Languages: every operation supports cURL, Node.js (TypeScript), Python, Go, Ruby, and PHP. The first 15 operations on this page show all six languages; the remaining 24 show cURL and TypeScript — the two most-used.

Verify API

Send and check OTP verification codes via SMS, WhatsApp, Email, Voice, Viber, or Telegram Base path: /api/v1/verify Endpoint count: 39

title: “Worked request and response samples” description: “Worked samples for the OTP verification flow: send a verifiable code, and check it. Each sample shows the request, the success envelope, and the error envelope to expect.”

Worked request and response samples

Copy a request body as written, substitute your own ids, and compare the response envelope. Errors follow Devotel Orbit’s { error, meta } envelope, shown once below under Error envelope.

Send a verification code

POST /api/v1/verify/send

Pick the channel you deliver the code on, and hold onto the returned verification_id for the check call. Request

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/send" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/send', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/send", headers=headers, json={
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/send", bytes.NewBuffer([]byte(`{
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/send')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/send');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "destination": "+14155552671",
  "channel": "sms",
  "template_id": "tmpl_9e8d7c6b5a4f3021e5d6c7b8"
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "destination": "+14155552671",
    "channel": "sms",
    "expires_at": "2026-08-01T12:10:00.000Z"
  },
  "meta": {
    "request_id": "req_send",
    "timestamp": "2026-08-01T12:00:00.000Z"
  }
}

Check a code

POST /api/v1/verify/check

Send the verification_id from the send call and the code the user typed. Request

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/check" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/check', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/check", headers=headers, json={
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/check", bytes.NewBuffer([]byte(`{
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/check')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/check');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
  "code": "123456"
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Error envelope

An expired or wrong code returns 422 with VALIDATION_ERROR; repeated wrong codes are rate-limited.

422

{
  "error": {
    "code": "INVALID_CODE",
    "status": 422,
    "message": "verification code does not match"
  },
  "meta": {
    "request_id": "req_...",
    "timestamp": "2026-08-01T12:00:00.000Z"
  }
}

Gate a verification on identity signals

POST /api/v1/verify/fraud-gate

Decide whether to trust a number before sending the OTP. One call fuses the three carrier-asserted takeover signals — SIM-swap recency, port-event (number recycling), and silent network auth possession — into a single allow / review / deny decision. Request

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/fraud-gate" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/fraud-gate', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/fraud-gate", headers=headers, json={
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/fraud-gate", bytes.NewBuffer([]byte(`{
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/fraud-gate')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/fraud-gate');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "phone_number": "+14155552671",
  "number_recycled": false,
  "roaming": false
}
JSON);
echo curl_exec($ch);

Add a device-bound access_token (from the three-legged Silent Auth flow) to also check possession, and pass any backups you already hold — number_recycled, roaming, reputation_risk_level, call_forwarding_unconditional. Operator-asserted results always win over the backups you supply; when no carrier integration is configured, the gate still answers from your backups and lists the operator signals under signals_unavailable.

{
  "data": {
    "phone_number": "+1415****",
    "decision": "deny",
    "risk_score": 90,
    "risk_level": "critical",
    "reasons": ["sim_swap_recent", "number_verification_failed"],
    "signals_evaluated": ["numberVerified", "simSwapped", "numberRecycled"],
    "signals_unavailable": [],
    "headline_signals": {
      "resolved": ["simSwap", "portEvent", "numberVerification"],
      "unavailable": []
    }
  },
  "meta": {
    "request_id": "req_gate",
    "timestamp": "2026-08-28T12:00:00.000Z"
  }
}

The three headline signals are audited in headline_signals so you can tell “SIM-swap came back clean” apart from “SIM-swap was not evaluated”. A missing signal always contributes zero risk in either direction — you can tune the fusion per request with weights (0-100 per signal) and thresholds (the review / deny cut points on the 0-100 score). Nothing is ever sent to the subscriber by this call; it is a read-only network check.

Consume a magic-link token

GET /api/v1/public/verify/magic-link/consume

Public, unauthenticated endpoint that consumes a single-use magic-link token emitted by POST /verify/send with channel: "magic_link". Validates the HMAC + expiry in constant time, then approves the underlying verification row by replaying the embedded OTP code through VerifyService.checkVerification. Single-use, brute-force lockout, and PSD2 SCA binding are enforced by the same row-state machine every other Verify channel uses.

