Verify a one-time password to step up a token

Completes step-up by submitting the one-time password sent to the user.

On success the access token you are already using is raised to STEPPED_UP in place. No new token is returned, and no token needs swapping in your client. Retry the operation that required step-up with the same token.

Limits

The challenge expires after 5 minutes (VERIFICATION_CODE_EXPIRED) and the number of incorrect attempts is capped to reduce the risk of fraud. ONE_CHALLENGE_LIMIT_REMAINING is the warning before CHALLENGE_LIMIT_EXCEEDED; once exceeded, issue a fresh challenge with Send a one-time password to step up a token.

ALREADY_VERIFIED means the token is already stepped up, and STATE_INVALID means no challenge is in flight for this token.