--- title: "Non-FIDO authentication" slug: "dpo-rest-api-non-fido-authentication" updated: 2026-10-27T20:13:12Z published: 2026-10-27T20:13:12Z canonical: "docs.onespan.com/dpo-rest-api-non-fido-authentication" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Non-FIDO authentication | URL: /nnlgateway/nnl//auth Method: POST | | --- | --- Use these operations to authenticate using a non-FIDO authentication method like Email OTP, SMS OTP, Photo ID or External Authentication. ## INIT_VERIFY Initiates the verification process for non-FIDO authentication methods like OTP and Photo ID. You do not need to call INIT_VERIFY for External authentication because Adaptive Authentication has been optimized for those methods. You must call [INIT_ADAPTIVE](/dpoa/docs/s3suite94-rest-api-1) before calling INIT_VERIFY. INIT_VERIFY expects to receive data specific to the method in the method.data request attribute, this is summarized below. For complete details about method.data as it pertains to INIT_VERIFY, see the specific sections for each authentication method under [Data Field Contents by Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#data-field-contents-by-authentication-method). - Email OTP: The user's email address that receives the verification code. Assign to method.data.identifier. "data": {"identifier": "user@noknok.com"} - Photo ID: The scan reference ID to get the results of facial recognition. Assign to method.data.scanReferenceId. "data": { ```plaintext       "scanReferenceId": "c2f59eae-8404-4db5-8338-18ac42439eb7" ``` } - SMS OTP: The user's phone number that receives the verification code. Assign to method.data.identifier. "data": {"identifier": "+91xxxxxxxxxx"} See [About Photo ID](/dpoa/docs/s3suite94-step-4-configure-non-fido-authentication-methods-1#about-photo-id) for an explanation of scan reference ID. ### Request | **Attribute** | **Description** | | --- | --- | | operation | Required. The string INIT_VERIFY. | | callerOrigin | Required if a web app is sending the request and that app has a different origin than the DigipassONE API Server. A web origin is defined by the scheme (protocol), host (domain), and port of the URL used to access it. The API Server checks if this origin is listed in its origin allow list, if not, the request is rejected. See [My Web Apps Have a Different Origin](/dpoa/docs/s3suite94-my-web-client-apps-have-a-different-origin-than-the-api-server-1). | | id | Optional. The correlation ID, a unique id that ties together different API requests that comprise a FIDO operation, like authentication. An alphanumeric string, maximum 255 characters. No special characters are allowed. If not provided, the Server generates a unique id and returns it. | | locale | Optional. The Server uses locale, in subsequent calls to email OTP and SMS OTP, to tailor the end user's prompts to the language in the user’s profile. An IETF BCP 47 language tag string, like en-US. | | method | Required. The non-FIDO authentication method that the Server will use to verify the user. See the description for INIT_VERIFY above. | | optionsData | Optional. An object used to pass additional attributes to REST API operations. See [OptionsData](/dpoa/docs/s3suite94-nok-nok-data-types-1#optionsdata) for a complete description. | | sessionData | Optional. An object containing the user's session information. See [SessionData](/dpoa/docs/s3suite94-nok-nok-data-types-1#sessiondata). If you send sessionData in the request to INIT_ADAPTIVE, you must also include it in the request to INIT_VERIFY. | | sessionData.pushHandle | Optional. Identifies the device that receives a push notification and then initiates a FIDO OOB authentication. | | sessionData.userName | Optional. For an improved FIDO OOB authentication experience, provide the username so it is known up front. | ### Response The following attributes are always present in the JSON payload of the response. | **Attribute** | **Description** | | --- | --- | | id | The unique id that correlates different requests comprising an operation. Must be identical to the id returned from INIT_ADAPTIVE. A Base64-URL encoded string. If id was sent in the request, the same id is returned. If not, a server-generated ID is returned. If id was provided in the REST payload but the server was unable to parse the payload, the value is unknown. | | method | Result of method that will be used for verification. [Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method). Check