To complete the MFA action, the flow service calls the POST /{environmentId}/flows/{flowId} endpoint operation and uses the application/vnd.pingidentity.otp.check+json custom media type in the Content-type HTTP request header to identify the action.

The action asks for a value for the otp value, which was sent in a text message to the user’s mobile phone. If provided, the otp.check action verifies the one-time passcode and completes the flow.