Skip to content

    Arabic or English · ↑↓ to move · Enter to open · Esc to close

    العربية
    On this page

    OTP (verification codes)

    Verify a code

    POST/v2/otp/{otpId}/verify
    • Scope:otp
    • Idempotency-Key:not used
    • uses quota

    Each call spends one attempt; send the code as a string. reason: INVALID_CODE | EXPIRED | TOO_MANY_ATTEMPTS | ALREADY_VERIFIED.

    Parameters

    Path

    NameTypeConstraintsDescription
    otpIdrequiredTypestringConstraints—DescriptionOTP id returned by POST /v2/otp.

    Headers

    NameTypeConstraintsDescription
    X-Request-IdoptionalTypestringConstraints—DescriptionOptional: your own request id, echoed back (otherwise we generate req_…). Quote it to support.

    Body

    NameTypeConstraintsDescription
    coderequiredTypestringConstraints—DescriptionThe code the person typed, as a string (keeps leading zeros).

    Request

    curl -X POST "https://mursilat.com/api/v2/otp/otp_8f2c1d9a7b3e4f56a1b2c3d4/verify" \
      -H "Authorization: Bearer $WASLA_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{
      "code": "048213"
    }'
    Request — JSON
    {
      "code": "048213"
    }

    Response

    200Example

    200 — application/json
    {
      "otpId": "otp_8f2c1d9a7b3e4f56a1b2c3d4",
      "valid": true,
      "reason": null,
      "attemptsLeft": 4
    }

    Response schema

    Fields of the example answer. Expand objects and arrays.

    • responseobject4 fields
      • otpIdstring "otp_8f2c1d9a7b3e4f56a1b2c3d4"
      • validboolean true
      • reasonnull null
      • attemptsLeftinteger 4

    Errors

    Besides the authentication, rate-limit and validation errors every endpoint can return:

    Errors →

    Try it

    Send this request from your browser to the Mursilat API.

    documented example

    Preview — this copy of the docs isn’t on mursilat.com, so the console shows the documented example instead of calling the API.

    Real requests use your real number and plan: they can send WhatsApp messages, spend quota and delete data. (uses quota)

    Kept only in this tab’s memory: never saved, never put in the URL, sent only to mursilat.com. Reloading the page forgets it.

    Path parameters

    Send this request for real?

    This uses your plan quota or credits.

    POST /v2/otp/{otpId}/verify