Send SMS OTP

Request

Send a one-time passcode (OTP) by SMS to the given phone number.

Required permissions: apps:execute, [appId]:execute, auth:execute.

Security

ClientAccessToken

Bodyapplication/jsonrequired

custom_messagestring

Message to send, must contain {otp} and {app} placeholders to be replaced with one time password and application name. Limited to 140 characters

sender_idstring

The sender name that appears as the message sender on recipients devices. Limited to 11 characters. Limited support see https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.html

phone_numberstringrequired

Phone number to send the OTP to

create_new_userbooleanrequired

Indicates whether to create a new user at the end of the authentication flow if a user is not found for the provided phone number. If enabled, public signups must also be configured as allowed for the application.

Default:false

redirect_uristringrequired

URI that will receive the authorization code once the SMS OTP is validated. This is the server GET endpoint used to call the token endpoint, and should accept 'code' as a query parameter. This URI must also be configured as an allowed redirect URI in the Transmit Admin Portal

require_mfaboolean

Require multi factor authentication for this authentication request.

Default:false

Example:true

claimsobject

Used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the OIDC Standard. For supported claims and how to request custom claims, see the ID Token Reference.

Example:

{
  "id_token": {
    "roles": null
  }
}

approval_dataobject

Flat object that contains the data that your customer should approve for a transaction signing or custom approval flow. It can contain up to 10 keys, and only alphanumeric characters, underscores, hyphens, and periods. It will be returned as a claim in the ID token upon successful authentication.

Example:

{
  "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
  "sum": "200"
}

org_idstring

Organization ID, used for member login in B2B scenarios

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/v1/auth/otp/sms \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "custom_message": "string",
    "sender_id": "string",
    "phone_number": "string",
    "create_new_user": false,
    "redirect_uri": "string",
    "require_mfa": true,
    "claims": {
      "id_token": {
        "roles": null
      }
    },
    "approval_data": {
      "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
      "sum": "200"
    },
    "org_id": "string"
  }'

Responses

Bodyapplication/json

messagestringread-onlyrequired

Example:"SMS sent"

approval_dataobjectread-only

Approval data object, if passed in the request.

Example:

{
  "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
  "sum": "200"
}

Response

{
  "message": "SMS sent",
  "approval_data": {
    "transaction_id": "eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT",
    "sum": "200"
  }
}