# Verify an agent's phone OTP

Operation ID: `fieldagent.verifySms`

Confirm an SMS OTP and mark the Cognito account's phone number as verified. Unlike fieldagent.verifyEmail, the caller identifies the account directly by Cognito sub (cognito_id/user_id/cognito_sub are aliases for the same value) rather than by email.

## Public method

`verifySms`

Signature: `fieldAgent.verifySms(request)`

Return type: `Promise<VerifiedResponse>`

## Authentication

Classification: **PUBLIC**

## Prerequisites

None documented.

## HTTP

`POST /auth/verify-sms`

## Path parameters

None.

## Query parameters

None.

## Body parameters

| Name | Type | Required | Format | Allowed values | Default | Nullable | Description |
|---|---|---:|---|---|---|---:|---|
| `body` | [`fieldagent.VerifySmsRequest`](../models/fieldagent.VerifySmsRequest.md) | Yes |  |  |  | No |  |

Request model: [`fieldagent.VerifySmsRequest`](../models/fieldagent.VerifySmsRequest.md)

## Request example

```json
{
  "cognito_id": "00000000-0000-4000-8000-000000000000",
  "cognito_sub": "00000000-0000-4000-8000-000000000001",
  "otp": "123456",
  "tenant_id": "tenant-example-001",
  "user_id": "00000000-0000-4000-8000-000000000001"
}
```

## Success responses

| Status | Shape | Content type | Description |
|---|---|---|---|
| `200` | [`VerifyOtpResponse`](../models/VerifyOtpResponse.md) | application/json | Phone verified |

## Success response examples

### 200

```json
{
  "verified": true
}
```

## Common errors

| Status | Shape | Content type | Description |
|---|---|---|---|
| `400` | [`fieldagent.ErrorResponse`](../models/fieldagent.ErrorResponse.md) | application/json | Required fields are missing, or the OTP is invalid/expired |

## Error examples

### 400 — The OTP is incorrect or expired (sanitized example)

```json
{
  "error": "Invalid or expired OTP"
}
```

### 400 — Required fields are missing

```json
{
  "error": "cognito_id, tenant_id and otp are required"
}
```

## NodeJS / TypeScript implementation

```ts
import { HCSDK } from "@healthcloudai/hc-sdk";
import type { VerifyFieldAgentSmsRequest } from "@healthcloudai/hc-sdk";
```

```ts
const request = {
  "cognito_id": "00000000-0000-4000-8000-000000000000",
  "cognito_sub": "00000000-0000-4000-8000-000000000001",
  "otp": "123456",
  "tenant_id": "tenant-example-001",
  "user_id": "00000000-0000-4000-8000-000000000001"
};

const result = await fieldAgent.verifySms(request);
```

## cURL

```bash
curl -X POST \
  -H 'Content-Type: application/json' \
  -d '{"cognito_id":"00000000-0000-4000-8000-000000000000","cognito_sub":"00000000-0000-4000-8000-000000000001","otp":"123456","tenant_id":"tenant-example-001","user_id":"00000000-0000-4000-8000-000000000001"}' \
  'https://dev-api-fieldagent.health.cloud/auth/verify-sms'
```

## Notes

None.

## Prepared Test Console scenario

No canonical scenario is currently associated.

## Real response

No approved real integration response is currently published. Unapproved candidates are never rendered as examples.