The validation signature
The server nonce to prevent replay attacks
The OTP code
Optional
The status of the request
The response timestamp
The validation signature