You can stub method making external api call i.e verify_sms_code in your case. You can write something like
SessionsController.any_instance.stub(:verify_sms_code).and_return({code: 200, data: ''})
When you write above code whenever you use verify_sms_code inside SessionsController it will return the hash that you provide i.e {code: 200, data: ''}
If you are using rspec 3 and above, you can mock verify_sms_code as following inside controller.
allow(controller).to receive(:verify_sms_code).and_return({code: 200, data: ''})
Reference link:
https://www.relishapp.com/rspec/rspec-mocks/v/2-6/docs/method-stubs/stub-on-any-instance-of-a-class
http://rspec.info/documentation/3.4/rspec-mocks/
There are also other ways to mock. Check below link
https://robots.thoughtbot.com/how-to-stub-external-services-in-tests
Example:
it "does something" do
SessionsController.any_instance.stub(:verify_sms_code).and_return({code: 200, data: "success data"})
end
it "does other thing" do
SessionsController.any_instance.stub(:verify_sms_code).and_return({code: 404, data: "error data"})
end