> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Activate user with an OTP

An user completes a separate Process (e.g., either they onboard for the first time, or they register a new email or mobile to their existing User entity). Once that Process completes, Digital Identity Management will:

* Issue an [action token](c_actionTokens) for the Activate User Process, and store the token in the cloud.

* Send a notification to the newly registered email or mobile. The message contains either a verification link, or a verification One-time Passcode (OTP), or both.

  **Note:** The verification type (link or OTP) that Digital Identity Management sends is dependent on your organization's notification settings and notification templates. These settings are configured during your initial onboarding and integration period with Digital Identity Management.

* Return a Proof Key for Action Token (PKAT) to the client application.

In this use case, the user receives an OTP. Therefore, your client application needs to prompt the user to supply that OTP that was sent to their contact channel.

\[product: dim]<img src="https://mintcdn.com/amdocs-ulm/XSI-_zBHRIt1HJAz/portal/m1Connect/processGuide/images/m1c_umlActivateOTP.png?fit=max&auto=format&n=XSI-_zBHRIt1HJAz&q=85&s=502562c92d1249449bf54a360486e90c" alt="" width="1604" height="1085" data-path="portal/m1Connect/processGuide/images/m1c_umlActivateOTP.png" />\[/product: dim]

## Request

Once the user provides their OTP to your application, the client then calls the [Session Token](c_sessionToken#) API to invoke the Activate User Process. Your client must supply the OTP and PKAT as URL path parameters:

```
**GET https://\{your/url\}/session/token?customToken=12345&amp;pkat=sdfsd-gfsdfgsd-sdgsdg-sfddsf-dsfsdf**
<no body>
```

| Custom Token = OTP |
| - |
| "Custom Token" may be a bit confusing at first. When a Process issues an action token, and the token is sent to the user in a clickable redirect URL, the actual internal token ID is appended directly to that URL. However, when the token is sent, the code only represents or correlates to the actual token ID. |

## Process Complete

If the token and PKAT are valid, then the Process starts. Digital Identity Management activates the User ID (and user's authN ID), authenticates the user, and returns a `200 HTTP` status:

```
**RESPONSE - body**
{
   "processId": "eec918ff-5db4-4fee-a601-5ff76a099c8e",
   "lastStep": true,
   "runtimeId": 229,
   "userId": 12345,
   "userAuthenticated:" true
}
```

| `processId` | The unique identifier for this instance of the Process. |
| - | - |
| `lastStep` | Boolean that indicates whether or not this was the last step in the Process. |
| `runtimeId` | Identifier of the Digital Identity Management Runtime entity currently associated to the Digital Identity Management User entity.\*\*About Runtime Entities:\*\*Upon user creation or authentication, Digital Identity Management looks for a JRUNTIMEID cookie in the user's browser or application. If no cookie is found, Digital Identity Management creates a Runtime Entity with a unique ID and associates it to the user during the login phase. Digital Identity Management will generate and pass a corresponding JRUNTIMEID cookie for clients to store and return with subsequent requests. |
| `userId` | The unique identifier of the current user. |
| `userAuthenticated` | Boolean that indicates if the user was authenticated into Digital Identity Management. |
| The Process also authenticates the user (if they are not already authenticated). Going forward, the user can authenticate with this activated authN ID and their password. | |

**Note:** If the user supplies an incorrect OTP three times, then the Session Token API will fail and stop responding. The user would then need to request a verification message resend. They can do this through one of three methods:

* [Token Resend](c_putSessionToken) API — Resends the same new action token (i.e., the same link). Ideal for use cases where the user is anonymous. Requires the corresponding PKAT.
* [Send Verification](c_sendVerification) Process — Issues and sends a new action token (i.e., a new link). Ideal for use cases where the user is authenticated.
* [Authenticate User](c_authenticateUser) Process — If an end user attempts to sign in with an unverified authN ID, Digital Identity Management will issue and send a new action token. The Process then ends without authenticating the user.

Once the user receives another verification message (regardless of whether it's a new token or the same token) they are then free to supply the OTP again.

**Parent topic:**[Activate User (and User Attribute) Process](../topics/c_activateUser)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.