# Send SMS OTP

Send a one-time passcode (OTP) by SMS to the given phone number. Required permissions: apps:execute, [appId]:execute, auth:execute.

Endpoint: POST /v1/auth/otp/sms
Security: ClientAccessToken

## Request fields (application/json):

  - `custom_message` (string)
    Message to send, must contain {otp} and {app} placeholders to be replaced with one time password and application name. Limited to 140 characters

  - `sender_id` (string)
    The sender name that appears as the message sender on recipients devices. Limited to 11 characters. Limited support see https://docs.aws.amazon.com/sns/latest/dg/sns-supported-regions-countries.html

  - `phone_number` (string, required)
    Phone number to send the OTP to

  - `create_new_user` (boolean, required)
    Indicates whether to create a new user at the end of the authentication flow if a user is not found for the provided phone number. If enabled, public signups must also be configured as allowed for the application.

  - `redirect_uri` (string, required)
    URI that will receive the authorization code once the SMS OTP is validated. This is the server GET endpoint used to call the token endpoint, and should accept 'code' as a query parameter. This URI must also be configured as an allowed redirect URI in the Transmit Admin Portal

  - `require_mfa` (boolean)
    Require multi factor authentication for this authentication request.
    Example: true

  - `claims` (object)
    Used to request additional claims in the ID token, such as roles, permissions, and other user profile data. The structure is per the [OIDC Standard](https://openid.net/specs/openid-connect-core-1_0-final.html#ClaimsParameter). For supported claims and how to request custom claims, see the [ID Token Reference](https://developer.transmitsecurity.com/openapi/id_token_reference/).
    Example: {"id_token":{"roles":null}}

  - `approval_data` (object)
    Flat object that contains the data that your customer should approve for a transaction signing or custom approval flow. It can contain up to 10 keys, and only alphanumeric characters, underscores, hyphens, and periods. It will be returned as a claim in the ID token upon successful authentication.
    Example: {"transaction_id":"eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT","sum":"200"}

  - `org_id` (string)
    Organization ID, used for member login in B2B scenarios

## Response 200 fields (application/json):

  - `message` (string, required)
    Example: "SMS sent"

  - `approval_data` (object)
    Approval data object, if passed in the request.
    Example: {"transaction_id":"eFII2y40uB9hQ98nXt3tc1IHkRt8GrRZiqZuRn_59wT","sum":"200"}

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: "Bad request"

  - `error_code` (number, required)
    Example: 400

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404