> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pcibooking.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Contact Verification

> Verify that a contact's email and phone number are valid and reachable using OTP.

Contact Verification lets you confirm that the email address and phone number you have on file for a contact are valid, reachable, and controlled by the same person. PCI Booking handles the entire verification flow: sending the email, hosting the verification page, and delivering the OTP via SMS or voice call.

This is the same two-factor mechanism used by [Card Display with OTP](/use-tokens/card-display-otp), offered standalone - no card is involved.

## Use Cases

* **Validating newly submitted details.** When a hotel, partner, or end user submits contact details through a self-service portal, trigger a verification to confirm they are correct before storing them.
* **Periodic re-verification.** Contact details can become outdated without notice. Periodically re-verify stored details to detect stale information and prompt the contact to update their records.
* **Verifying a recipient before sending sensitive material.** Confirm the recipient controls both the email address and the phone number before you rely on those channels for anything sensitive.

## How It Works

1. **You create a verification request.** Call the [Create a Verification](/api-reference/additional/create-verification) endpoint with the contact's email, phone number, and name. You can optionally set an expiration time, language, callback URL, and metadata.

2. **PCI Booking sends an email.** The contact receives an email with a greeting and a secure link. The link expires after the time you specified (default: 10 minutes).

3. **The contact verifies their phone number.** When they click the link, PCI Booking shows a hosted page displaying the **last four digits of the phone number on file** as a hint. The contact enters the full phone number - it must match the number you provided in the verification request - and receives a 6-digit OTP via SMS or voice call. The OTP expires in 10 minutes.

4. **Verification completes.** After entering the correct code, the session status changes to `Verified`. If the code is wrong or the link expires, the status becomes `Failed` or `Expired`.

## Checking Results

You have two options for getting the verification outcome:

### Polling

Call [Get Verification Status](/api-reference/additional/get-verification-status) to check whether the session is still in progress (`Pending`, `OtpSent`) or has reached a terminal state (`Verified`, `Failed`, `Expired`). Once terminal, call [Get Verification Results](/api-reference/additional/get-verification-results) for the full outcome.

### Callback

If you provided a `callbackUrl` when creating the verification, PCI Booking sends a POST request to that URL when the session reaches a terminal state. The payload contains the session ID, final status, completion time, and your metadata. See [Receive Result Notification](/api-reference/additional/receive-result-notification) for the payload format.

<Info>
  Callback delivery is best-effort. If your endpoint is unreachable, the failure is logged but does not affect the verification outcome. Use polling as a fallback.
</Info>

## Verification Statuses

| Status | Description |
| - | - |
| `Pending` | The verification was created but the contact has not yet clicked the link. |
| `OtpSent` | The contact clicked the link and an OTP was sent to their phone. |
| `Verified` | The contact successfully entered the correct OTP. |
| `Failed` | The verification failed (wrong code, too many attempts, etc.). |
| `Expired` | The verification link expired before the contact completed the process. |

## Security

* Each OTP is a single-use 6-digit code, hashed and salted before storage. PCI Booking does not retain the plain-text code.
* Two-factor verification (email link + phone OTP) ensures the contact controls both channels.
* Verification links are time-limited and single-use.

## Next Steps

<CardGroup cols={2}>
  <Card title="Create a Verification" icon="code" href="/api-reference/additional/create-verification">
    Initiate a new contact verification request.
  </Card>

  <Card title="Get Verification Status" icon="code" href="/api-reference/additional/get-verification-status">
    Check if a verification is still pending or complete.
  </Card>

  <Card title="Get Verification Results" icon="code" href="/api-reference/additional/get-verification-results">
    Retrieve the full outcome of a completed verification.
  </Card>

  <Card title="Receive Result Notification" icon="code" href="/api-reference/additional/receive-result-notification">
    Callback payload format for automated processing.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.