Verify a step-up OTP and receive a change-of-bank token

Verifies the one-time code and returns a short-lived verification_token bound to this customer, the change-bank action, and this mandate. Pass it to re-authorize.

Related endpoints

• POST /customer-portal/sessions — Create a customer-portal session
• GET /customer-portal/customer — Retrieve the authenticated customer
• GET /customer-portal/subscriptions — List the authenticated customer's subscriptions
• GET /customer-portal/subscriptions/{id} — Retrieve a subscription
• POST /customer-portal/subscriptions/{id}/cancel — Cancel a subscription
• GET /customer-portal/invoices — List the authenticated customer's invoices
• GET /customer-portal/invoices/{id} — Retrieve an invoice
• GET /customer-portal/mandates — List the authenticated customer's Direct Debit mandates

Common errors

• 400 invalid_request — malformed payload or failed validation.
• 403 permission_denied — key lacks the required scope, or the resource belongs to a different merchant.
• 404 resource_missing — the referenced resource does not exist or is not visible to your key.
• 422 unprocessable_entity — business-rule failure (for example, refunding more than the original charge).

Idempotency

Pass an Idempotency-Key header (UUID v4 recommended) to make retries safe. Keys are valid for 24 hours; see the idempotency guide.

curl -X POST "https://api.revkeen.com/v2/customer-portal/mandates/00000000-0000-0000-0000-000000000000/re-authorize/verify-otp" \
  -H "x-api-key: $REVKEEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "code": "string"
  }'

{
  "verification_token": "string"
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}

{
  "error": {
    "type": "string",
    "code": "string",
    "message": "string"
  }
}