Dispatch an SMS/email verification code for the session's active challenge

POST

/v1/hosted-sessions/{sessionId}/challenge/send

const url = 'https://api.govifi.com/v1/hosted-sessions/example/challenge/send';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.govifi.com/v1/hosted-sessions/example/challenge/send \
  --header 'Authorization: Bearer <token>'

For sms/email challenges only, triggers delivery of the verification code bound to the session. No-op for hcaptcha/turnstile. Idempotent within a short window; rate limited. (RFC rfc-fraud-challenges.md §3.2)

Authorizations

sessionCredential

Parameters

Path Parameters

sessionId

required

string

/^cs_[A-Za-z0-9]+$/

Responses

200

Code dispatched (or no code needed for this challenge type)

application/json

Server-decided fraud challenge the payer must satisfy before confirm (RFC rfc-fraud-challenges.md). Null = no challenge required. Browser-safe — site_key is public and delivery_hint is masked; contains no PII.

object

type

string

Allowed values: hcaptcha turnstile sms email

site_key

Public key for hcaptcha/turnstile.

string

delivery_hint

Masked destination for sms/email, e.g. --1234.

string

code_sent

Sms/email: whether a verification code has already been dispatched.

boolean

Example

{
  "type": "hcaptcha"
}

404

Session not found

application/json

object

code

required

string

Allowed values: card_declined expired_card incorrect_cvc insufficient_funds processing_error network_error session_expired validation_error origin_not_allowed rate_limited challenge_required challenge_failed duplicate_payment already_confirmed insufficient_scope

message

required

string

recoverable

boolean

request_id

string

Example

{
  "code": "card_declined"
}

429

Validation error

application/json

object

code

required

string

message

required

string

recoverable

boolean

request_id

string

Example

{
  "code": "card_declined"
}