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/verify/magic-link/consume');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List verifications

GET /api/v1/verify

Retrieve verification records with cursor-based pagination.

string (enum: true|false)

Sandbox opt-in for Clerk-session-authenticated requests. Set to true to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response meta.test_mode: true. Ignored for live API keys (dv_live_sk_*) — server-to-server clients must use a test-prefixed key (dv_test_sk_*) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Get verification

GET /api/v1/verify/{id}

Retrieve a single verification record by ID.

string

required

—

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Get verification detail

GET /api/v1/verify/{id}/detail

Consolidated detail DTO for the verification-request drawer. Returns the verification row plus fallback timeline, profile name, and a masked code-attempt log (submitted digits limited to the trailing 4 characters only).

string

required

—

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/detail');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Verification analytics

GET /api/v1/verify/analytics

Aggregate totals, status, and channel breakdown for verifications over a rolling look-back window. Optional window_days query (1-90, default 30); the applied window is echoed back as window_days. Optionally narrow the aggregate with channel, status (pending | verified | approved | expired | failed), and from / to ISO-8601 bounds — the counts are then a server-side COUNT(*) for that filter rather than for the whole org.

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/analytics" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/analytics', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/analytics", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/analytics", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/analytics')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/analytics');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List pending

GET /api/v1/verify/approvals/pending

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/approvals/pending" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/approvals/pending', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/approvals/pending", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/approvals/pending", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/approvals/pending')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/approvals/pending');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List settings

GET /api/v1/verify/approvals/settings

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/approvals/settings" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/approvals/settings', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/approvals/settings", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/approvals/settings", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/approvals/settings')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/approvals/settings');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List verification configs

GET /api/v1/verify/configs

Retrieve every verification config configured for the tenant. The /configs paths are a frontend-facing alias of /profiles with identical payloads and behaviour.

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/configs" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/configs', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/configs", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/configs", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/configs')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/configs');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Get verification config

GET /api/v1/verify/configs/{id}

Retrieve a single verification config by ID. The /configs paths are a frontend-facing alias of /profiles with identical payloads and behaviour.

string

required

—

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Verify Fraud Shield conversion anomaly

GET /api/v1/verify/conversion-anomaly

Detect artificially-inflated traffic (AIT / SMS-pumping) on the Verify product via per-destination OTP completion-rate anomaly (verified vs sent): destinations converting far below the tenant baseline against a material send volume are flagged, with an estimated carrier spend-at-risk figure. Optional window_days query (1-90, default 30).

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Export AIT chargeback evidence (CSV)

GET /api/v1/verify/conversion-anomaly/evidence-export.csv

Download the flagged (AIT-suspect) destinations from the conversion-anomaly report — plus the Fraud Guard block/step-up ledger totals for the same window — as an RFC-4180 CSV evidence pack suitable for a carrier/MNO chargeback dispute. Optional window_days query (1-90, default 30). A tenant with no flagged destinations downloads a header-only file.

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/conversion-anomaly/evidence-export.csv');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List backup-codes

GET /api/v1/verify/factors/backup-codes

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List totp

GET /api/v1/verify/factors/totp

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/factors/totp" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/totp', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/factors/totp", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/factors/totp", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/factors/totp')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/factors/totp');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Verify Fraud Guard analytics

GET /api/v1/verify/fraud-analytics

Aggregate AIT / SMS-pumping defense metrics from the persisted fraud-event ledger: blocked + step-up totals, per-channel and per-reason breakdowns, a per-day time series, and estimated blocked spend saved. Optional window_days query (1-90, default 30).

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/fraud-analytics" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/fraud-analytics', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/fraud-analytics", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/fraud-analytics", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/fraud-analytics')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/fraud-analytics');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

List verification profiles

GET /api/v1/verify/profiles

Retrieve every verification profile configured for the tenant.

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/profiles" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/profiles', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/verify/profiles", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/verify/profiles", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/profiles')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/profiles');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Get verification profile

GET /api/v1/verify/profiles/{id}

Retrieve a single verification profile by ID.

string

required

—

string (enum: true|false)

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Cancel verification

POST /api/v1/verify/{id}/cancel

Cancel a pending verification.

string

required

—

string

Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the Idempotency-Replay: true response header.

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/cancel" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/cancel', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Resend verification

POST /api/v1/verify/{id}/resend

Resend a verification code for a pending verification.

