Universal Security Verification

POST /api/verify

Performs a universal security verification for the current user (via 2FA or Passkey). On success, a verification timestamp is stored in the session, and the verification status and expiry are returned, used for step-up checks before sensitive operations.

Authentication

User console endpoint. Requires a logged-in user identity (session Cookie, or Authorization: Bearer <access_token>). This token is different from the sk- key used for model calls.

Request Body

Parameter	Type	Required	Description
method	string	Required	Verification method: 2fa or passkey
code	string	Optional	Verification code; required when method=2fa

Passkey verification

Before using the passkey method, first complete the Passkey Verify Begin and Passkey Verify Finish flows.

Request Example

{
  "method": "2fa",
  "code": "123456"
}

Response Fields（200）

Field Name	Type	Description
success	boolean	Whether the request succeeded
message	string	Message; 验证成功 on success
data	object	Verification result
data.verified	boolean	Whether verification passed
data.expires_at	integer	Verification expiry time (Unix timestamp, seconds)

Response Example

{
  "success": true,
  "message": "验证成功",
  "data": {
    "verified": true,
    "expires_at": 1735689600
  }
}