# Verify a facemap

Verifies a facemap challenge when calling a SCA-secured endpoint. Make sure to [create a facemap](/api-reference/legacy/sca-facemaps/scafacemapcreate) before using this endpoint.
A facemap should be exported from your FaceTec server using the SDK's [export API](https://dev.facetec.com/api-guide#export-3d-facemap). Please use Wise's FaceTec [public key](/api-reference/legacy/facetec/facetecpublickeyget) to encrypt a facemap during the export process.

Endpoint: POST /v2/profiles/{profileId}/facemaps/verify
Security: UserToken

## Security:

  - `UserToken` (unknown)
    http bearer JWT

## Path parameters:

  - `profileId` (integer, required)
    The profile ID.

## Header parameters:

  - `One-Time-Token` (string, required)
    A one-time token unique identifier.

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/json):

  - `faceMap` (string)
    A base64 encoded string.

## Response 200:

  - `200` (unknown)
    The facemap has been successfully verified.

## Response 200 fields (application/json):

  - `oneTimeToken` (string)
    A one-time token unique identifier.
    Example: 5932d5b5-ec13-452f-8688-308feade7834

  - `challenges` (array)
    An array of challenges.

  - `challenges.primaryChallenge` (object)

  - `challenges.primaryChallenge.type` (string)
    A type of challenge.
    Example: PIN

  - `challenges.passed` (boolean)
    The status of a challenge.
    Example: false

  - `validity` (integer)
    The One-Time Token expiration in seconds.
    Example: 3600

## Response 200 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 400:

  - `400` (unknown)
    The facemap verification failed.

## Response 400 headers:

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 429:

  - `429` (unknown)
    Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Number of seconds to wait before retrying the request.
    Example: 5

  - `X-Rate-Limited-By` (string)
    Identifies the rate limiter that triggered the 429 response.
    Example: wise-public-api

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f