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/resend" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/resend', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Create approve

POST /api/v1/verify/approvals/{id}/approve

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/approvals/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/approve" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/approvals/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/approve', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Create reject

POST /api/v1/verify/approvals/{id}/reject

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/approvals/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/reject" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/approvals/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/reject', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Send bulk verifications

POST /api/v1/verify/bulk

High-throughput OTP fan-out for login surges / password-reset campaigns. Accepts an array of up to 1000 recipients sharing one channel + optional profile/template. Each recipient flows through the same per-recipient send pipeline as POST /verify/send (rate limit, fraud velocity, wallet deduct, MessageRouter dispatch), so invariant #45 (SMS/voice via Devotel softswitch only) is preserved. Returns 201 when all sent, 207 (Multi-Status) on partial success, 400 when every recipient failed for a caller reason (invalid recipients, rejected profile/channel, rate limit, insufficient funds), or 503 when every recipient failed because of a genuine upstream delivery outage (SDK-retryable, matching POST /verify/send’s contract for the same failure).

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/bulk" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/bulk', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Check a verification code

POST /api/v1/verify/check

Validate a verification code against the stored record.

string

string (enum: true|false)

string

required

ID returned from the send step. Format is vrf_<hex> (per generateId('verification')); NOT a bare UUID — paired with the matching loosening on profile_id to prevent the same format: uuid mismatch (DEVOTEL-ORBIT-28 family).

string

required

Verification code entered by the user

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/check" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "verification_id": "string",
  "code": "string"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/check', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "verification_id": "string",
  "code": "string"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0,
    "details": {}
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "docs_url": "https://example.com"
  }
}

Create verification config

POST /api/v1/verify/configs

Create a new verification config describing OTP delivery behaviour: an ordered fallback chain over the supported channels (sms, whatsapp, email, viber, voice, telegram, …), code length, expiry, max attempts, per-recipient rate limit, and optional per-channel templates overrides (e.g. templates.sms, templates.voice). A template body may reference , , , , — every one of those resolves on every channel EXCEPT {{magic_link_url}}, which is only supplied on the magic_link channel’s template. Any other {{…}} token is left in the message exactly as written and delivered to the recipient verbatim. The /configs paths are a frontend-facing alias of /profiles with identical payloads and behaviour.

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/configs" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/configs', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Create backup-code factor

POST /api/v1/verify/factors/backup-codes

Mint 10 single-use backup codes for an end-tenant user. The plaintext codes are returned ONCE in the response; the server stores SHA-256 hashes only and cannot recover plaintext. Use this surface for recovery flows when the user has lost their device + SMS access (Twilio/Auth0/Authy parity).

string

string (enum: true|false)

string

required

Identifier for the end user these backup codes belong to, such as their email or username. Required, 1 to 200 characters.

string

Optional label stored with the factor for display in your own factor-management UI. Up to 200 characters.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "accountName": "string"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "accountName": "string"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Verify backup code

POST /api/v1/verify/factors/backup-codes/{id}/verify

Consume one backup code against a provisioned factor. The same code cannot succeed twice (single-use, enforced via an UPDATE … WHERE consumed_at IS NULL gate). Returns remaining_count so the FE can prompt regeneration when the user is low on codes.

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Create TOTP factor

POST /api/v1/verify/factors/totp

Provision an authenticator-app (RFC 6238) factor. Returns the otpauth:// URI for QR rendering plus the base32 secret for manual entry. The secret is surfaced ONCE — subsequent list/get calls return metadata only.

string

string (enum: true|false)

string

required

Identifier for the end user this authenticator factor belongs to, such as their email or username. It is written into the otpauth:// URI and shown beside the generated code in the user’s authenticator app. Required, 1 to 200 characters.

string

Optional label stored with the factor for display in your own factor-management UI. Up to 200 characters.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/factors/totp" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "accountName": "string"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/totp', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "accountName": "string"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Regenerate TOTP recovery codes

POST /api/v1/verify/factors/totp/{id}/recovery-codes/regenerate

Invalidate the factor’s existing recovery codes and return a fresh batch of 10 single-use codes. The new plaintexts are surfaced ONCE — only their SHA-256 hashes are persisted at rest. Used after a device is restored or the prior codes are suspected exposed.

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/recovery-codes/regenerate" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/recovery-codes/regenerate', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Verify TOTP code

POST /api/v1/verify/factors/totp/{id}/verify

Validate a 6-digit code against a provisioned TOTP factor (RFC 6238, 30s step, ±1 step skew window).

