Help Center/ OneAccess/ API Reference/ OneAccess APIs/ User APIs/ MFA/ SMS-based MFA
Updated on 2024-12-30 GMT+08:00
View PDF
Share

SMS-based MFA

Function

If SMS-based MFA is required during login, this API is called for authentication in accordance with mobile number and SMS verification code.

URI

POST /api/v2/sdk/mfa/sms

Request Parameters

Table 1 Request header parameters

Parameter

Mandatory

Type

Description

Content-Type

Yes

String

Set this field to "application/json;charset=utf8".

X-operating-sys-version

Yes

String

Caller OS version, for example, Android 10.

X-device-fingerprint

Yes

String

Caller device fingerprint, for example, 156aysdna213sc50.

X-device-ip

No

String

Caller IP address, for example, 10.10.10.1

X-agent

Yes

String

User agent information, for example, Mozilla/5.0 (Linux; Android 10; Redmi K30 Build/QKQ1.190825.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/80.0.3987.99 Mobile Safari/537.36

X-L

No

String

Language type, for example, en.

X-client-id

Yes

String

Application ID, which is a ClientId allocated to an application after registration.

X-state-token

Yes

String

User token with a status. state_token is returned when login-related APIs are called for MFA.

X-tenant-id

No

String

Tenant ID. This parameter is mandatory when calling an ISV application. Replace "{domain_name}" with the ISV common domain name "{common_domain}". In the request header, specify tenant_id of the corresponding tenant and replace X-client-id with client_id of the ISV application template.
Table 2 Request body parameters

Parameter

Mandatory

Type

Description

mobile

Yes

String

Mobile number for receiving a verification code.

verify_code

Yes

String

Verification code that is received.

Response Parameters

Status code: 200

Table 3 Response body parameters

Parameter

Type

Description

status

String

Login process status identifier.

session_token

String

User session_token, which can be used to call the SSO API to obtain sso_ticket. User information can be obtained using sso_ticket.

id_token

String

It is essentially a JWT token that contains user identity information. The token is valid for 2 hours by default and its validity period can be configured.

expire

Integer

session_token validity period. Unit: second. Within the validity period, ticket can be obtained using session_token.

Status code: 400

Table 4 Response body parameters

Parameter

Type

Description

error_code

String

Error code.

error_msg

String

Error details.

Example Requests

SMS-based MFA. The mobile number is 12345678901 and the verification code is 123456.

POST https://{domain_name}/api/v2/sdk/mfa/sms

X-operating-sys-version: Android 10
X-device-fingerprint: 156aysdna213sac
X-device-ip: 10.10.10.1
X-agent: Mozilla/5.0 (Linux; Android 10; Redmi K30 Build/QKQ1.190825.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/80.0.3987.99 Mobile Safari/537.36
X-L: zh
X-client-id: DRrYIqauawN0I8myTMoDTPys6ezGZxnm
X-state-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
X-tenant-id: 08f770f51f80d2f40f38c00cb199fd21

{
  "mobile": "12345678901",
  "verify_code": "123456"
}

Example Responses

Status code: 200

Request successful.

{
  "status" : "SUCCESS",
  "expire" : 43200,
  "session_token" : "LGT******sqa"
}

Status Codes

Status Code

Description

200

Request successful.

400

Invalid parameter.

Error Codes

See Error Codes.

Parent topic: MFA