> ## Documentation Index
> Fetch the complete documentation index at: https://docs-api.kravata.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Request the OTP

> Finds the user of your company with this WhatsApp number and sends them an OTP by **SMS and email** (never by WhatsApp). Keep `challengeId` for *Verify the OTP*. Limits per number: one code every 30 seconds and 5 per hour.

#### Authentication

`Authorization: Bearer <channel token>`, from `POST /api/v1/channel/token`. The user token is not accepted here.

#### Production

Available in test today. In production these calls go to `https://partners-api.kravata.co` with your mTLS client certificate; ask your Kravata point of contact before going live.

See the [WhatsApp channel guide](/stack/whatsapp-channel) for the full flow.

#### Errors

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | `INVALID_WA_ID` | `waId` is not a phone number. |
| 403 | `CHANNEL_DISABLED` | The channel is not enabled for your company. |
| 404 | `USER_NOT_FOUND` | No user of your company has this phone. |
| 409 | `AMBIGUOUS_PHONE` | More than one user has this phone. |
| 429 | `OTP_RESEND_COOLDOWN` | Less than 30 seconds since the last code. |
| 429 | `TOO_MANY_OTP_REQUESTS` | 5 codes in the last hour. |
| 502 | `OTP_DELIVERY_FAILED` | The code could not be sent. |



## OpenAPI

````yaml /stack/openapi.json post /api/v1/channel/whatsapp/session/request
openapi: 3.1.0
info:
  title: Kravata Stack API
  version: '2.0'
  description: >-
    Kravata Stack API: users, accounts, custody wallets, liquidity ramps and
    fiat payments.
servers:
  - url: https://test-api-kore.kravata.co
    description: Test
  - url: https://partners-api.kravata.co
    description: Production (mTLS + IP allowlist)
security:
  - bearerAuth: []
tags:
  - name: Authentication
  - name: Users
  - name: Accounts
  - name: Earn
  - name: Custody
  - name: Liquidity Ramps
  - name: Payments
  - name: Webhooks
  - name: Request Logs
  - name: WhatsApp Channel
    description: >-
      Endpoints for a company's own WhatsApp bot acting for one end user at a
      time. See the WhatsApp channel guide.
paths:
  /api/v1/channel/whatsapp/session/request:
    post:
      tags:
        - WhatsApp Channel
      summary: Request the OTP
      description: >-
        Finds the user of your company with this WhatsApp number and sends them
        an OTP by **SMS and email** (never by WhatsApp). Keep `challengeId` for
        *Verify the OTP*. Limits per number: one code every 30 seconds and 5 per
        hour.


        #### Authentication


        `Authorization: Bearer <channel token>`, from `POST
        /api/v1/channel/token`. The user token is not accepted here.


        #### Production


        Available in test today. In production these calls go to
        `https://partners-api.kravata.co` with your mTLS client certificate; ask
        your Kravata point of contact before going live.


        See the [WhatsApp channel guide](/stack/whatsapp-channel) for the full
        flow.


        #### Errors


        | Status | Code | Meaning |

        | --- | --- | --- |

        | 400 | `INVALID_WA_ID` | `waId` is not a phone number. |

        | 403 | `CHANNEL_DISABLED` | The channel is not enabled for your
        company. |

        | 404 | `USER_NOT_FOUND` | No user of your company has this phone. |

        | 409 | `AMBIGUOUS_PHONE` | More than one user has this phone. |

        | 429 | `OTP_RESEND_COOLDOWN` | Less than 30 seconds since the last
        code. |

        | 429 | `TOO_MANY_OTP_REQUESTS` | 5 codes in the last hour. |

        | 502 | `OTP_DELIVERY_FAILED` | The code could not be sent. |
      operationId: channel-session-request
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - waId
              properties:
                waId:
                  type: string
                  description: >-
                    The user's WhatsApp number as WhatsApp sends it: country
                    code, no `+`.
                  example: '573001234567'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                required:
                  - challengeId
                properties:
                  challengeId:
                    type: string
                    description: Send it back in *Verify the OTP*.
                  channels:
                    type: array
                    description: Where the code was sent, for example `["sms", "email"]`.
                    items:
                      type: string
                  expiresIn:
                    type: integer
                    description: Validity of the code, in seconds.
                    example: 300
      security:
        - bearerAuth: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Access token from POST /api/v1/client/token.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.