the following fields in Method for results: - statusHandle - lifetimeMillis - data.identifier present for - Email OTP - SMS OTP | | statusCode | Server-specific status code that reports the success or failure of this operation. Integer. See *Response Status Codes* below for the status and error codes. | ### Response Status Codes The following are the descriptions of the Auth Server status codes returned by INIT_VERIFY. Under certain circumstances, the API Server returns an unsuccessful HTTP status code. Examples include an invalid request or invalid session. You can find descriptions of these in [API Server Status Codes](/dpoa/docs/s3suite94-rest-api-1#api-server-status-codes). | **Server Status Code** | **Description** | **Examples** | | --- | --- | --- | | 4005 | OK. Operation in progress. | Request has been created successfully. But the authentication methods are in AWAITING_USER_ACTION so it is in progress. | | 4401 | Operation expired | The user can't complete all the methods in the sequence within the time period specified by maxTimeAllowedInSeconds. This attribute is configured in the succeeding rule used for Adaptive Authentication. | | 4403 | PolicyVerificationException | One of the following occurred: - The requested ruleset is not available on Server. - The requested ruleset denied authentication. - None of the rules in the ruleset matched. | | 4404 | Internal Server Error | Internal server error. Failed to read from the database. Failed to connect to the database. Failed to read required properties. | | 4406 | Unacceptable content in request | The mandatory attribute, method, is missing or empty | | 4454 | Operation failed. | When the method processing fails with an error code. | ### Samples #### Sample Request URL ```plaintext https://www.example.com:8443/nnlgateway/nnl//auth ``` #### Sample Request ```plaintext {    "operation": "INIT_VERIFY",    "id": "uQB9W_swT4iPhqOU_6UlHA",    "method": {        "type": "Email OTP",        "name": "OTP Using Email",        "data": {            "identifier": "user@noknok.com"        }    } } ``` #### Sample Response ```plaintext {    "statusCode": 4005,    "id": "uQB9W_swT4iPhqOU_6UlHA",    "method": {        "type": "Email OTP",        "name": "OTP Using Email",        "state": "AWAITING_USER_ACTION",        "data": {            "identifier": "user@noknok.com"        },        "statusHandle": "ohhOQZ1Xa8HY4kJKy2mPEF90wNZJFMOc45iEkWE05YM",        "lifetimeMillis": 338677    } } ``` ## VERIFY Completes non-FIDO authentication method verification using the provided method data. If there are pending methods in the authentication sequence to process, VERIFY transitions the verification process to the next step. For the Photo ID method, VERIFY checks and returns the status of Photo ID verification from the Netverify service. VERIFY expects to receive data specific to the method in the method.data request attribute. Photo ID is the only exception. - Email OTP and SMS OTP: The one-time passcode that is sent to the end user. Assign to method.data.otp. - External Authentication method: The JWT sent by the RP Server that authenticated the end user. Assign to method.data.credential. For more details about method.data, see [Data Field Contents by Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#data-field-contents-by-authentication-method). VERIFY returns 4000 if authentication was successful and the method was the last one in the authentication sequence. Otherwise, if authentication is successful and there are pending methods, VERIFY returns 4005. ### Request | **Attribute** | **Description** | | --- | --- | | operation | Required. The string VERIFY. | | callerOrigin | Required if a web app is sending the request and that app has a different origin than the DigipassONE API Server. A web origin is defined by the scheme (protocol), host (domain), and port of the URL used to access it. The API Server checks if this origin is listed in its origin allow list, if not, the request is rejected. See [My Web Apps Have a Different Origin](/dpoa/docs/Operate_Configure_apps.html#my-web-client-apps-have-a-different-origin-than-the-api-server). | | locale | Optional. The Server uses locale, in subsequent calls to email OTP and SMS OTP, to tailor the end user's prompts to the language in the user’s profile. An IETF BCP 47 language tag string, like en-US. | | method | Required. Authentication method being