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Identity-verification fraud gate

POST /api/v1/verify/fraud-gate

Fuse SIM-swap recency, port-event reassignment (number recycling), and silent-network-auth possession into ONE composite risk verdict (decision / risk_score / risk_level / reasons) for fraud gating. Caller-held backups (roaming, reputation, recycling) fill operator gaps; a device-bound access_token unlocks the silent-network-auth possession dip. Operator-asserted CAMARA signals win over caller-held backups; an unconfigured deployment degrades to caller-held evidence with operator signals in signals_unavailable (fail-closed). Read-only identity signals only — nothing is sent outbound.

string

string (enum: true|false)

string

required

The phone number to gate, in E.164 format (e.g. +14155550100).

string

Device-bound access token from the 3-legged Number Verification flow. When present, possession is checked; otherwise the silent-network-auth signal is not evaluated.

number

SIM Swap look-back window in hours (CAMARA range 1..2400). Default 240.

number

Number Recycling / port-event look-back window in days (CAMARA range 1..2555). Default 30.

boolean

Caller-held port-event / recycling backup assertion.

boolean

Caller-held HLR roaming flag.

string (enum: low|medium|high|unknown)

Caller-held line-type / reputation bucket.

boolean

Caller-held unconditional call-forwarding assertion.

object

Per-request fusion weight overrides (0-100 each); merged onto defaults.

object

Per-request decision-threshold overrides on the composite 0-100 score.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/fraud-gate" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "phone_number": "+14155552671"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/fraud-gate', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "phone_number": "+14155552671"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Score phone-number fraud risk

POST /api/v1/verify/fraud-score

Verify Fraud Scoring add-on. Pre-screen a phone number for SIM-swap & line-type fraud risk from a live number-intelligence dip WITHOUT sending an OTP. Returns a transparent composite 0-100 risk_score, a coarse risk_level (low/medium/high), an advisory recommendation (allow/step_up/block), the contributing reasons, and the underlying SIM-swap / line-type / roaming detail. Fail-open: an upstream lookup outage returns a 0 / allow score flagged lookup_available: false rather than an error, so a flaky HLR can never brick the caller.

string

string (enum: true|false)

string

required

The phone number to score, in E.164 format (e.g. +14155550100).

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/fraud-score" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "phone_number": "+14155552671"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/fraud-score', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "phone_number": "+14155552671"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Create verification profile

POST /api/v1/verify/profiles

Create a new verification profile describing OTP delivery behaviour: an ordered fallback chain over the supported channels (sms, whatsapp, email, viber, voice, telegram, …), code length, expiry, max attempts, per-recipient rate limit, and optional per-channel templates overrides (e.g. templates.sms, templates.voice). A template body may reference , , , , — every one of those resolves on every channel EXCEPT {{magic_link_url}}, which is only supplied on the magic_link channel’s template. Any other {{…}} token is left in the message exactly as written and delivered to the recipient verbatim.

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/profiles" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/profiles', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Send a verification code

POST /api/v1/verify/send

Generate and deliver a one-time verification code via the specified channel.

string

string (enum: true|false)

string

required

Recipient (E.164 phone or email)

Delivery channel for the OTP (defaults to sms)

Optional ad-hoc fallback channel chain (overlays the send when no profile_id is set)

object

Optional async fallback engine config (pairs with channels)

integer

Max verification attempts

string

Optional verification profile ID. Format is vprof_<hex> (per generateId("vprof")); NOT a bare UUID — the prior format: uuid constraint here was the root cause of DEVOTEL-ORBIT-28 (27 events in 11 days) where every FE call with a real profile id 422’d before reaching the Zod parse.

string

Optional ISO 3166-1 alpha-2 country hint (e.g. TR) so national-format phone numbers normalise to the E.164 form OTP providers require. Not needed for clean E.164 input.

integer

Number of digits in the generated OTP (defaults to 6). Must equal custom_code length when a custom code is supplied.

object

Optional PSD2 SCA dynamic-linking binding. Replay the SAME object on POST /verify/check; a mismatch rejects with BINDING_MISMATCH. Omit for non-PSD2 flows.

string (enum: en|es|fr|de|it|pt|…)

Optional 2-letter language code selecting the localized voice TTS and SMS body for the built-in fallback message. Profile-defined templates override it. Region tags (e.g. es-MX) are rejected — use es.

string

Optional caller-supplied OTP (4–8 digits, digits only) for sandbox / test-mode QA. Rejected on live keys. Its length must equal code_length.

string

Device-bound network access token for the sna channel (Silent Network Authentication), obtained via the GSMA Open Gateway / CAMARA flow. When present on an sna send, verification completes via a network possession-proof and no OTP is minted.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/send" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "to": "+14155552671"
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/send', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "to": "+14155552671"
}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "destination": "+14155552671",
    "channel": "sms",
    "expires_at": "2026-08-01T12:10:00.000Z"
  },
  "meta": {
    "request_id": "req_send",
    "timestamp": "2026-08-01T12:00:00.000Z"
  }
}

