> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scripxhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a firm

> API-driven verification of a client firm on ScripX: submit the firm's customs-account credentials under its mandate, then complete with the one-time authorization code sent to the firm.

Verifies the firm's customs account. Your platform collects the firm's credentials **in its own UI under the firm's explicit mandate** (see [API terms](/api-terms)) and submits them here; ScripX runs the verification and returns only the outcome.

One verification attempt per call, deliberately: verification attempts are strictly rate-limited, so batch retries buy nothing. The password is handed straight through for the attempt; it is **never stored and never echoed**, on our side or in any response.

Two outcomes:

* `connected`, done in one step.
* `verification_pending` with `next: "authorize"`, a **one-time authorization code** went to the firm's registered email and mobile; finish with [authorize](/api-reference/firms/authorize).

### Request example

```bash theme={"dark"}
curl -X POST "https://api.scripxhq.com/v1/firms/0512345678/verify" \
  -H "X-ScripX-Key: <YOUR_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"registration_id": "acmexports", "password": "<FIRM_SUPPLIED>"}'
```

### Response example

```json theme={"dark"}
{
  "firm": {
    "iec": "0512345678",
    "name": "Acme Exports Pvt Ltd",
    "state": "verification_pending"
  },
  "next": "authorize",
  "authorization": {
    "sent_to": "the firm's registered email and mobile"
  }
}
```

<Note>
  In [sandbox](/environments) the flow simulates end to end: verify always returns `verification_pending`, and any 6-digit code completes it. Same shapes as production, no real account touched.
</Note>

### Errors

* `422 unprocessable`, missing `registration_id` or `password`.
* `404 not_found`, the firm is not registered on your desk ([register first](/api-reference/firms/create)).
* Wrong credentials surface as an error message; the state does not advance. Never loop retries, ask the firm to re-enter.

**Terms used here:** [IEC](/annexure/terminology#iec), [connection state](/annexure/terminology#connection-state), [batch](/annexure/terminology#batch), [API key](/annexure/terminology#api-key). Full list in the [terminology annexure](/annexure/terminology).

### Next steps

* [Authorize](/api-reference/firms/authorize) with the code the firm received.
* [Get the firm](/api-reference/firms/get) any time for the current state.


## OpenAPI

````yaml POST /v1/firms/{iec}/verify
openapi: 3.1.0
info:
  title: ScripX Partner API
  version: 1.2.0
  description: >-
    Automate duty-credit-scrip trading: quote, order, positions, market,
    webhooks. Auth: `X-ScripX-Key: scripx_live_…`. Money = integer paise; price
    = bps of face.
  contact:
    name: ScripX API Support
    email: amin@eximfiles.io
    url: https://scripxhq.com
servers:
  - url: https://api.scripxhq.com
    description: >-
      Production and sandbox share one host; a scripx_test_ key selects the
      sandbox.
security:
  - ApiKeyAuth: []
tags:
  - name: Firms
    description: >-
      client-firm lifecycle: register, verify, authorize, credits, update,
      offboard
  - name: Trading
    description: quote, orders, positions, market
  - name: Group
    description: intra-group netting + positions (enterprise/broker)
  - name: Cross
    description: 'broker cross-desk: block deals + intra-group transfers'
  - name: Webhooks
    description: event subscriptions + delivery
  - name: Account
    description: usage + metering
  - name: Keys
    description: self-serve scoped child keys (sub-accounts)
paths:
  /v1/firms/{iec}/verify:
    post:
      tags:
        - Firms
      summary: Verify the firm's customs account (API-driven; one attempt per call)
      parameters:
        - name: iec
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FirmVerifyRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FirmVerifyResult'
        '401':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '429':
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - ApiKeyAuth: []
components:
  schemas:
    FirmVerifyRequest:
      type: object
      required:
        - registration_id
        - password
      properties:
        registration_id:
          type: string
          description: the firm's customs-account id
        password:
          type: string
          format: password
          description: handed straight through for verification; never stored, never echoed
      description: >-
        Submit only under the firm's explicit mandate. One verification attempt
        per call.
    FirmVerifyResult:
      type: object
      properties:
        firm:
          $ref: '#/components/schemas/Firm'
        next:
          type:
            - string
            - 'null'
          enum:
            - authorize
            - null
          description: authorize → finish with POST /v1/firms/{iec}/authorize
        authorization:
          type: object
          properties:
            sent_to:
              type: string
    Error:
      type: object
      properties:
        error:
          type: string
        code:
          type: string
          description: stable machine code
          enum:
            - bad_request
            - unauthorized
            - forbidden
            - not_found
            - conflict
            - unprocessable
            - rate_limited
            - internal
        message:
          type: string
        detail:
          type: object
    Firm:
      type: object
      properties:
        iec:
          type: string
        name:
          type: string
        email:
          type: string
        role:
          type: string
          enum:
            - exporter
            - importer
        state:
          type: string
          enum:
            - registered
            - connecting
            - verification_pending
            - connected
            - attention_needed
            - reconnect_needed
        created_at:
          type: string
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-ScripX-Key
      description: >-
        Your API key, e.g. `scripx_live_…`. Bound to one firm; tenant isolation
        is enforced.

````