> ## Documentation Index
> Fetch the complete documentation index at: https://hmis-docs.derrickmugabwa.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a patient OTP

> Verifies the challenge once and issues a device-bound Sanctum token. Shared phone numbers require patient number and date of birth.



## OpenAPI

````yaml /openapi-patient.yaml post /patient/auth/otp/verify
openapi: 3.1.0
info:
  title: HMIS Patient Mobile API
  version: 1.0.0
  description: >-
    Patient-owned authentication, appointment, clinical record, and billing
    operations.
servers:
  - url: https://jaliprohmis.derrickmugabwa.dev/api/v1
    description: HMIS staging API
security:
  - bearerAuth: []
tags:
  - name: Patient authentication
  - name: Patient profile
  - name: Patient appointments
  - name: Patient records
  - name: Patient billing
paths:
  /patient/auth/otp/verify:
    post:
      tags:
        - Patient authentication
      summary: Verify a patient OTP
      description: >-
        Verifies the challenge once and issues a device-bound Sanctum token.
        Shared phone numbers require patient number and date of birth.
      operationId: verifyPatientOtp
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OtpVerifyRequest'
      responses:
        '200':
          $ref: '#/components/responses/TokenIssued'
        '422':
          $ref: '#/components/responses/ValidationError'
        '429':
          $ref: '#/components/responses/RateLimited'
      security: []
components:
  schemas:
    OtpVerifyRequest:
      type: object
      required:
        - challenge_id
        - phone
        - code
        - device_name
      properties:
        challenge_id:
          type: string
        phone:
          type: string
          example: '0712345678'
        code:
          type: string
          pattern: ^\d{6}$
          example: '123456'
        device_name:
          type: string
          maxLength: 100
          example: Derrick Android
        patient_number:
          type:
            - string
            - 'null'
          description: Required with date_of_birth when the phone is shared.
        date_of_birth:
          type:
            - string
            - 'null'
          format: date
    TokenResponse:
      type: object
      properties:
        token_type:
          const: Bearer
        access_token:
          type: string
        expires_at:
          type: string
          format: date-time
        patient:
          type: object
          additionalProperties: true
  responses:
    TokenIssued:
      description: Patient device token issued.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TokenResponse'
    ValidationError:
      description: Request validation failed.
    RateLimited:
      description: Too many requests.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: Sanctum patient device token

````