# Verify a PIN

Verifies a PIN challenge when calling a SCA-secured endpoint. Make sure to [create a PIN](/api-reference/sca-pin/scapincreate) before using this endpoint.
The request and response are encrypted using the JOSE framework. Please refer to the [SCA over API guide](/guides/developer/auth-and-security/sca-over-api) to understand how encryption and decryption work.

Endpoint: POST /profiles/{profileId}/pin/verify
Security: UserToken

## Path parameters:

  - `profileId` (integer, required)
    The profile ID.

## Header parameters:

  - `One-Time-Token` (string, required)
    A one-time token unique identifier.

  - `Accept` (string, required)

  - `Accept-Encoding` (string, required)

  - `Content-Encoding` (string, required)

  - `X-tw-jose-method` (string, required)

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Response 200 fields (application/json):

  - `oneTimeToken` (string)
    A one-time token unique identifier.
    Example: 5932d5b5-ec13-452f-8688-308feade7834

  - `challenges` (array)
    An array of challenges.

  - `challenges.primaryChallenge` (object)

  - `challenges.primaryChallenge.type` (string)
    A type of challenge.
    Example: PIN

  - `challenges.passed` (boolean)
    The status of a challenge.
    Example: false

  - `validity` (integer)
    The One-Time Token expiration in seconds.
    Example: 3600