# Confirm Phone Number via OTP

Submits the OTP received via SMS to verify the phone number associated with the onboarding process. On success, returns the URL for the next onboarding step (KYC/identity verification).

Endpoint: POST /onboarding/{onboarding_process_ulid}/phone/confirm-otp
Version: 1.1.0
Security: user_bearer_auth

## Path parameters:

  - `onboarding_process_ulid` (string, required)
    The unique identifier (ULID) for the user's onboarding process.
    Example: "01ARZ3NDEKTSV4RRFFQ69G5FAV"

## Request fields (application/json):

  - `otp` (string, required)
    The One-Time Password received by the user via SMS.
    Example: "654321"

  - `client_id` (string, required)
    The OAuth client_id of the company initiating the request.
    Example: "aBcDeFgHiJkLmNoPqRsT"

## Response 200 fields (application/json):

  - `kyc_url` (string, required)
    The URL the user should be redirected to for the KYC/identity verification step.
    Example: "https://id.cybersign.gt/start/01ARZ3NDEKTSV4RRFFQ69G5FAV"

## Response 400 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 401 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 404 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."

## Response 500 fields (application/json):

  - `code` (string, required)
    An application-specific error code string.
    Example: "INVALID_OTP"

  - `message` (string, required)
    A human-readable explanation specific to this occurrence of the problem.
    Example: "The OTP provided is invalid or has expired."