verified. [Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method). method.data contains fields specific to the authentication method. See the description for VERIFY above. | | optionsData | Optional. An object used to pass additional attributes to REST API operations. See [OptionsData](/dpoa/docs/s3suite94-nok-nok-data-types-1#optionsdata) for a complete description. | | sessionData | Optional. An object containing the user's session information. See [SessionData](/dpoa/docs/s3suite94-nok-nok-data-types-1#sessiondata). If you send sessionData in the request to INIT_ADAPTIVE, you must also include it in the request to VERIFY. | ### Response The following attributes are always present in the JSON payload of the response. | **Attribute** | **Description** | | --- | --- | | id | The unique id that correlates different requests comprising an operation. A Base64-URL encoded string. If id was sent in the request, the same id is returned. If not, a server-generated ID is returned. If id was provided in the REST payload but the server was unable to parse the payload, the value is unknown. | | method | Result of method that was used for verification. [Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method). Check the following fields in Method for results: - statusHandle - data: Contains an identifier field with the following masked value: - Email OTP: The user's email address that receives the OTP - SMS OTP: The user's phone number that receives the OTP | | statusCode | Server-specific status code that reports the success or failure of this operation. Integer. See *Response Status Codes* below for the status and error codes. | The following attributes are present in the response upon a successful operation (Server status of 4000). | **Attribute** | **Description** | | --- | --- | | additionalInfo | An object containing information about the client app and device that is initiating authentication. See [AdditionalInfo](/dpoa/docs/s3suite94-nok-nok-data-types-1#additionalinfo). In order for the API Server to return this information, 1. The client app must have sent this information in the INIT_ADAPTIVE request message attribute. 2. Update the response filter configuration so the API Server returns the information you want. By default, the API Server automatically returns device information. Refer to [Response Filter Configuration](/dpoa/docs/s3suite94-main-1#response-filter-configuration). | | completedMethods | Contains the methods that were completed during the Adaptive Authentication. List<[Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method)> Present in the response when Adaptive Authentication is completed (statusCode = 4000). | | authSequences | Present when there are pending methods in the authentication sequence to complete verification. Map Not present when one of the following occurs: - The authentication method in the response completed verification. - None of the method combinations in the authentication sequence can be performed. This is based on the userName identified from the authentication method in the response. - The authentication method in the response has not reached a final state. Applies to FIDO OOB, SMS OTP, email OTP, Photo ID, and external authentication. | | claims | Returned if the successful Authentication Rule has claims defined for it and the user authenticated successfully using one of the rule's authentication sequences. Claims are an arbitrary name-value pair of information that the client wants returned on successful authentication, like "MariposaIndex: 55". Map Present in the response when Adaptive Authentication is completed (statusCode = 4000). | | ruleSetResult | ruleSetResult contains information about the Authentication Rule that succeeded such as its name and action. If ruleSetResult.action was TRIGGER_AUTHENTICATION, then it also contains the authentication sequence ID that the user successfully authenticated with. [AdaptiveRuleSetResult](/dpoa/docs/s3suite94-nok-nok-data-types-1#adaptiverulesetresult) | | sessionData | An object representing the authenticated user's session information. See [SessionData](/dpoa/docs/s3suite94-nok-nok-data-types-1#sessiondata). | | userNames | Contains a value when Quick Authentication is performed. The name(s) of the authenticated user(s). Set Contains a single username when Quick Authentication is performed for a built-in authentication method. In the future, this could be a list of users, if