OTP (verification codes)
Verify a code
POST
/v2/otp/{otpId}/verify- Scope:
otp - Idempotency-Key:not used
- uses quota
Each call spends one attempt; send the code as a string. reason: INVALID_CODE | EXPIRED | TOO_MANY_ATTEMPTS | ALREADY_VERIFIED.
Parameters
Path
| Name | Type | Constraints | Description |
|---|---|---|---|
otpIdrequired | Typestring | Constraints— | DescriptionOTP id returned by POST /v2/otp. |
Headers
| Name | Type | Constraints | Description |
|---|---|---|---|
X-Request-Idoptional | Typestring | Constraints— | DescriptionOptional: your own request id, echoed back (otherwise we generate req_…). Quote it to support. |
Body
| Name | Type | Constraints | Description |
|---|---|---|---|
coderequired | Typestring | Constraints— | DescriptionThe code the person typed, as a string (keeps leading zeros). |
Request
curl -X POST "https://mursilat.com/api/v2/otp/otp_8f2c1d9a7b3e4f56a1b2c3d4/verify" \
-H "Authorization: Bearer $WASLA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"code": "048213"
}'const res = await fetch('https://mursilat.com/api/v2/otp/otp_8f2c1d9a7b3e4f56a1b2c3d4/verify', {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.WASLA_API_KEY}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
"code": "048213"
}),
});
const data = await res.json();
if (!res.ok) throw new Error(`${data.error.code}: ${data.error.message}`);
console.log(data);import os
import requests
headers = {"Authorization": f"Bearer {os.environ['WASLA_API_KEY']}"}
res = requests.post(
"https://mursilat.com/api/v2/otp/otp_8f2c1d9a7b3e4f56a1b2c3d4/verify",
headers=headers,
json={
"code": "048213"
},
timeout=30,
)
data = res.json()
if not res.ok:
raise RuntimeError(f"{data['error']['code']}: {data['error']['message']}")
print(data)<?php
$ch = curl_init('https://mursilat.com/api/v2/otp/otp_8f2c1d9a7b3e4f56a1b2c3d4/verify');
curl_setopt_array($ch, [
CURLOPT_CUSTOMREQUEST => 'POST',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
'Authorization: Bearer ' . getenv('WASLA_API_KEY'),
'Content-Type: application/json',
],
CURLOPT_POSTFIELDS => json_encode([
'code' => '048213'
], JSON_UNESCAPED_UNICODE),
]);
$data = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($status >= 400) { throw new Exception($data['error']['code'] . ': ' . $data['error']['message']); }
print_r($data);{
"code": "048213"
}Response
200Example
{
"otpId": "otp_8f2c1d9a7b3e4f56a1b2c3d4",
"valid": true,
"reason": null,
"attemptsLeft": 4
}Response schema
Fields of the example answer. Expand objects and arrays.
responseobject4 fields
- otpIdstring "otp_8f2c1d9a7b3e4f56a1b2c3d4"
- validboolean true
- reasonnull null
- attemptsLeftinteger 4
Errors
Besides the authentication, rate-limit and validation errors every endpoint can return:
- 404OTP_NOT_FOUNDOTP not found.
- 429OTP_VERIFY_RATE_LIMITEDToo many verification calls from this key.
Try it
Send this request from your browser to the Mursilat API.
documented examplePreview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.
Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (uses quota)
Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.