OTP (verification codes)

Send a code

POST/v2/otp

Scope:otp
Idempotency-Key:required
sends messages

length 4–8, ttlSeconds 60–900, maxAttempts 1–10, app name (letters, digits, spaces; no links). Fixed localized text. Max 5 codes per recipient and 200 recipients per account per hour; opted-out numbers are refused.

Parameters

Headers

Name	Type	Constraints	Description
`Idempotency-Key`required	Type`string`	Constraints≤ 191 chars	DescriptionYour unique id for this operation (≤ 191 visible ASCII). A retry with the same key and body returns the first answer with `Idempotent-Replayed: true` — it never runs twice. Kept 24 h.
`X-Request-Id`optional	Type`string`	Constraints—	DescriptionOptional: your own request id, echoed back (otherwise we generate `req_…`). Quote it to support.

Body

Name	Type	Constraints	Description
`numberId`required	Type`string`	Constraints—	DescriptionNumber to act on (id from `GET /v2/numbers`). A key restricted to some numbers can use only those.
`to`required	Type`string`	Constraints—	DescriptionRecipient: international digits without `+` or leading zeros (e.g. `201001234567`, `966501234567`).
`length`optional	Type`integer`	Constraints4–8default 6	DescriptionDigits in the code (4–8).
`ttlSeconds`optional	Type`integer`	Constraints60–900default 300	DescriptionHow long the code is valid (60–900 s).
`maxAttempts`optional	Type`integer`	Constraints1–10default 5	DescriptionWrong tries before the OTP locks (1–10).
`app`optional	Type`string`	Constraints≤ 30 chars	DescriptionYour app or shop name in the fixed text: letters, digits and spaces (≤ 30), no links, no domain endings, no runs of 6+ digits.
`locale`optional	Type`string`	Constraintsone of: ar · endefault ar	DescriptionLanguage of the fixed OTP text.
`copyButton`optional	Type`boolean`	Constraintsdefault false	DescriptionAdd a “Copy code” button under the message.

Request

POST /v2/otp

curl -X POST "https://mursilat.com/api/v2/otp" \
  -H "Authorization: Bearer $WASLA_API_KEY" \
  -H "Idempotency-Key: order-1042-confirm" \
  -H "Content-Type: application/json" \
  -d '{
  "numberId": "cm1abcd2345efgh6789ijkl",
  "to": "201001234567",
  "length": 6,
  "ttlSeconds": 300,
  "maxAttempts": 5,
  "app": "متجر النور",
  "copyButton": true
}'

const res = await fetch('https://mursilat.com/api/v2/otp', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
    'Idempotency-Key': 'order-1042-confirm',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "numberId": "cm1abcd2345efgh6789ijkl",
    "to": "201001234567",
    "length": 6,
    "ttlSeconds": 300,
    "maxAttempts": 5,
    "app": "متجر النور",
    "copyButton": true
  }),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);

import os
import requests

headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}", "Idempotency-Key": "order-1042-confirm"}
res = requests.post(
    "https://mursilat.com/api/v2/otp",
    headers=headers,
    json={
        "numberId": "cm1abcd2345efgh6789ijkl",
        "to": "201001234567",
        "length": 6,
        "ttlSeconds": 300,
        "maxAttempts": 5,
        "app": "متجر النور",
        "copyButton": True
    },
    timeout=30,
)
data = res.json()
if not res.ok:
    raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)

<?php
$ch = curl_init('https://mursilat.com/api/v2/otp');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
        'Idempotency-Key: order-1042-confirm',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'numberId' => 'cm1abcd2345efgh6789ijkl',
        'to' => '201001234567',
        'length' => 6,
        'ttlSeconds' => 300,
        'maxAttempts' => 5,
        'app' => 'متجر النور',
        'copyButton' => true
    ], JSON_UNESCAPED_UNICODE),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);

Request — JSON

{
  "numberId": "cm1abcd2345efgh6789ijkl",
  "to": "201001234567",
  "length": 6,
  "ttlSeconds": 300,
  "maxAttempts": 5,
  "app": "متجر النور",
  "copyButton": true
}

Response

201Example

201 — application/json

{
  "otpId": "otp_8f2c1d9a7b3e4f56a1b2c3d4",
  "numberId": "cm1abcd2345efgh6789ijkl",
  "to": "2010****4567",
  "status": "pending",
  "length": 6,
  "maxAttempts": 5,
  "expiresAt": "2026-10-13T08:05:00.000Z",
  "messageId": "3EB0A1B2C3D4E5F60718"
}

Response schema

Fields of the example answer. Expand objects and arrays.

responseobject8 fields
- otpIdstring "otp_8f2c1d9a7b3e4f56a1b2c3d4"
- numberIdstring "cm1abcd2345efgh6789ijkl"
- tostring "2010****4567"
- statusstring "pending"
- lengthinteger 6
- maxAttemptsinteger 5
- expiresAtstring "2026-10-13T08:05:00.000Z"
- messageIdstring "3EB0A1B2C3D4E5F60718"

Errors

Besides the authentication, rate-limit and validation errors every endpoint can return:

400OTP_INPUT_INVALIDInvalid OTP request.
429OTP_RECIPIENT_RATE_LIMITEDToo many codes to this recipient (5 per hour).
429SAFETY_HOURLY_CAP_REACHEDHourly limit reached.
403MESSAGES_QUOTA_EXCEEDEDNo messages left in your plan.

Errors →

Number Shield & behaviour

OTPs use their own Number Shield class: 30 per hour and 300 per day per number, 3–5 s apart, plus 5 codes per recipient and 200 recipients per account per hour. Opted-out recipients are refused.

Try it

Send this request from your browser to the Mursilat API.

documented example

Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (sends messages)

API key

Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

Idempotency-Key *

Body (JSON)