required by a custom authentication method. | ### Response Status Codes The following are the descriptions of the Auth Server status codes returned by VERIFY. Under certain circumstances, the API Server returns an unsuccessful HTTP status code. Examples include an invalid request or invalid session. You can find descriptions of these in [API Server Status Codes](/dpoa/docs/s3suite94-rest-api-1#api-server-status-codes). | **Server Status Code** | **Description** | **Examples** | | --- | --- | --- | | 4000 | OK. Operation completed | Request has been created successfully. | | 4002 | OK. Optional security checks failed | Failed to validate ChannelBinding | | 4005 | Operation in progress. | Request has been created successfully. Use Correlation ID (id returned from this operation) when retrying an authentication method if the state is failed or trying the next method as determined by the FIDO policy if the state is succeeded. | | 4401 | Operation expired | An operation expires when: - The user can't complete all the methods in the sequence within the time period specified by maxTimeAllowedInSeconds. This attribute is configured in the succeeding rule used for Adaptive Authentication. Based on id. - The user can't complete an authentication method (for example, the FIDO challenge expired or the OTP expired) before that method's expiry time. The expiry time is in the method's lifetimeMillis field. Based on statusHandle. | | 4402 | Security Exception | - sessionData.userName for the current method does not match the one used for previously authenticated methods. - There is an invalid method name or statusHandle in the request. ```json { "operation": "SETUP", "methods": [ { "type": "email", "name": "recoveryEmailOtp", "statusHandle":"wrong statusHandle" } ] } ``` | | 4403 | PolicyVerificationException | The user does not have any registered methods that can be used to complete authentication with the remaining methods in the authentication sequence. | | 4404 | Internal Server Error | Internal server error. Failed to read from the database. Failed to connect to the database. Failed to read required properties. | | 4406 | Unacceptable content in request | One or more mandatory attributes are missing. | | 4452 | Maximum attempts reached | maxRetriesAllowedPerMethod configured for the method was reached. For FIDO methods the retry count is restricted to 1 | ### Samples #### Sample Request URL ```plaintext https://www.example.com:8443/nnlgateway/nnl//auth ``` #### Sample Status Check Request ```plaintext {  "operation": "VERIFY",  "sessionData": {        "userName": "zsmith@noknok.com"    },  "method":    {    "name": "Using Email OTP",    "type": "Email OTP",    "statusHandle":"fvQGqIUNqnzdipfKNmsX4k2T1kKA855ZLSyCy3XfrHo"   } } ``` #### Sample Status Check Response ```plaintext {    "statusCode": 4005,    "id": "uQB9W_swT4iPhqOU_6UlHA",    "method": {        "type": "Email OTP",        "name": "OTP Using Email",        "state": "AWAITING_USER_ACTION",        "data": {            "identifier": "zsmith@noknok.com"        },        "statusHandle": "ohhOQZ1Xa8HY4kJKy2mPEF90wNZJFMOc45iEkWE05YM",        "lifetimeMillis": 338677    } } ``` #### Sample Request for Email OTP ```plaintext {    "operation": "VERIFY",    "method": {        "type": "Email OTP",        "name": "OTP Using Email",        "data": {            "otp": "88231"        },        "statusHandle": "ohhOQZ1Xa8HY4kJKy2mPEF90wNZJFMOc45iEkWE05YM"    } } ``` #### Sample Response for Email OTP ```plaintext {    "statusCode":4000,    "userNames":[        "zsmith@noknok.com"    ],    "method":{        "statusHandle":"fvQGqIUNqnzdipfKNmsX4k2T1kKA855ZLSyCy3XfrHo",        "data":{            "identifier":"zsmith@noknok.com"        },        "name":"OTP Using Email",        "state":"SUCCEEDED",        "type":"Email OTP"    },    "ruleSetResult":{        "action":"TRIGGER_AUTHENTICATION",        "ruleSetName":"adaptive",        "ruleName":"transactionAmountSmallAndroid",        "authSequenceId":"authSequence1",        "riskScore":20    },    "claims":{        "enable3DSBlob":"true",        "claim":"claimValue"    },    "id":"nuuGne-wLA388JzXRbioUw",    "sessionData":{        "sessionKey":""    } } ``` #### Sample Response for Photo ID While Jumio Server Still Processing ```plaintext {  "statusCode" : 4005,  "method" : {    "type" : "Photo ID",    "name" : "Using Photo ID",    "state" : "PENDING",    "statusHandle" : "a2V5aGFuZGxlAAAAAoLDtmKQ1puxov4oVlZETQiXzW05tZXbRPXND5L11-UZZStaELy3l75tqsJzLGMP4bEZqeOPNUc4PI40ODkwwftJlOQgAYBbBfUrCPDC"  } } ``` #### Sample Response for Photo ID When Successful ```plaintext {  "userNames" : [ "oob_uaf3" ],  "statusCode" : 4000,  "method" : {    "type" : "Photo ID",    "name" : "Using Photo ID",    "state" : "SUCCEEDED",    "data" : {"identifier":"DRIVING_LICENSE:FcdEC4Iar3YikQpHNW4_Ks5LJgLFBzIM_BZCh_4mpg0"},    "statusHandle" : "a2V5aGFuZGxlAAAAAorG6pQSEM1v5nnDu4gUvD2ZNKcc2SD_OgxoXrLDqrbj8XU6_GDdpKCB3_s9YN-No4krdw4L3oli-tSouOlFCJq0c6AuzRfjn54gA7D2"  },  "completedMethods" : [ {    "type" : "Photo ID",    "name" : "Using Photo ID",    "state" : "SUCCEEDED",    "data" : {"identifier":"DRIVING_LICENSE:FcdEC4Iar3YikQpHNW4_Ks5LJgLFBzIM_BZCh_4mpg0"},    "statusHandle" : "a2V5aGFuZGxlAAAAAorG6pQSEM1v5nnDu4gUvD2ZNKcc2SD_OgxoXrLDqrbj8XU6_GDdpKCB3_s9YN-No4krdw4L3oli-tSouOlFCJq0c6AuzRfjn54gA7D2"  } ],  "ruleSetResult" : {    "action" : "TRIGGER_AUTHENTICATION",    "ruleSetName" : "tutorial",    "ruleName" : "Default",    "authSequenceId" : "authenticationSequence_1638434966116",    "riskScore" : 0  },  "claims" : {    "enable3DSBlob" : "true"  } } ``` #### Sample Request for an External Authentication Method ```plaintext {    "operation": "VERIFY",    "method": {        "type": "External Auth",        "name": "Password-based External Auth",        "state": "PENDING",        "statusHandle": "UGHctLm3PmwjX_WMWKtosefpPZVn7TjKUBYQhqTdXQA",        "data": {            "credential": ""        }    } } ``` #### Sample Response for an External Authentication Method ```plaintext {    "userNames": [        "zsmith@noknok.com"    ],    "statusCode": 4000,    "id": "q9azQdpsAEBy3LpCVrVPow",    "method": {        "type": "External Auth",        "name": "Password-based External Auth",        "state": "SUCCEEDED",        "data": {            "userName": "zsmith@noknok.com"        },        "statusHandle": "a2V5aGFuZGxlAAAAAdNJi_CNF4"    },    "ruleSetResult": {        "action": "TRIGGER_AUTHENTICATION",        "ruleSetName": "Password-based External Auth",        "ruleName": "ExternalAuthRule",        "authSequenceId": "authenticationSequence_1",        "riskScore": 0    },    "claims": {        "enable3DSBlob": "false"    },    "sessionData": {        "sessionKey": ""    },    "additionalInfo": {} } ``` #### Sample Response for an External Authentication Method with Additional Pending Methods > A developer updated the response filter configuration so the API Server returns the FIDO protocol for the pending FIDO authentication method in additionalInfo. ```plaintext {  "statusCode":4005,  "additionalInfo":{},  "method":{    "type":"External Auth",    "name":"Password-based External Auth",    "state":"SUCCEEDED",    "data":{      "userName":"zsmith@noknok.com"    },    "statusHandle":"a2V5aGFuZGxlAAAAAXD"  },  "authSequences":{    "authenticationSequence_1657613813542":{      "methods":[        {          "type":"FIDO Auth",          "name":"auth",          "state":"PENDING",          "data":{            "message":"eyJzZXJ2ZXIiOnsibm5sRGF0YSI6ImEyVjVhR0Z1Wkd4bEFBQUFBUTB0NUp2V2xXWFo5THNGZUZfaGs1UVI4M3BKTWpIOHE2cDhab0ZNV2pIbV9KZnB4UURSN1hhQmdoRUUwQTY3ZV91QkZ4X1BRNmtjZnFVaFVUaHVBamtwVGltemtCanZ2OV9BbG1IYXFCMllodE5MeGYtSVAyYkUxLU53Z2RJSDFya00tSXBfbF9vVUYtcUpVWGR2cmUtMUs3ZVVVTi0ydENubXFRanJGNkg4UklMUk5qTExEb25OWHVfRWJfc3QzUjhscV9UbEZYMHgifSwicHJvdG9jb2xNZXNzYWdlIjoie1wib3B0aW9uc1wiOntcImNoYWxsZW5nZVwiOlwiMlZ2bmNDb3hheXJUWUE3eEt6MDZvcnYyQ1J6ZXU5U0xadk1maVJ6b0JoY1wiLFwidGltZW91dFwiOjMwMDAwMCxcInJwSWRcIjpcImxvY2FsLm5va25va3Rlc3QuY29tXCIsXCJhbGxvd0NyZWRlbnRpYWxzXCI6W3tcInR5cGVcIjpcInB1YmxpYy1rZXlcIixcImlkXCI6XCI1Y09pNFM1alU3WlJzSEpSd3o2ZEllZ0REYmE0ckVVU3JnSkZCUWRGZjZjXCJ9XSxcInVzZXJWZXJpZmljYXRpb25cIjpcInJlcXVpcmVkXCJ9LFwic2VydmVyRGF0YVwiOlwiYTJWNWFHRnVaR3hsQUFBQUFSbHZRTDBMdjBVYUc4NEMwY3BueFBnajBrLXhEdlFYOUZ1MlV1aVVVVkJMRWQyZExHQUwyODF2a1dYRWJjWlp0YzB6b3RhSDlXS2RzNnNHU2p3Q2luT0VOSU9HRXNuak50WkZLaHg2YkxRWW9FYkhNa3M0WFFrX2ZieWQ4c0pDSUdDejk2OUtPeU9jVlNHWGY2ZGI3azdMXCJ9IiwiZXh0ZW5zaW9ucyI6W3siaWQiOiJub2tub2sudWFmLmxvY2F0aW9uIiwiZGF0YSI6IiIsImZhaWxfaWZfdW5rbm93biI6ZmFsc2V9XSwicmVnVXNlZE9uVGhpc0RldmljZSI6dHJ1ZSwidmVyc2lvbiI6IjEuMCIsIm9wZXJhdGlvbiI6IklOSVRfQVVUSCIsInByb3RvY29sIjoid2ViXzEuMCJ9",            "additionalInfo":{              "protocol":"web_1.0"            }          },          "statusHandle":"a2V5aGFuZGxlAAAAAXD",          "lifetimeMillis":300000        }      ]    }  } } ``` ## CANCEL_VERIFY