> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vultlocal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify PEP Access

> Verify OTP and grant access to PEP account

# Verify PEP Access

Verify the 6-digit OTP and grant temporary access to PEP account data.

## Endpoint

```http theme={null}
POST /api/v1/pep/verify-access
```

## Authentication

<ParamField header="Authorization" type="string" required>
  Bearer token (Admin JWT with `pep_access_authorized: true`)
</ParamField>

## Request Body

<ParamField body="subscriber_id" type="string" required>
  PEP subscriber UUID
</ParamField>

<ParamField body="otp_code" type="string" required>
  6-digit OTP code received
</ParamField>

## Response

```json theme={null}
{
  "success": true,
  "message": "Access granted"
}
```

## Security Notes

* OTP verification is required for each session
* Access is time-limited
* All access attempts are logged for audit
* IP address and user agent are recorded

## Errors

| Code | Description                   |
| ---- | ----------------------------- |
| 400  | Invalid OTP or expired        |
| 401  | User not authenticated        |
| 403  | Not authorized for PEP access |
| 500  | Internal server error         |


## OpenAPI

````yaml olive-openapi.json POST /pep/verify-access
openapi: 3.0.0
info:
  description: >-
    API Gateway for OLIVE NFC Card Payment System - Comprehensive payment, card
    management, agent operations, and admin authentication. All /api/v1 routes
    require authentication using either API Key or JWT token.
  title: OLIVE NFC Card Payment API
  termsOfService: http://swagger.io/terms/
  contact:
    name: API Support
    email: support@olive.sl
  license:
    name: Apache 2.0
    url: http://www.apache.org/licenses/LICENSE-2.0.html
  version: 1.0.0
servers:
  - url: https://olive-gateway-a6ba.onrender.com/api/v1
security: []
paths:
  /pep/verify-access:
    post:
      tags:
        - PEP Access
      summary: Verify OTP for PEP account access
      description: Verify the OTP code and grant access to PEP account
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/handler.VerifyPEPAccessRequest'
        description: OTP verification
        required: true
      responses:
        '200':
          description: Access granted
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '400':
          description: Invalid OTP
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '403':
          description: Not authorized
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
      security:
        - ApiKeyAuth: []
        - BearerAuth: []
components:
  schemas:
    handler.VerifyPEPAccessRequest:
      type: object
      required:
        - otp_code
        - subscriber_id
      properties:
        otp_code:
          type: string
        subscriber_id:
          type: string
  securitySchemes:
    ApiKeyAuth:
      description: >-
        API Key for third-party integrations (WhatsApp, Smart PAY, VULT).
        Format: 'Bearer olive_live_xxxxxxxxxxxxx'
      type: apiKey
      name: Authorization
      in: header
    BearerAuth:
      description: >-
        JWT token from admin login for administrative operations. Format:
        'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
      type: apiKey
      name: Authorization
      in: header

````