WhatsApp Channel

Verify the OTP

Checks the code the user typed in the chat and opens their session. The code allows 3 attempts and lasts 5 minutes. Opening a session closes any previous channel session of the same number.

Authentication

Authorization: Bearer <channel token>, from POST /api/v1/channel/token. The user token is not accepted here.

Production

Available in test today. In production these calls go to https://partners-api.kravata.co with your mTLS client certificate; ask your Kravata point of contact before going live.

See the WhatsApp channel guide for the full flow.

Errors

Status	Code	Meaning
401	`OTP_INVALID`	Wrong code; the message says how many attempts are left.
401	`OTP_EXPIRED`	The code expired: request a new one.
403	`USER_DISABLED`	The user is disabled.
404	`CHALLENGE_NOT_FOUND`	Unknown or already used `challengeId`.
429	`OTP_LOCKED`	Too many wrong codes: request a new one.

POST

api

channel

session

verify

Verify the OTP

curl --request POST \
  --url https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "waId": "573001234567",
  "challengeId": "<string>",
  "otpCode": "482915"
}
'

import requests

url = "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify"

payload = {
    "waId": "573001234567",
    "challengeId": "<string>",
    "otpCode": "482915"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({waId: '573001234567', challengeId: '<string>', otpCode: '482915'})
};

fetch('https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'waId' => '573001234567',
    'challengeId' => '<string>',
    'otpCode' => '482915'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify"

	payload := strings.NewReader("{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "<string>",
  "userId": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 300,
  "refreshExpiresIn": 123
}

Authorizations

Authorization

string

header

required

Access token from POST /api/v1/client/token.

Body

application/json

waId

string

required

The user's WhatsApp number as WhatsApp sends it: country code, no +.

Example:

"573001234567"

challengeId

string

required

From Request the OTP.

otpCode

string

required

Code the user typed.

Example:

"482915"

Response

200 - application/json

Successful response

accessToken

string

required

User token. Use it for every user call (PIN, deposit, accounts, withdrawal).

userId

string

required

Kravata user id.

refreshToken

string

Use it with Refresh the session.

expiresIn

integer

Validity of accessToken, in seconds.

Example:

300

refreshExpiresIn

integer

Validity of refreshToken, in seconds.

Verify the OTP

curl --request POST \
  --url https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "waId": "573001234567",
  "challengeId": "<string>",
  "otpCode": "482915"
}
'

import requests

url = "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify"

payload = {
    "waId": "573001234567",
    "challengeId": "<string>",
    "otpCode": "482915"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({waId: '573001234567', challengeId: '<string>', otpCode: '482915'})
};

fetch('https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'waId' => '573001234567',
    'challengeId' => '<string>',
    'otpCode' => '482915'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify"

	payload := strings.NewReader("{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://test-api-kore.kravata.co/api/v1/channel/whatsapp/session/verify")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"waId\": \"573001234567\",\n  \"challengeId\": \"<string>\",\n  \"otpCode\": \"482915\"\n}"

response = http.request(request)
puts response.read_body

{
  "accessToken": "<string>",
  "userId": "<string>",
  "refreshToken": "<string>",
  "expiresIn": 300,
  "refreshExpiresIn": 123
}

Guides

API reference

Verify the OTP

Authentication

Production

Errors

Authorizations

Body

Response