{
  "error": {
    "code": "string",
    "message": "string",
    "status": 0,
    "details": {}
  },
  "meta": {
    "request_id": "req_sample",
    "timestamp": "1970-01-01T00:00:00.000Z",
    "docs_url": "https://example.com"
  }
}

Update settings

PUT /api/v1/verify/approvals/settings

string

string (enum: true|false)

cURL

curl -X PUT "https://api.orbit.devotel.io/api/v1/verify/approvals/settings" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/approvals/settings', {
  method: 'PUT',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Update verification config

PATCH /api/v1/verify/configs/{id}

Partially update an existing verification config. templates overrides follow the same placeholder contract as create: , , , , , with {{magic_link_url}} resolving only on the magic_link channel’s template. The /configs paths are a frontend-facing alias of /profiles with identical payloads and behaviour.

string

required

—

string (enum: true|false)

cURL

curl -X PATCH "https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'PATCH',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Update verification profile

PATCH /api/v1/verify/profiles/{id}

Partially update an existing verification profile. templates overrides follow the same placeholder contract as create: , , , , , with {{magic_link_url}} resolving only on the magic_link channel’s template.

string

required

—

string (enum: true|false)

cURL

curl -X PATCH "https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'PATCH',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Delete verification config

DELETE /api/v1/verify/configs/{id}

Delete a verification config. The /configs paths are a frontend-facing alias of /profiles with identical payloads and behaviour.

string

required

—

string (enum: true|false)

cURL

curl -X DELETE "https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/configs/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'DELETE',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Delete backup-codes

DELETE /api/v1/verify/factors/backup-codes/{id}

string

required

—

string (enum: true|false)

cURL

curl -X DELETE "https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/backup-codes/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'DELETE',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Delete totp

DELETE /api/v1/verify/factors/totp/{id}

string

required

—

string (enum: true|false)

cURL

curl -X DELETE "https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/factors/totp/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'DELETE',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

Delete verification profile

DELETE /api/v1/verify/profiles/{id}

Delete a verification profile.

string

required

—

string (enum: true|false)

cURL

curl -X DELETE "https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/profiles/num_8fb2d1b7c00c4ec9a1d3f5e7b9c1d3', {
  method: 'DELETE',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

{
  "data": {
    "verification_id": "ver_3f6a81c2d4e5471a9b0c2d5e",
    "status": "verified"
  },
  "meta": {
    "request_id": "req_check",
    "timestamp": "2026-08-01T12:00:30.000Z"
  }
}

​Verify API

​title: “Worked request and response samples” description: “Worked samples for the OTP verification flow: send a verifiable code, and check it. Each sample shows the request, the success envelope, and the error envelope to expect.”

​Worked request and response samples

​Send a verification code

​Check a code

​Error envelope

​Gate a verification on identity signals

​Consume a magic-link token

​List verifications

​Get verification

​Get verification detail

​Verification analytics

​List pending

​List settings

​List verification configs

​Get verification config

​Verify Fraud Shield conversion anomaly

​Export AIT chargeback evidence (CSV)

​List backup-codes

​List totp

​Verify Fraud Guard analytics

​List verification profiles

​Get verification profile

​Cancel verification

​Resend verification

​Create approve

​Create reject

​Send bulk verifications

​Check a verification code

​Create verification config

​Create backup-code factor

​Verify backup code

​Create TOTP factor

​Regenerate TOTP recovery codes

​Verify TOTP code

​Identity-verification fraud gate

​Score phone-number fraud risk

​Create verification profile

​Send a verification code

​Update settings

​Update verification config

​Update verification profile

​Delete verification config

​Delete backup-codes

​Delete totp

​Delete verification profile

Verify API

title: “Worked request and response samples” description: “Worked samples for the OTP verification flow: send a verifiable code, and check it. Each sample shows the request, the success envelope, and the error envelope to expect.”

Worked request and response samples

Send a verification code

Check a code

Error envelope

Gate a verification on identity signals

Consume a magic-link token

List verifications

Get verification

Get verification detail

Verification analytics

List pending

List settings

List verification configs

Get verification config

Verify Fraud Shield conversion anomaly

Export AIT chargeback evidence (CSV)

List backup-codes

List totp

Verify Fraud Guard analytics

List verification profiles

Get verification profile

Cancel verification

Resend verification

Create approve

Create reject

Send bulk verifications

Check a verification code

Create verification config

Create backup-code factor

Verify backup code

Create TOTP factor

Regenerate TOTP recovery codes

Verify TOTP code

Identity-verification fraud gate

Score phone-number fraud risk

Create verification profile

Send a verification code

Update settings

Update verification config

Update verification profile

Delete verification config

Delete backup-codes

Delete totp

Delete verification profile