> ## Documentation Index
> Fetch the complete documentation index at: https://developers.smsmanager.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify HMAC proof

> Verifies an HMAC proof for phone validation without storing any state.
This endpoint is useful for backend verification when you have all the validation data
but want SMS Manager to verify the HMAC calculation.

This endpoint not requires authentication - proof itself is the authentication.

All of these data are returned by the `/v1/validations` endpoint.

**Note**: This only works for accounts with a `verificationSecret` configured.




## OpenAPI

````yaml /openapi/en/verify/verifyapi_v1.yaml post /v1/verify-proof
openapi: 3.1.0
info:
  title: SMS Validation API
  description: >
    Backend API for phone number validation via SMS and other channels. This API
    allows you to validate phone numbers

    by sending SMS verification codes and verifying them. 



    ## Rate Limiting

    The API implements multi-level rate limiting per account, country, and phone
    number.


    ## Offline Proof Verification

    If your tenant has a `verificationSecret` configured, the API returns an
    HMAC proof in the 

    validation response. This proof can be verified offline without calling the
    API (see `/v1/verify-proof` endpoint).
  version: 1.0.0
  contact:
    name: API Support
    email: support@smsmanager.com
servers:
  - url: https://verify-api.smsmanager.com
    description: Production server
security:
  - ApiKeyAuth: []
tags:
  - name: Validation
    description: Phone number validation operations
  - name: Tenant
    description: Tenant configuration endpoints
  - name: System
    description: System health and status endpoints
paths:
  /v1/verify-proof:
    post:
      tags:
        - Validation
      summary: Verify HMAC proof
      description: >
        Verifies an HMAC proof for phone validation without storing any state.

        This endpoint is useful for backend verification when you have all the
        validation data

        but want SMS Manager to verify the HMAC calculation.


        This endpoint not requires authentication - proof itself is the
        authentication.


        All of these data are returned by the `/v1/validations` endpoint.


        **Note**: This only works for accounts with a `verificationSecret`
        configured.
      operationId: verifyProof
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - phoneNumber
                - token
                - code
                - timestamp
                - proof
              properties:
                phoneNumber:
                  type: string
                  description: The normalized phone number
                  example: '1234567890'
                token:
                  type: string
                  description: The validation token
                  example: 61591bd88d8f...
                code:
                  type: string
                  description: The 6-digit verification code
                  example: '123456'
                timestamp:
                  type: string
                  format: date-time
                  description: The timestamp when validation started
                  example: '2024-01-15T10:30:00Z'
                proof:
                  type: string
                  description: The HMAC proof to verify
                  example: a1b2c3d4e5f6...
      responses:
        '200':
          description: Proof verification result
          content:
            application/json:
              schema:
                type: object
                properties:
                  valid:
                    type: boolean
                    description: Whether the proof is valid
                  expired:
                    type: boolean
                    description: Whether the validation has expired (24 hours)
              examples:
                valid:
                  summary: Valid proof
                  value:
                    valid: true
                invalid:
                  summary: Invalid proof
                  value:
                    valid: false
                expired:
                  summary: Expired validation
                  value:
                    valid: false
                    expired: true
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                missingFields:
                  summary: Missing required fields
                  value:
                    message: >-
                      Missing required fields: phoneNumber, token, code,
                      timestamp, proof
                noSecret:
                  summary: Tenant has no verification secret
                  value:
                    valid: false
                    error: Tenant does not have verification enabled
        '500':
          $ref: '#/components/responses/InternalError'
      security: []
components:
  schemas:
    ErrorResponse:
      type: object
      required:
        - message
      properties:
        message:
          type: string
          description: Human-readable error message
          example: Invalid code
        error:
          type: string
          description: Error code for programmatic handling
          example: INVALID_CODE
        attemptsRemaining:
          type: integer
          description: >-
            Number of verification attempts remaining (only for verification
            errors)
          example: 3
          minimum: 0
  responses:
    InternalError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
          example:
            message: Internal server error
            error: INTERNAL_ERROR
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Your tenant's API key

````