Step 2 of 2. Submits the OTP for a session_id returned by /v2/verify/okyc_generate_otp and, when it is correct, returns the Aadhaar holder's demographics and photo.

otp must be exactly 6 digits; a malformed OTP is rejected free and does not use one of the session's 5 attempts. Send an optional Idempotency-Key header (up to 255 characters) to make retries safe.

Response contract: every HTTP 2xx is status: "success" and only a raised error is status: "error", so branch on error_code, never on status. Every response carries tranx_id (quote it to support), timestamp (ISO 8601 UTC), billed (whether the call was charged to your idto credits) and the legacy string fields chargeble and user_consent. Authenticate with your X-Client-ID and X-API-KEY headers.

data always carries all 24 fields; a field the source did not provide is null. Filled fields come first and null fields last, so read fields by name, never by position. address is one line built from house, street, landmark, locality, sub_locality, post_office, sub_district, district, state, country, then - <pincode>, with repeated parts appearing once. photo is a base64 JPEG; photo_url is reserved and currently always null.

Codes: IDTO_205 (wrong OTP, expired OTP or unknown session_id; let the user retry, and if expired start again with Generate OTP; 422, not billed), IDTO_206 (too many wrong OTPs for this session_id; start again with Generate OTP; 429, not billed), IDTO_001 (invalid input: OTP not 6 digits or a required field missing; 400, or 422 if the request body fails schema validation), IDTO_004 (duplicate request with an Idempotency-Key already in progress, 409), IDTO_010 (Idempotency-Key reused with a different body, 422), IDTO_009 (insufficient idto credits, 402), IDTO_006 (too many requests, 429), IDTO_007 (service configuration issue on idto's side, 500), IDTO_008 (upstream Aadhaar service busy, unavailable or timed out, 503).