Skip to main content
Contact Verification lets you confirm that the email address and phone number you have on file for a contact are valid, reachable, and controlled by the same person. PCI Booking handles the entire verification flow: sending the email, hosting the verification page, and delivering the OTP via SMS or voice call. This is the same two-factor mechanism used by Card Display with OTP, offered standalone - no card is involved.

​
Use Cases

  • Validating newly submitted details. When a hotel, partner, or end user submits contact details through a self-service portal, trigger a verification to confirm they are correct before storing them.
  • Periodic re-verification. Contact details can become outdated without notice. Periodically re-verify stored details to detect stale information and prompt the contact to update their records.
  • Verifying a recipient before sending sensitive material. Confirm the recipient controls both the email address and the phone number before you rely on those channels for anything sensitive.

​
How It Works

  1. You create a verification request. Call the Create a Verification endpoint with the contact’s email, phone number, and name. You can optionally set an expiration time, language, callback URL, and metadata.
  2. PCI Booking sends an email. The contact receives an email with a greeting and a secure link. The link expires after the time you specified (default: 10 minutes).
  3. The contact verifies their phone number. When they click the link, PCI Booking shows a hosted page displaying the last four digits of the phone number on file as a hint. The contact enters the full phone number - it must match the number you provided in the verification request - and receives a 6-digit OTP via SMS or voice call. The OTP expires in 10 minutes.
  4. Verification completes. After entering the correct code, the session status changes to Verified. If the code is wrong or the link expires, the status becomes Failed or Expired.

​
Checking Results

You have two options for getting the verification outcome:

​
Polling

Call Get Verification Status to check whether the session is still in progress (Pending, OtpSent) or has reached a terminal state (Verified, Failed, Expired). Once terminal, call Get Verification Results for the full outcome.

​
Callback

If you provided a callbackUrl when creating the verification, PCI Booking sends a POST request to that URL when the session reaches a terminal state. The payload contains the session ID, final status, completion time, and your metadata. See Receive Result Notification for the payload format.
Callback delivery is best-effort. If your endpoint is unreachable, the failure is logged but does not affect the verification outcome. Use polling as a fallback.

​
Verification Statuses

​
Security

  • Each OTP is a single-use 6-digit code, hashed and salted before storage. PCI Booking does not retain the plain-text code.
  • Two-factor verification (email link + phone OTP) ensures the contact controls both channels.
  • Verification links are time-limited and single-use.

​
Next Steps

Create a Verification

Initiate a new contact verification request.

Get Verification Status

Check if a verification is still pending or complete.

Get Verification Results

Retrieve the full outcome of a completed verification.

Receive Result Notification

Callback payload format for automated processing.