Cowdidocs
API ReferenceCurrent account activation

Confirm the OTP for an in-flight activation

POST
/v1/user/accounts/current/activations/{activationId}/confirm

Verifies the OTP code and moves the activation to OTP_CONFIRMED. Requires an authenticated, active user. The current account becomes ACTIVE once the wallet provider confirms the account opening by callback. Returns 404 when the activation does not exist, belongs to another caller, or is not AWAITING_OTP. Returns 422 when the caller's KYC status is no longer APPROVED. Returns 409 when the provider rejects the activation while the OTP is being confirmed.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

activationId*string

Unique identifier of the current-account activation.

Formatuuid

Request Body

application/json

Request body for confirming the OTP on a current-account activation.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/user/accounts/current/activations/550e8400-e29b-41d4-a716-446655440000/confirm" \  -H "Content-Type: application/json" \  -d '{    "otp_code": "1234"  }'
{  "id": "550e8400-e29b-41d4-a716-446655440000",  "status": "AWAITING_OTP",  "created_at": "2026-01-15T09:30:00Z",  "otp_confirmed_at": "2026-01-15T09:31:00Z",  "completed_at": "2026-01-15T09:32:00Z",  "rejection_reason": "Document image quality too low for verification",  "current_verification": {    "channel": "sms"  },  "resource_id": "string"}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Get a current-account activation GET

Returns one current-account activation by its id. The caller must be authenticated. Returns 404 when the id does not exist, or belongs to another caller.

Resend the OTP for an in-flight activation POST

Sends a new OTP for an activation that is still `AWAITING_OTP`. Requires an authenticated, active user. Returns 404 when the activation does not exist, belongs to another caller, or already moved past the OTP step. Repeated calls are throttled. A call inside the cooldown window returns 429.