> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vultlocal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PEP Access Control

> Secure access to Politically Exposed Person accounts

<Warning>
  PEP accounts require **two-factor verification** via OTP before any access is granted. All access attempts are logged for audit compliance.
</Warning>

## What is PEP?

Politically Exposed Persons (PEP) are individuals who hold prominent public positions or have close associations with such persons. Their accounts require enhanced due diligence and access controls.

<CardGroup cols={3}>
  <Card title="OTP Verification" icon="mobile">
    6-digit code sent to staff phone
  </Card>

  <Card title="Audit Trail" icon="scroll">
    Every access logged with IP & timestamp
  </Card>

  <Card title="Time-Limited" icon="clock">
    Access expires after session ends
  </Card>
</CardGroup>

***

## Endpoints

<CardGroup cols={2}>
  <Card title="Request Access" icon="key" color="#f59e0b" href="/api-reference/pep/request-access">
    `POST /api/v1/pep/request-access`

    Generate OTP and send to authorized staff
  </Card>

  <Card title="Verify Access" icon="check-circle" color="#10b981" href="/api-reference/pep/verify-access">
    `POST /api/v1/pep/verify-access`

    Verify OTP and grant temporary access
  </Card>
</CardGroup>

***

## Access Flow

<Steps>
  <Step title="Initiate Request">
    Staff member with `pep_access_authorized: true` requests access to a PEP subscriber
  </Step>

  <Step title="OTP Generated">
    System generates 6-digit OTP and sends via SMS to staff's registered phone
  </Step>

  <Step title="OTP Expires">
    OTP is valid for **5 minutes** only
  </Step>

  <Step title="Verification">
    Staff enters OTP to verify identity
  </Step>

  <Step title="Access Granted">
    Temporary access granted with full audit logging
  </Step>
</Steps>

***

## Security Features

<AccordionGroup>
  <Accordion title="Role-Based Access" icon="users">
    Only users with `pep_access_authorized: true` in their profile can even request access to PEP accounts. This is set by system administrators.
  </Accordion>

  <Accordion title="IP & Device Logging" icon="map-pin">
    Every access attempt logs:

    * Client IP address
    * User agent string
    * Request timestamp
    * Staff user ID
    * Subscriber ID accessed
  </Accordion>

  <Accordion title="Session Expiry" icon="timer">
    PEP access is granted per-session only. When the staff member logs out or their session expires, new OTP verification is required.
  </Accordion>

  <Accordion title="Rate Limiting" icon="shield">
    Failed OTP attempts are tracked. After 3 failed attempts, the staff member is temporarily locked out.
  </Accordion>
</AccordionGroup>

***

## Request Example

<Tabs>
  <Tab title="Request Access">
    ```bash theme={null}
    curl -X POST https://demo.api.vultlocal.com/api/v1/pep/request-access \
      -H "Authorization: Bearer $JWT_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{"subscriber_id": "sub_pep_12345"}'
    ```

    **Response:**

    ```json theme={null}
    {
      "success": true,
      "message": "OTP sent successfully",
      "expiry_time": "2025-01-15T10:35:00Z"
    }
    ```
  </Tab>

  <Tab title="Verify Access">
    ```bash theme={null}
    curl -X POST https://demo.api.vultlocal.com/api/v1/pep/verify-access \
      -H "Authorization: Bearer $JWT_TOKEN" \
      -H "Content-Type: application/json" \
      -d '{
        "subscriber_id": "sub_pep_12345",
        "otp_code": "123456"
      }'
    ```

    **Response:**

    ```json theme={null}
    {
      "success": true,
      "message": "Access granted"
    }
    ```
  </Tab>
</Tabs>

***

## Error Codes

| Code | Error                  | Description                        |
| ---- | ---------------------- | ---------------------------------- |
| 401  | `UNAUTHORIZED`         | User not authenticated             |
| 403  | `PEP_ACCESS_DENIED`    | User not authorized for PEP access |
| 400  | `INVALID_OTP`          | OTP incorrect or expired           |
| 404  | `SUBSCRIBER_NOT_FOUND` | PEP subscriber does not exist      |
| 429  | `TOO_MANY_ATTEMPTS`    | Too many failed OTP attempts       |