PingOne Platform APIs

Check One-Time Password (OTP)

POST {{authPath}}/{{envID}}/flows/{{flowID}}

The multi-factor authentication flow uses a one-time password (OTP) sent to the user’s device to continue the login flow. The user receives the OTP and submits it as a step in the login process. The MFA actions service validates the OTP to complete the authentication flow.

The following sample shows the POST /{{envID}}/flows/{{flowID}} operation to validate the OTP used in the multi-factor authentication flow. This operation uses the application/vnd.pingidentity.otp.check+json custom media type as the content type in the request header.

Prerequisites

If completed successfully, and if this action is the last action of the authentication flow, the status property shows a value of COMPLETED.

Request Model
Property Type Required?

otp

String

Required

Headers

Content-Type      application/vnd.pingidentity.otp.check+json

Body

raw ( application/vnd.pingidentity.otp.check+json )

{
    "otp": "xxxxxx"
}

Example Request

  • cURL

  • C#

  • Go

  • HTTP

  • Java

  • jQuery

  • NodeJS

  • Python

  • PHP

  • Ruby

  • Swift

curl --location --globoff '{{authPath}}/{{envID}}/flows/{{flowID}}' \
--header 'Content-Type: application/vnd.pingidentity.otp.check+json' \
--data '{
    "otp": "xxxxxx"
}'
var options = new RestClientOptions("{{authPath}}/{{envID}}/flows/{{flowID}}")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/vnd.pingidentity.otp.check+json");
var body = @"{" + "\n" +
@"    ""otp"": ""xxxxxx""" + "\n" +
@"}";
request.AddStringBody(body, DataFormat.Json);
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);
package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{authPath}}/{{envID}}/flows/{{flowID}}"
  method := "POST"

  payload := strings.NewReader(`{
    "otp": "xxxxxx"
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/vnd.pingidentity.otp.check+json")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}
POST /{{envID}}/flows/{{flowID}} HTTP/1.1
Host: {{authPath}}
Content-Type: application/vnd.pingidentity.otp.check+json

{
    "otp": "xxxxxx"
}
OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/vnd.pingidentity.otp.check+json");
RequestBody body = RequestBody.create(mediaType, "{\n    \"otp\": \"xxxxxx\"\n}");
Request request = new Request.Builder()
  .url("{{authPath}}/{{envID}}/flows/{{flowID}}")
  .method("POST", body)
  .addHeader("Content-Type", "application/vnd.pingidentity.otp.check+json")
  .build();
Response response = client.newCall(request).execute();
var settings = {
  "url": "{{authPath}}/{{envID}}/flows/{{flowID}}",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/vnd.pingidentity.otp.check+json"
  },
  "data": JSON.stringify({
    "otp": "xxxxxx"
  }),
};

$.ajax(settings).done(function (response) {
  console.log(response);
});
var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{authPath}}/{{envID}}/flows/{{flowID}}',
  'headers': {
    'Content-Type': 'application/vnd.pingidentity.otp.check+json'
  },
  body: JSON.stringify({
    "otp": "xxxxxx"
  })

};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});
import requests
import json

url = "{{authPath}}/{{envID}}/flows/{{flowID}}"

payload = json.dumps({
  "otp": "xxxxxx"
})
headers = {
  'Content-Type': 'application/vnd.pingidentity.otp.check+json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)
<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{authPath}}/{{envID}}/flows/{{flowID}}');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/vnd.pingidentity.otp.check+json'
));
$request->setBody('{\n    "otp": "xxxxxx"\n}');
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}
require "uri"
require "json"
require "net/http"

url = URI("{{authPath}}/{{envID}}/flows/{{flowID}}")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/vnd.pingidentity.otp.check+json"
request.body = JSON.dump({
  "otp": "xxxxxx"
})

response = http.request(request)
puts response.read_body
let parameters = "{\n    \"otp\": \"xxxxxx\"\n}"
let postData = parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{authPath}}/{{envID}}/flows/{{flowID}}")!,timeoutInterval: Double.infinity)
request.addValue("application/vnd.pingidentity.otp.check+json", forHTTPHeaderField: "Content-Type")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

200 OK

{
  "_links": {
    "self": {
      "href": "https://auth.pingone.com/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/flows/d8bbb008-dc4d-469e-819f-e12a350f51c2"
    },
    "id": "7b37d3e8-38b0-4469-b553-04b8bee08e6f",
    "resumeUrl": "https://auth.pingone.com/abfba8f6-49eb-49f5-a5d9-80ad5c98f9f6/as/resume?flowId=d8bbb008-dc4d-469e-819f-e12a350f51c2",
    "status": "COMPLETED",
    "createdAt": "2018-09-20T13:40:56.977Z",
    "expiresAt": "2018-09-20T13:56:12.306Z",
    "_embedded": {
      "user": {
        "id": "482a626f-a894-485d-b9f3-ba8f4ed0c58d",
        "username": "johndoe",
        "name": {
          "given": "John",
          "family": "Doe"
        }
      }
    }
  }
}