# Identity Verification (Digital Identity Trust + Customer OTP)

.sc-doc-table table { table-layout: auto; width: 100%; }
table th, table td { word-break: keep-all; overflow-wrap: normal; padding: 8px 14px; vertical-align: top; }
table th:first-child, table td:first-child { white-space: nowrap; }
table td code, table th code { white-space: nowrap; }
DIT identity check, then **your** application performs the OTP step using your own SMS or email infrastructure. Your backend confirms the result with `POST /direct/verify-user` so the user can be enrolled; `POST /users/begin-enrollment` fails with `SC358` until it does.
Learn more: [Identity Verification](/client-spec/products#identity-verification).
You can find test cases [here](/client-spec/test-cases#dit-customer-otp).
![Digital Identity Trust + Customer OTP flow](https://efx-dev.stitchcredit.com/api/DIT_Customer_OTP.png)

 - [POST /direct/login](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/login.md): Authenticates a customer host using API key and secret credentials, returning a JWT access token and a refresh token. The access token must be included as a Bearer token in the `Authorization` header
 - [POST /direct/user-reg](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/register.md): Registers a new user under the authenticated host and returns the user data. **Requirements:** Email must be unique within the host. **Dormant users.** If dormant enrollment is enabled for your accoun
 - [GET /direct/preauth-token/{id}](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/preauthtoken_1.md): Generates a short-lived pre-auth token for the specified user. **Parameters:** The `{id}` path parameter is the user's unique identifier (UUID). **Flow:** The returned token is used to establish a use
 - [GET /users/preauth-token/{preauthToken}](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/exchangepreauthtoken.md): Exchanges a pre-auth `{preauthToken}` for a full user session. This is how to obtain the `userToken` used for all `/users/*` endpoints. Returns the user profile along with JWT access and refresh token
 - [POST /users/dit-identity](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/postditverifyidentity.md): Submits personal identity information (name, SSN, DOB, address) for Digital Identity Trust verification. **Flow:** On success, returns a session `token`. The next step depends on the customer's verifi
 - [POST /direct/verify-user](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/confirmuserverification.md): Records that the customer has independently verified a user's identity (Digital Identity Trust + Customer OTP flow). **Requirements:** - The user must be active - The user must belong to the host asso
 - [POST /users/begin-enrollment/{smfaToken}](https://crsintegration.redocly.app/client-spec/identity-verification-(digital-identity-trust-+-customer-otp)/beginenrollment.md): Initiates Equifax enrollment for a user who has passed DIT verification and been verified by the customer via OTP. **Parameters:** The `{smfaToken}` path parameter is the session token from the DIT ve