> ## Documentation Index
> Fetch the complete documentation index at: https://docs.braintest.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a Standalone Test Profile via SMS

> Complete SMS-based standalone test authentication by submitting the draft token and the code the participant received.

Use this endpoint to finish authenticating a participant profile when the organizer setting `tests_auth_required` is `true`. It exchanges the `draft_token` from `POST /record/{token}/auth/` plus the SMS code the participant received for the final profile.

<Note>
  Only call this endpoint when `tests_auth_required` is `true` on the record. If the setting is disabled, the auth call already returns the profile and this endpoint returns a 400 error.
</Note>

## Endpoint

```http theme={"dark"}
PUT https://braintest.ir/api/v2/record/{token}/auth/verify/
```

## Headers

| Header         | Value                                 |
| -------------- | ------------------------------------- |
| `API-KEY`      | Your API key from the organizer panel |
| `Content-Type` | `application/json`                    |

## Path parameters

<ParamField path="token" type="string" required>
  The UUID token of the test record.
</ParamField>

## Body parameters

<ParamField body="draft_token" type="string" required>
  The `draft_token` returned by `POST /record/{token}/auth/`. Valid for 5 minutes.
</ParamField>

<ParamField body="vcode" type="string" required>
  The SMS verification code the participant received on their mobile number.
</ParamField>

## Response

<ResponseField name="data.tests_auth_required" type="boolean">
  Echoes the organizer setting. Always `true` when this endpoint succeeds.
</ResponseField>

<ResponseField name="data.profile" type="object">
  The authenticated profile with `token`, `external_id`, `case_number`, `mobile`, `name`, `age`, `birth`, and `is_male`.
</ResponseField>

## Example request

```bash theme={"dark"}
curl -X PUT "https://braintest.ir/api/v2/record/a1b2c3d4-e5f6-7890-abcd-ef1234567890/auth/verify/" \
  -H "API-KEY: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "draft_token": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
    "vcode": "58291"
  }'
```

## Example response

```json theme={"dark"}
{
  "data": {
    "tests_auth_required": true,
    "profile": {
      "token": "f1e2d3c4-b5a6-7890-abcd-ef0987654321",
      "external_id": 10042,
      "case_number": "ORG-00001",
      "mobile": "09123456789",
      "name": "Ali Rezaei",
      "age": 28,
      "birth": "1998-01-15",
      "is_male": true
    }
  },
  "successful": true,
  "messages": []
}
```

## Error responses

| Status | Message                                                        | Cause                                                                                                       |
| ------ | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| `400`  | `Verification draft token is invalid or expired.`              | The draft token is unknown or older than 5 minutes. Restart the flow with `POST /record/{token}/auth/`.     |
| `400`  | `Verification code is invalid.`                                | The `vcode` does not match the code sent via SMS. Have the participant re-enter it.                         |
| `400`  | `SMS verification is not required for this organizer account.` | The organizer setting `tests_auth_required` is `false`. Use the profile returned by the auth call directly. |
| `429`  | API rate limit exceeded                                        | Wait and retry. See [Rate Limits](/reference/rate-limits).                                                  |