Verify an approval OTP

POST /approvals/otp/verify

Exchanges the code the approver received for an approval_token, with the same rules as POST /approvals/pin. This call takes no Idempotency-Key.

Status	Code	When
400	`VALIDATION_FAILED`	The body is not valid.
400	`USER_ID_REQUIRED`	`X-User-ID` is missing.
403	`OTP_INVALID`	A wrong code; see `data.attempts_remaining`.
403	`OTP_EXPIRED`	The code expired, or the `request_id` is unknown or belongs to another user.
403	`PERMISSION_DENIED`	The acting user may not do this.
403	`OUTLET_FORBIDDEN`	The outlet is not allowed.
409	`PIN_LOCKED`	The shared lock is on; see `data.unlock_at`.
409	`SHIFT_NOT_OPEN`	The acting user has no open shift.
422	`INVALID_USER`	The acting user is not valid.

Request

The approval grant