# Check a code (/docs/api-reference/verifications/check-verification)

Checks the code the end user typed, by the verification's id or by the destination (its latest verification). `valid: true` approves it (`verification.approved`, billed once); a wrong code spends an attempt, and the last one fails it. Checking an approved verification again with its code stays valid until it expires, without being billed again.

`POST https://api.coss.com/v1/verifications/check`

Authenticate with your API key as a bearer token (`Authorization: Bearer coss_test_…`). Responses are JSON with snake_case fields; errors are `{ error: { type, code, message, param?, issues?, request_id } }` (https://coss.com/docs/api-reference/errors.md).

## Headers

- `Idempotency-Key` (string, 1-256 characters): Makes retries safe: a repeated check with the same key returns the same answer without spending another attempt. 1-256 characters.

## Request body

- `verification_id` (string, at most 64 characters): The verification to check. Give this or `to`.
- `to` (string, 1-320 characters): The destination the code was sent to: checks its most recent verification. Give this or `verification_id`.
- `code` (string, required): The code the end user entered.

## Example request

TypeScript (the `coss` package):

```ts
import { Coss } from "coss";

const coss = new Coss({
  apiKey: process.env.COSS_API_KEY,
  baseUrl: "https://api.coss.com",
});

const { data, error } = await coss.verify.check({
  to: "+14155550199",
  code: "482913",
}, {
  idempotencyKey: "welcome-user-123",
});
```

HTTP:

```sh
curl -X POST "https://api.coss.com/v1/verifications/check" \
  -H "Authorization: Bearer $COSS_API_KEY" \
  -H "Idempotency-Key: welcome-user-123" \
  -H "Content-Type: application/json" \
  -d '{
  "to": "+14155550199",
  "code": "482913"
}'
```

## Response 200

Whether the code is right, and the verification after the check.

- `object` ("verification_check", required)
- `valid` (boolean, required): Whether the code is right. Only `true` proves the end user has the phone or mailbox; checking an approved verification again with its code stays `true` until it expires.
- `verification` (object, required)
  - `object` ("verification", required)
  - `id` (string, required)
  - `channel` ("sms" | "email", required)
  - `to` (string, required)
  - `country` (string | null, required): ISO 3166 country of a phone number.
  - `status` ("pending" | "approved" | "expired" | "canceled" | "failed" | "blocked", required): `pending` until the right code is checked (`approved`) or it ends: `expired`, `canceled`, `failed` (too many wrong codes, or the code couldn't be sent) or `blocked` (the fraud guard stopped it before anything was sent).
  - `failure` (object | null, required): Why it `failed`.
    - `code` (string, required)
    - `message` (string, required)
  - `reasons` (object[], required): Why it was `blocked` (empty otherwise).
    - `code` (string, required)
    - `value` (number)
  - `attempts` (integer, required): Wrong codes checked so far.
  - `max_attempts` (integer, required)
  - `sends` (object[], required): Each time the code was sent.
    - `channel` ("sms" | "email", required)
    - `route` ("own_number" | "shared_number" | "email" | "coss_email", required): `own_number`: one of your numbers; `shared_number`: coss.com's; `email`: your sender; `coss_email`: coss.com's sender.
    - `sms_id` (string | null, required): The SMS, in your environment: `own_number`, or any in a sandbox environment (`null` for coss.com's shared numbers' messages).
    - `email_id` (string | null, required): The email (`email` route only).
    - `created_at` (string, required, date-time)
  - `tags` (object[], required)
    - `name` (string, required)
    - `value` (string, required)
  - `sandbox` (boolean, required): Made in a sandbox environment: simulated, and the code is always zeros.
  - `expires_at` (string, required, date-time)
  - `approved_at` (string | null, required, date-time)
  - `created_at` (string, required, date-time)

Example:

```json
{
  "object": "verification_check",
  "valid": true,
  "verification": {
    "object": "verification",
    "id": "vrf_01k8e2m4q2f3e9v6t5r1n0p8yz",
    "channel": "sms",
    "to": "+14155550199",
    "country": "US",
    "status": "approved",
    "failure": null,
    "reasons": [],
    "attempts": 0,
    "max_attempts": 5,
    "sends": [],
    "tags": [],
    "sandbox": false,
    "expires_at": "2026-11-10T12:10:00.000Z",
    "approved_at": "2026-11-10T12:00:41.000Z",
    "created_at": "2026-11-10T12:00:00.000Z"
  }
}
```

## Errors

- `400`: The body is not valid JSON (`invalid_json`) or the `Idempotency-Key` header is invalid (`invalid_idempotency_key`). Also when the `Coss-Version` header names an unknown API version (`invalid_api_version`).
- `401`: The API key is missing, invalid, revoked or expired (`authentication_error`).
- `403`: The API key lacks the permission this endpoint needs (`permission_error`), or its organization is suspended (`organization_suspended`).
- `404`: No such verification in the API key's environment (`not_found`).
- `422`: The body failed validation (`validation_error`, see `issues`).
- `429`: Too many requests with this API key (`rate_limited`), or too many checks for this destination (`quota_exceeded`).
- `500`: Unexpected server error (`api_error` / `internal_error`).
- `503`: The API key could not be verified right now; retry (`service_unavailable`).