Verify Call

Verify Call Quick Start

Novauth rings the user's phone once. The last 4–6 digits of the incoming number are the verification code — no typing required on Android, one glance on iOS.

Testing without real calls? Use Sandbox Mode — no real calls placed, predictable OTP codes, and no billing.

Flow

Your serverPOST /call/flash with the user's phone number

NovauthRoutes a call via voice carrier to the user

User's phoneRings once — caller ID shows verification number

Your mobile appReads caller ID automatically (Android) or user sees it (iOS)

Your serverPOST /call/flash/webhook to confirm Success or Failed

1Initiate a flash call

Send a POST request with the user's phone number. Novauth immediately routes a call via the voice carrier.

POST/api/v1/connect-hub/call/flash

bash

curl -X POST https://api.novauth.com/api/v1/connect-hub/call/flash \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-account-id: YOUR_ACCOUNT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "callee": "+14155552671",
    "max_ring_time": 20
  }'

200 OK — Response

json

{
  "uuid":   "01JQHM3P7KXNV8W2QF5DG6TYAB",   // save this — used for status reporting
  "caller": "12025550188",                      // number that will ring the user (no + prefix)
  "callee": "14155552671"                       // your user's number (no + prefix)
}

2Mobile app reads the caller ID

This step is handled entirely on the client device — no server call required.

Android: Use PhoneStateListener or the READ_CALL_LOG permission to read the incoming caller ID automatically — fully zero-friction. iOS: The user briefly sees the incoming number on screen and taps Ignore — still faster than typing a 6-digit code.

The last 4–6 digits of the caller field from Step 1 act as the OTP. Compare these against what the mobile app reads, then report the result in Step 3.

3Report the verification result

After your mobile app determines whether the caller IDs matched, your backend reports the outcome back to Novauth. This closes the call record and enables analytics.

POST/api/v1/connect-hub/call/flash/webhook

bash

# After your mobile app reads the caller ID, report the result:
curl -X POST https://api.novauth.com/api/v1/connect-hub/call/flash/webhook \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-account-id: YOUR_ACCOUNT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "uuid": "01JQHM...",
    "status": "Success"
  }'

# status options:
#   "Success"     — user verified (caller ID matched)
#   "Failed"      — call failed or user rejected
#   "Incomplete"  — call started but not resolved
#   "WrongNumber" — user reports wrong number received

4Retrieve the call detail record (optional)

Pull the full CDR for debugging, auditing, or fraud analysis. Returns timestamps, duration, and disposition.

CDR is available only after the call has fully ended. If you fetch immediately after initiating, the response will be null — wait a few seconds or fetch after receiving the webhook callback.

GET/api/v1/connect-hub/call/flash/{uuid}/cdr

bash

# Get full call detail record
curl https://api.novauth.com/api/v1/connect-hub/call/flash/01JQHM.../cdr \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-account-id: YOUR_ACCOUNT_ID"

API Reference

POST/call/flashInitiate a flash call

POST/call/flash/webhookReport verification outcome

GET/call/flash/{uuid}/cdrGet call detail record

POST/call/flash/cdrList all CDRs (paginated)

DELETE/call/flash/{uuid}Hangup / cancel a ringing call

Cancel a ringing call

bash

# Cancel a ringing call before it's answered
curl -X DELETE https://api.novauth.com/api/v1/connect-hub/call/flash/01JQHM... \
  -H "x-api-key: YOUR_API_KEY" \
  -H "x-account-id: YOUR_ACCOUNT_ID"

Webhook status values

SuccessCaller ID verified — user is authenticated

FailedCall failed, dropped, or user rejected

IncompleteCall started but outcome not determined

WrongNumberUser reports the incoming number was unexpected