123456'
        timestamp:
          type: string
          format: date-time
          description: When the validation was started (only present if verified is true)
          example: '2024-01-15T10:30:00Z'
        proof:
          type: string
          description: >-
            HMAC proof for this verification (only present if verified is true
            and tenant has verificationSecret)
          example: 86dd8444ed76402c93ce62497cb29a0d7af7215261b8497cb355e617b13f4ef2
        verifiedAt:
          type: string
          format: date-time
          description: >-
            When the verification was completed (only present if verified is
            true)
          example: '2024-01-15T10:31:15Z'
    ErrorResponse:
      type: object
      required:
        - message
      properties:
        message:
          type: string
          description: Human-readable error message
          example: Invalid code
        error:
          type: string
          description: Error code for programmatic handling
          example: INVALID_CODE
        attemptsRemaining:
          type: integer
          description: >-
            Number of verification attempts remaining (only for verification
            errors)
          example: 3
          minimum: 0
  responses:
    Unauthorized:
      description: Unauthorized - Invalid or missing API key
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          examples:
            missingKey:
              summary: Missing API key
              value:
                message: Missing X-API-Key header
                error: MISSING_API_KEY
            invalidKey:
              summary: Invalid API key
              value:
                message: Invalid or disabled API key
                error: INVALID_API_KEY
    InternalError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            message: Internal server error
            error: INTERNAL_ERROR
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Your tenant's API key

````