Send a one-time password to step up a token

Use this when an operation rejects your access token because it isn't stepped up.

It starts the step-up process by sending a one-time password over SMS to a device belonging to the logged-in user. Confirm the code with Verify a one-time password to step up a token; the token you are already using is then raised to STEPPED_UP in place, so there is no new token to store.

Operations that need a stepped-up token include creating prepaid and debit cards, creating accounts, reading a card PIN, and statements.

Prerequisites

The device must have been enrolled beforehand through /authentication_factors/otp/{channel}, or the request fails with CHANNEL_NOT_REGISTERED. SMS is the only OTP channel; to use a push notification instead, see the push variant.

Rate limits

Challenges are throttled. RETRY_IN_15SEC means you asked again too soon, and CHALLENGE_LIMIT_EXCEEDED means the user has run out of attempts for now.