---
title: "Perform MFA"
url: "https://developer.incode.com/api-reference/oneton-mfa/"
section: "api-reference"
group: "Onboarding"
version: "v1.1"
status: "live"
endpoint: "POST /omni/oneToN/mfa"
---
# Perform MFA

`POST /omni/oneToN/mfa`

Base URL: `https://demo-api.incodesmile.com` — Incode demo environment

This method is used for confirming user identity by sending last four digits of his phone number. transactionId which
was received in [/omni/oneToN/identify](#/Login/oneToNIdentify) response should be used.

## Path & query parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `api-version` | header | string | yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `verificationCode` | string |  | The last 4 digits of the user's phone number. |
| `transactionId` | string |  | Authentication identifier received in [/omni/oneToN/identify](#/Login/oneToNIdentify). |

## Responses

### 200

OK

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `customerId` | string |  |  |
| `token` | string |  |  |
| `interviewId` | string |  |  |
| `interviewToken` | string |  |  |
| `transactionId` | string |  | Authentication attempt identifier. |
| `externalId` | string |  | External ID of customer, provided by client on /omni/start call. |
| `externalCustomerId` | string |  | External ID of customer, provided by client on /omni/start call. |
| `faceMatch` | boolean |  |  |
| `spoofAttempt` | boolean |  | Flag indicating if this was spoof attempt. |
| `secondFactor` | boolean |  |  |
| `children` | array[Child] |  |  |
| `children.customerId` | string |  |  |
| `children.token` | string |  |  |
| `spoofConfidence` | number (float) |  | Score between 0 and 1 that indicates if an image is a spoof. Scores closer to 0 indicate a legitimate session with a live user, whereas scores closer to 1 indicate a higher probability that the provided image is spoofed and that the session may be fraudulent. |
| `overallScore` | number (float) |  | Overall score search, value form 0 to 100. |
| `overallStatus` | string |  | Overall status Enum: `PASS`, `FAIL` |
| `deviceIPLocationData` | DeviceIPLocationDataDto |  |  |
| `deviceIPLocationData.ipAddress` | string |  |  |
| `deviceIPLocationData.ipCountry` | string |  |  |
| `deviceIPLocationData.ipCity` | string |  |  |
| `deviceIPLocationData.ipRegion` | string |  |  |

### 400

Custom error status: - 4004: Couldn't find record with verificationCode and transactionId

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `timestamp` | integer (int64) |  | UTC timestamp in milliseconds |
| `status` | integer (int32) |  | Custom error code or HTTP status code |
| `error` | string |  | HTTP status error |
| `message` | string |  | Custom error message |
| `path` | string |  | Endpoint path |
| `details` | object |  | Custom error details |

## Code samples

Generated from this endpoint's method, path, and the conventional Incode headers. The base URL is the Incode demo environment; replace `<YOUR_API_KEY>` with a key for your region.

### cURL

```bash
curl -X POST https://demo-api.incodesmile.com/omni/oneToN/mfa \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "api-version: 1.0" \
  -H "Content-Type: application/json" \
  -d '{
    "verificationCode": "",
    "transactionId": ""
  }'
```

### Node

```js
const res = await fetch("https://demo-api.incodesmile.com/omni/oneToN/mfa", {
  method: "POST",
  headers: {
      "x-api-key": "<YOUR_API_KEY>",
      "api-version": "1.0",
      "Content-Type": "application/json",
  },
    body: JSON.stringify({
      "verificationCode": "",
      "transactionId": ""
    }),
});
const data = await res.json();
```

### Python

```python
import requests

headers = {
    "x-api-key": "<YOUR_API_KEY>",
    "api-version": "1.0",
    "Content-Type": "application/json",
}
res = requests.post("https://demo-api.incodesmile.com/omni/oneToN/mfa", headers=headers, json={
  "verificationCode": "",
  "transactionId": ""
})
data = res.json()
```

### Java

```java
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://demo-api.incodesmile.com/omni/oneToN/mfa"))
    .header("x-api-key", "<YOUR_API_KEY>")
    .header("api-version", "1.0")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"verificationCode\": \"\",\n  \"transactionId\": \"\"\n}"))
    .build();
HttpResponse<String> res = HttpClient.newHttpClient()
    .send(req, HttpResponse.BodyHandlers.ofString());
```

### Example response

```json
{
  "success": true,
  "status": "OK"
}
```