Skip to content

Send OTP

Request

Send a one-time passcode to a user by email or SMS, or retrieve the code directly in the response to deliver it out-of-band — for example, when an admin generates a temporary access code on behalf of a user.

Security
ClientAccessToken
Bodyapplication/jsonrequired
device_idstring, <= 80 characters

Identifier of the device from which the authentication request originates

channelstringrequired

Channel to use to send the OTP. Use sms or email to deliver the code to the user. Use direct to return the code in the response body without sending it — for example, to deliver it out-of-band as a temporary access code. See Generate temporary access code.

Enum:"sms""email""direct"
identifier_typestringrequired

Type of user identifier used for login

identifierstringrequired

User identifier, which may correspond to the user's email, phone number, username, or user ID. The type of identifier should be specified as the identifier_type.

email_contentobject

Texts, logo and color to render email template with, if the channel is email

custom_sms_inputobject

Custom SMS message to send, if the channel is sms

approval_dataobject

Flat object that contains the data that your customer should approve for a transaction signing or custom approval flow. It can contain up to 10 keys, and only alphanumeric characters, underscores, hyphens, and periods. It will be returned as a claim in the ID token upon successful authentication.

Example:
{
  "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
  "sum": "200"
}
custom_emailstring

Custom email to send the OTP to, can be different than the user's email (if the channel is email)

custom_phone_numberstring

Custom phone number to send the OTP to, can be different than the user's phone number (if the channel is sms)

client_attributesobject

Client attributes

expires_innumber

Number of minutes until the OTP expires

generate_request_idboolean

The request ID can serve as an additional security identifier for authentication requests. When set to 'false' (by default), the request ID isn't returned. When set to 'true', Mosaic generates a unique request ID that must be included in the subsequent Authenticate OTP request along with other required parameters.

Default:false
curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/otp/send \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "device_id": "string",
    "channel": "sms",
    "identifier_type": "string",
    "identifier": "string",
    "email_content": {
      "subject": "string",
      "primaryColor": "#6981FF",
      "base64logo": "string",
      "headerText": "string",
      "bodyText": "string",
      "linkText": "string",
      "infoText": "string",
      "footerText": "If you didn'\''t request this email, you can safely ignore it.",
      "senderName": "string"
    },
    "custom_sms_input": {
      "custom_message": "string",
      "sender_id": "string"
    },
    "approval_data": {
      "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
      "sum": "200"
    },
    "custom_email": "string",
    "custom_phone_number": "string",
    "client_attributes": {
      "user_agent": "string",
      "ip_address": "string"
    },
    "expires_in": 0,
    "generate_request_id": false
  }'

Responses

Backend auth initialized successfully.

Bodyapplication/json
messagestringread-onlyrequired
Example:"OTP sent"
approval_dataobjectread-only

Approval data object, if passed in the request.

Example:
{
  "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
  "sum": "200"
}
codestringread-only

One time passcode, if the channel is direct.

Example:"123456"
Response
{
  "message": "OTP sent",
  "approval_data": {
    "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
    "sum": "200"
  },
  "code": "123456"
}