---
title: "Validates pre-authorized code and user pin"
method: POST
path: "/issuer/interactions/validate-pre-authorized-code"
tags: ["issuer"]
---

# Validates pre-authorized code and user pin

`POST /issuer/interactions/validate-pre-authorized-code`

Validates pre-authorized code and user pin.

## Request body

- ValidatePreAuthorizedCodeRequest — Model for validating pre-authorized code and pin.
  - `pre-authorized_code` string, required — Pre authorized code.
  - `user_pin` string — User pin.
  - `client_id` string — Client ID for VCS OIDC interaction.
  - `client_assertion_type` string — Specifies the method used to authenticate the client application to the authorization server (VCS). The only supported value is "urn:ietf:params:oauth:client-assertion-type:jwt-client-attestation". It indicates that the client must authenticate using OAuth 2.0 Attestation-Based Client Authentication method.
  - `client_assertion` string — The value MUST contain two JWTs, separated by a "~" character. The first JWT is the client attestation JWT, the second is the client attestation PoP JWT.

## Response `200`

OK

- ValidatePreAuthorizedCodeResponse — Model for validating pre-authorized code and pin.
  - `tx_id` string, required — transaction id
  - `op_state` string, required — Op state.
  - `scopes` string[], required — A list of pre-authorized scopes
  - `authorization_details` AuthorizationDetails[] — REQUIRED when authorization_details parameter is used to request issuance of a certain Credential type as defined in Section 5.1.1. It MUST NOT be used otherwise. It is an array of objects, as defined in Section 7 of [RFC9396]. — unresolved $ref

## Other responses

- `400` — Bad request

---

[API](https://skmtc.net/trustbloc/apis/verifiable-credential-service-vcs.md) · [All operations](https://skmtc.net/trustbloc/apis/verifiable-credential-service-vcs/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/trustbloc/verifiable-credential-service-vcs/revisions/9e21ad997121/schema)