/v1/holds/{reservationId}/otp/verify

POST

/v1/holds/{reservationId}/otp/verify

curl --request POST \
  --url http://localhost:8787/v1/holds/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/otp/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "email": "hello@example.com" }'

• Local development (`wrangler dev --env dev`).
• Staging — placeholder host; real custom domain not yet provisioned.
• Production — placeholder host; real custom domain not yet provisioned.

Authorizations

• ApiKeyAuth

Parameters

Path Parameters

reservationId

required

string format: uuid

Request Body

Media typeapplication/json

object

code

required

string

/^[0-9]{6}$/

email

required

string format: email

Example^generated

{
  "code": "example",
  "email": "hello@example.com"
}

Responses

200

Code matched an active, unexpired, not-yet-consumed OTP for this hold+email. The returned token authorizes confirming ONLY this one hold (API-008).

Media typeapplication/json

object

expiresAt

required

string

guestVerificationToken

required

string

Example^generated

{
  "expiresAt": "example",
  "guestVerificationToken": "example"
}

400

No active OTP for this hold+email, wrong code, expired, or attempt-locked — all fold into the SAME bad_code shape (M4: no oracle for which one it was).

Media typeapplication/problem+json

object

code

required

string

Allowed values: hold_not_found hold_not_held bad_code expired exhausted_attempts rate_limited

detail

required

string

status

required

number

title

required

string

type

required

string

Example

{
  "code": "hold_not_found"
}

429

OTP-verify rate limit exceeded for this hold.

Media typeapplication/problem+json

object

code

required

string

Allowed values: hold_not_found hold_not_held bad_code expired exhausted_attempts rate_limited

detail

required

string

status

required

number

title

required

string

type

required

string

Example

{
  "code": "hold_not_found"
}