Verify a step-up OTP and receive a change-of-bank token

Verifies the one-time code and returns a short-lived verification_token bound to this customer, the change-bank action, and this mandate. Pass it to re-authorize.

---

Related endpoints

• POST /customer-portal/sessions — Create a customer-portal session
• GET /customer-portal/customer — Retrieve the authenticated customer
• GET /customer-portal/subscriptions — List the authenticated customer's subscriptions
• GET /customer-portal/subscriptions/{id} — Retrieve a subscription
• POST /customer-portal/subscriptions/{id}/cancel — Cancel a subscription
• GET /customer-portal/invoices — List the authenticated customer's invoices
• GET /customer-portal/invoices/{id} — Retrieve an invoice
• GET /customer-portal/mandates — List the authenticated customer's Direct Debit mandates

Common errors

• 400 invalid_request — malformed payload or failed validation.
• 403 authorization_error — the caller is identified but the action is denied. Codes include insufficient_permissions, ip_not_allowed, merchant_mismatch, and origin_not_allowed.
• 404 resource_missing — the referenced resource does not exist or is not visible to your key.
• 422 unprocessable_entity — business-rule failure (for example, refunding more than the original charge).

Idempotency

Pass an Idempotency-Key header (UUID v4 recommended) to make retries safe. Keys are valid for 24 hours; see the idempotency guide.

Path Parameters

Response Body

curl -X POST "https://api.revkeen.com/v2/customer-portal/mandates/11111111-1111-4111-8111-111111111111/re-authorize/verify-otp" \
  -H "Authorization: Bearer $REVKEEN_PORTAL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "example"
  }'

{  "verification_token": "string"}