Cancels verification of the provided method. Authentication fails when this happens. ### Request | **Attribute** | **Description** | | --- | --- | | operation | Required. The string CANCEL_VERIFY. | | callerOrigin | Required if a web app is sending the request and that app has a different origin than the DigipassONE API Server. A web origin is defined by the scheme (protocol), host (domain), and port of the URL used to access it. The API Server checks if this origin is listed in its origin allow list, if not, the request is rejected. See [My Web Apps Have a Different Origin](/dpoa/docs/s3suite94-my-web-client-apps-have-a-different-origin-than-the-api-server-1). | | locale | Optional. The Server uses locale to tailor the end user's prompts to the language in the user’s profile. An IETF BCP 47 language tag string, like en-US. | | method | Required. The method whose authentication is being cancelled. [Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method). | | optionsData | Optional. An object used to pass additional attributes to REST API operations. See [OptionsData](/dpoa/docs/s3suite94-nok-nok-data-types-1#optionsdata) for a complete description. | | sessionData | Optional. An object containing the user's session information. See [SessionData](/dpoa/docs/s3suite94-nok-nok-data-types-1#sessiondata). If you send sessionData in the request to INIT_ADAPTIVE, you must also include it in the request to VERIFY. | ### Response The following attributes are always present in the JSON payload of the response. | **Attribute** | **Description** | | --- | --- | | id | The unique id that correlates different requests comprising an operation. A Base64-URL encoded string. If id was sent in the request, the same id is returned. If not, a server-generated ID is returned. If id was provided in the REST payload but the server was unable to parse the payload, the value is unknown. | | method | Result of method that was used for verification. [Authentication Method](/dpoa/docs/s3suite94-nok-nok-data-types-1#authentication-method). Check the following fields in Method for results: - statusHandle - state | | statusCode | Server-specific status code that reports the success or failure of this operation. Integer. See *Response Status Codes* below for the status and error codes. | ### Response Status Codes The following are the descriptions of the Auth Server status codes returned by CANCEL_VERIFY. Under certain circumstances, the API Server returns an unsuccessful HTTP status code. Examples include an invalid request or invalid session. You can find descriptions of these in [API Server Status Codes](/dpoa/docs/s3suite94-rest-api-1#api-server-status-codes). | **Server Status Code** | **Description** | **Examples** | | --- | --- | --- | | 4000 | OK. Operation completed | The authentication method was successfully cancelled. | | 4401 | Operation expired | An operation expires when: - The user can't complete all the methods in the sequence within the time period specified by maxTimeAllowedInSeconds. This attribute is configured in the succeeding rule used for Adaptive Authentication. Based on id. - The user can't complete an authentication method (for example, the FIDO challenge expired or the OTP expired) before that method's expiry time. The expiry time is in the method's lifetimeMillis field. Based on statusHandle. | | 4402 | Security exception | The wrong value was entered for statushandle. | | 4404 | Internal Server Error | Internal server error. Failed to read from the database. Failed to connect to the database. Failed to read required properties. | | 4406 | Unacceptable content in the request | One or more of the following mandatory attributes are missing: - method - type - name - statushandle | ### Samples #### Sample Request URL ```plaintext https://www.example.com:8443/nnlgateway/nnl//auth ``` #### Sample Request ```plaintext {  "operation": "CANCEL_VERIFY",  "sessionData": {        "userName":"zsmith@noknok.com"   },  "method": {     "name": "OTP Using Email",     "type": "Email OTP",     "statusHandle":""   } } ``` #### Sample Response ```plaintext {    "statusCode":4000,    "method":{        "statusHandle":"tfLnOBlRPjxu9xeg-9qW5QVmC5vYvcctYz1ahqsov4Q",        "data":{            "identifier":"zsmith@noknok.com"        },        "name":"OTP Using Email",        "state":"CANCELLED",        "type":"Email OTP"    },    "id":"MM9nX2ZEQCE07ka1YczF1A" } ``` Formerly known as Digipass S3.