Verify a member with their challenge code

POST /members/verify

The Studio calls it at onboarding when the register's connection has "Challenge code required" switched on, with the member code as the person typed it, the birth date they entered and their challenge code (memberSecret).

Answer verified: true with the member's status and person data when the three belong together, and verified: false otherwise, also for an unknown member code: this operation never answers 404. The Studio then compares the first name, last name and birth date in params with what the person entered, so a verified member must carry all three; without them the Studio treats the register as unavailable.

Authentication

appsolut_m2m (sent in the header x-api-key): The "API key" entered in the register's connection in the Studio, sent with every call. The Studio keeps it encrypted and never shows it again. Answer 401 or 403 to a wrong key.

Parameters

Name	In	Required	Type	Description
`x-tenant-id`	header	Yes	string	The "Tenant ID" entered in the register's connection in the Studio, sent unchanged with every call. Your register can use it to tell apart the organisations it serves. Example: `pannoniqa`.
`x-custom-scope`	header	Yes	string	The "Scope" entered in the register's connection in the Studio, sent unchanged with every call. Your register can use it to choose the data set it answers from. Example: `employees`.

Request body

Content type: application/json, required

Field	Type	Required	Description
`memberCode`	string	Yes	The member code as the person typed it.
`birthDate`	string (date)	Yes	The birth date the person entered, YYYY-MM-DD.
`memberSecret`	string	Yes	The challenge code the person entered: the personal secret the organisation sent them on a second channel.

Example

{
  "memberCode": "100001",
  "birthDate": "1979-02-02",
  "memberSecret": "K7MQ-2Z9P"
}

Responses

200

Verified or not. verified: false needs no other field than source.

Content type: application/json

Field	Type	Required	Description
`source`	string	Yes	The name of your data source, such as "SAP HR".
`verified`	boolean	Yes	Whether the member code, birth date and challenge code belong to one member.
`status`	object	No	The member's status. Required when `verified` is true.
`status.statusCode`	string	Yes	The member's status in the register. Filters in the membership definition and in communities can check it. Allowed values: `active`, `inactive`, `pending`.
`params`	object	No	The member's person data. Required when `verified` is true.
`params.firstName`	string	No	First name.
`params.lastName`	string	No	Last name.
`params.memberCode`	string	No	The member code as the register holds it.
`params.birthDate`	string (date)	No	Birth date, YYYY-MM-DD.
`params.zip`	string	No	Postal code.
`params.city`	string	No	City.
`params.street`	string	No	Street and house number.
`params.country`	string	No	Country code, such as AT.

Example: An active employee

{
  "source": "SAP HR",
  "verified": true,
  "status": {
    "statusCode": "active"
  },
  "params": {
    "firstName": "Anna",
    "lastName": "Berger",
    "memberCode": "100001",
    "birthDate": "1979-02-02",
    "zip": "7100",
    "city": "Neusiedl am See",
    "street": "Musterweg 3",
    "country": "AT"
  }
}

Example: A retired employee

{
  "source": "SAP HR",
  "verified": true,
  "status": {
    "statusCode": "inactive"
  },
  "params": {
    "firstName": "Johann",
    "lastName": "Novak",
    "memberCode": "100009",
    "birthDate": "1952-07-07",
    "zip": "7000",
    "city": "Eisenstadt",
    "street": "Beispielgasse 7",
    "country": "AT"
  }
}

Example: Not verified

{
  "source": "SAP HR",
  "verified": false
}

400

The register could not process the request. The Studio treats it as the register being unavailable and does not read the body.

Content type: text/plain

Type: string

Example

Bad request

401

The API key is wrong. The Studio reports the credentials as rejected (it does the same for 403) and treats the register as unavailable.

Content type: text/plain

Type: string

Example

Unauthorized

429

Too many requests. The Studio treats it as the register being unavailable.

Content type: text/plain

Type: string

Example

Too many requests

Verify a member with their challenge code

POST /members/verify

Authentication

appsolut_m2m (sent in the header x-api-key): The "API key" entered in the register's connection in the Studio, sent with every call. The Studio keeps it encrypted and never shows it again. Answer 401 or 403 to a wrong key.

Parameters

Name	In	Required	Type	Description
`x-tenant-id`	header	Yes	string	The "Tenant ID" entered in the register's connection in the Studio, sent unchanged with every call. Your register can use it to tell apart the organisations it serves. Example: `pannoniqa`.
`x-custom-scope`	header	Yes	string	The "Scope" entered in the register's connection in the Studio, sent unchanged with every call. Your register can use it to choose the data set it answers from. Example: `employees`.

Request body

Content type: application/json, required

Field	Type	Required	Description
`memberCode`	string	Yes	The member code as the person typed it.
`birthDate`	string (date)	Yes	The birth date the person entered, YYYY-MM-DD.
`memberSecret`	string	Yes	The challenge code the person entered: the personal secret the organisation sent them on a second channel.

Example

{
  "memberCode": "100001",
  "birthDate": "1979-02-02",
  "memberSecret": "K7MQ-2Z9P"
}

Responses

200

Verified or not. verified: false needs no other field than source.

Content type: application/json

Field	Type	Required	Description
`source`	string	Yes	The name of your data source, such as "SAP HR".
`verified`	boolean	Yes	Whether the member code, birth date and challenge code belong to one member.
`status`	object	No	The member's status. Required when `verified` is true.
`status.statusCode`	string	Yes	The member's status in the register. Filters in the membership definition and in communities can check it. Allowed values: `active`, `inactive`, `pending`.
`params`	object	No	The member's person data. Required when `verified` is true.
`params.firstName`	string	No	First name.
`params.lastName`	string	No	Last name.
`params.memberCode`	string	No	The member code as the register holds it.
`params.birthDate`	string (date)	No	Birth date, YYYY-MM-DD.
`params.zip`	string	No	Postal code.
`params.city`	string	No	City.
`params.street`	string	No	Street and house number.
`params.country`	string	No	Country code, such as AT.

Example: An active employee

{
  "source": "SAP HR",
  "verified": true,
  "status": {
    "statusCode": "active"
  },
  "params": {
    "firstName": "Anna",
    "lastName": "Berger",
    "memberCode": "100001",
    "birthDate": "1979-02-02",
    "zip": "7100",
    "city": "Neusiedl am See",
    "street": "Musterweg 3",
    "country": "AT"
  }
}

Example: A retired employee

{
  "source": "SAP HR",
  "verified": true,
  "status": {
    "statusCode": "inactive"
  },
  "params": {
    "firstName": "Johann",
    "lastName": "Novak",
    "memberCode": "100009",
    "birthDate": "1952-07-07",
    "zip": "7000",
    "city": "Eisenstadt",
    "street": "Beispielgasse 7",
    "country": "AT"
  }
}

Example: Not verified

{
  "source": "SAP HR",
  "verified": false
}

400

The register could not process the request. The Studio treats it as the register being unavailable and does not read the body.

Content type: text/plain

Type: string

Example

Bad request

401

The API key is wrong. The Studio reports the credentials as rejected (it does the same for 403) and treats the register as unavailable.

Content type: text/plain

Type: string

Example

Unauthorized

429

Too many requests. The Studio treats it as the register being unavailable.

Content type: text/plain

Type: string

Example

Too many requests