...

1. Getting consent

   1. App calls /transact with the relevant auth details

   2. Provider responds with WaitingForOTP or PendingValidation as may be required

   3. App calls /transact/validate to supply OTP

   4. Provider responds with any of the completion codes Successful or Failed. If successful, provider also has to respond with a provider_token

2. Placing a hold

   1. App calls /transact with auth.type set to provider_token and passing a prior received token.

   2. Provider responds with any of the completion codes Successful or Failed.

Interface specification - (App → OnePipe)

...