> ## Documentation Index > Fetch the complete documentation index at: https://docs.qa.esectra.com/llms.txt > Use this file to discover all available pages before exploring further. # Handles `POST /v1/verifications/result-codes/exchange`. > Spends the code atomically and answers with the session's result. The code is bound to the caller's tenant: another tenant's code is unknown, not expired or spent. Every presentation is recorded, without the code. # Errors `401`, `403` without `VERIFICATIONS_READ`, `404 RESULT_CODE_INVALID` for an unknown code, `409 RESULT_CODE_CONSUMED` for one already exchanged, `410 RESULT_CODE_EXPIRED`, `503` when a store cannot be reached. ## OpenAPI ````yaml /openapi.json post /v1/verifications/result-codes/exchange openapi: 3.1.0 info: title: Esectra API description: >- Transaction screening, identity verification, and wallet risk. Every create route accepts `Idempotency-Key`; replaying one returns the original record with `200` where the first call returned `201`. `POST /v1/transactions` requires the header, because a duplicated transaction is a duplicated financial record. license: name: proprietary identifier: proprietary version: 0.1.0 servers: [] security: [] paths: /v1/verifications/result-codes/exchange: post: tags: - Verifications summary: Handles `POST /v1/verifications/result-codes/exchange`. description: |- Spends the code atomically and answers with the session's result. The code is bound to the caller's tenant: another tenant's code is unknown, not expired or spent. Every presentation is recorded, without the code. # Errors `401`, `403` without `VERIFICATIONS_READ`, `404 RESULT_CODE_INVALID` for an unknown code, `409 RESULT_CODE_CONSUMED` for one already exchanged, `410 RESULT_CODE_EXPIRED`, `503` when a store cannot be reached. operationId: exchange_handler requestBody: content: application/json: schema: $ref: '#/components/schemas/ExchangeBody' required: true responses: '200': description: The session's result; the code is now spent content: application/json: schema: $ref: '#/components/schemas/SessionResultBody' '401': description: No usable credentials '403': description: The caller does not hold VERIFICATIONS_READ '404': description: No such code for this tenant '409': description: The code was already exchanged '410': description: The code has expired; read the session by id instead '503': description: A backing store could not be reached security: - api_key: [] - session_cookie: [] components: schemas: ExchangeBody: type: object description: A code presented for exchange. required: - code properties: code: type: string description: The `code` from the return redirect. SessionResultBody: type: object description: A hosted session's result, as the customer may read it. required: - verification_session_id - subject_id - status - intent - reasons - checks - created_at properties: checks: type: array items: $ref: '#/components/schemas/ResultCheckBody' description: |- Per-check results so far, worded from the check's kind, outcome and reason code; never from stored text. completed_at: type: - string - 'null' description: RFC 3339 completion time, once concluded. created_at: type: string description: RFC 3339 opening time. decision: oneOf: - type: 'null' - $ref: '#/components/schemas/Decision' description: Its outcome. decision_id: type: - string - 'null' description: The decision, once there is one. flow: oneOf: - type: 'null' - $ref: '#/components/schemas/SessionFlowBody' description: The flow the session ran under, when one was named. intent: type: string description: '`FIRST_TIME` or `REVERIFICATION`.' reasons: type: array items: $ref: '#/components/schemas/HostedSessionReason' description: |- Why, as stable codes with customer-safe wording. A stored code this build does not describe is `UNSPECIFIED`. review_case_id: type: - string - 'null' description: The review case, when the outcome needs a person. risk_level: oneOf: - type: 'null' - $ref: '#/components/schemas/RiskLevel' description: Its risk level. status: type: string description: '`PENDING`, `PASSED`, `REVIEW_REQUIRED`, `FAILED` or `EXPIRED`.' subject_id: type: string description: The person, as the customer identified them. verification_session_id: type: string description: Session identifier. ResultCheckBody: type: object description: One check, as the customer may read it. required: - check - outcome - reason_code - detail properties: check: type: string description: Which check. detail: type: string description: Customer-safe wording. outcome: type: string description: '`PASS`, `REVIEW`, `FAIL`, `ERRORED`, `SKIPPED` or `PENDING`.' reason_code: type: string description: Stable reason code from the closed vocabulary, or `UNSPECIFIED`. Decision: type: string description: Decision emitted by an automated or human-assisted workflow. enum: - ALLOW - WARN - BLOCK - HOLD - REVIEW_REQUIRED - FLAG - BLOCK_RECOMMENDED - SUSPEND - END_STREAM SessionFlowBody: type: object description: The flow a session was opened under, as a customer sees it. required: - flow_id - revision - flow_type properties: flow_id: type: string description: Flow identifier. flow_type: $ref: '#/components/schemas/FlowType' description: |- `BIOMETRIC`, `DOCUMENT` or `FULL_IDENTITY`. A `BIOMETRIC` outcome proves presence, not identity. revision: type: integer format: int32 description: The revision frozen into the session. minimum: 0 HostedSessionReason: type: object description: |- Why the decision was what it was. The code is the decision store's, when it is one this module knows; the message is this module's own wording for it. The stored message is never repeated, because the fusion writes check detail into it. required: - code - message properties: code: type: string description: >- Stable reason code, or `UNSPECIFIED` for one this module does not know. message: type: string description: Customer-safe wording of that code. RiskLevel: type: string description: Explainable risk level. enum: - LOW - MEDIUM - HIGH - CRITICAL FlowType: type: string description: Which journey a flow describes. enum: - BIOMETRIC - DOCUMENT - FULL_IDENTITY securitySchemes: api_key: type: http scheme: bearer description: >- A tenant API key. Acts for exactly one tenant and cannot conclude a case, because a conclusion records a person. session_cookie: type: apiKey in: cookie name: esectra_session description: >- A signed-in reviewer's session. httpOnly and SameSite=Lax; set by `POST /v1/control/sessions` and only usable once the second factor is met. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.