> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Send a verification code > Generate and deliver a one-time verification code via the specified channel. ## OpenAPI ````yaml /openapi.yaml post /api/v1/verify/send openapi: 3.1.0 info: title: Devotel CPaaS API description: Orbit by Devotel — Communications Platform as a Service API version: 1.0.0 contact: name: Devotel url: https://devotel.io email: support@devotel.io license: name: Proprietary servers: - url: https://api.orbit.devotel.io description: Production security: - Bearer: [] - ApiKey: [] tags: - name: Messages description: >- Send and manage messages across all channels (SMS, WhatsApp, RCS, Email, Viber, etc.) - name: Fax description: >- List and track fax (MMS/T.38) transmissions on Telnyx-backed fax numbers (sending flows through the Messaging API) - name: Agents description: AI agent creation, configuration, and execution - name: Voice description: Voice calls, IVR, conferencing, and SIP trunking - name: OnCall description: On-call rotations and escalation policy planning for incident alerting - name: Webhooks description: Webhook endpoint management and delivery logs - name: Numbers description: Phone number search, provisioning, and configuration - name: Brand Identity description: >- Unified cross-channel brand trust posture (10DLC, toll-free, WhatsApp, RCS, branded calling, number KYC) - name: Contacts description: Contact management, segmentation, and lifecycle tracking - name: Campaigns description: Marketing campaign orchestration and analytics - name: Flows description: Automation flow builder and execution engine - name: Templates description: Message template management and approval workflows - name: Settings description: Organization, channel, and user preference settings - name: Verify description: OTP generation and verification across channels - name: Push description: Push notification delivery via FCM and APNs - name: Integrations description: Third-party service connections and OAuth management - name: CDP description: >- Customer Data Platform — activation surface (CRM object sync, streaming destinations, ad-audience activation) - name: Files description: >- Server-to-server media upload, listing, retrieval, and deletion (signed-URL backed) - name: Commerce description: >- Omnichannel conversational-commerce — persistent cart + checkout state machine, channel-agnostic hosted pay-by-link, native WhatsApp checkout, and AP2-style agent payment mandates. - name: Sync description: >- Real-time shared-state primitive (Twilio Sync parity) — Documents, Maps, Lists, and ephemeral Streams, with change events relayed over the /api/v1/ws/sync WebSocket gateway paths: /api/v1/verify/send: post: tags: - Verify summary: Send a verification code description: >- Generate and deliver a one-time verification code via the specified channel. requestBody: required: true content: application/json: schema: type: object required: - to properties: to: type: string description: Recipient (E.164 phone or email) channel: type: string enum: - sms - whatsapp - email - viber - voice - telegram - silent - rcs - flashcall - sna - totp - push - magic_link - backup_code description: Delivery channel for the OTP (defaults to `sms`) channels: type: array minItems: 1 maxItems: 4 items: type: string enum: - sms - whatsapp - email - voice - viber - telegram - silent - rcs description: >- Optional ad-hoc fallback channel chain (overlays the send when no `profile_id` is set) fallback_config: type: object properties: channel_timeout_seconds: type: integer minimum: 10 maximum: 600 default: 60 description: >- Seconds the scheduler waits before advancing to the next channel max_attempts_per_channel: type: integer minimum: 1 maximum: 3 default: 1 description: Retries per chain slot before advancing description: >- Optional async fallback engine config (pairs with `channels`) max_attempts: type: integer minimum: 1 maximum: 10 default: 3 description: Max verification attempts profile_id: type: string minLength: 1 maxLength: 64 description: >- Optional verification profile ID. Format is `vprof_` (per `generateId("vprof")`); NOT a bare UUID — the prior `format: uuid` constraint here was the root cause of DEVOTEL-ORBIT-28 (27 events in 11 days) where every FE call with a real profile id 422'd before reaching the Zod parse. country: type: string minLength: 2 maxLength: 2 description: >- Optional ISO 3166-1 alpha-2 country hint (e.g. `TR`) so national-format phone numbers normalise to the E.164 form OTP providers require. Not needed for clean E.164 input. code_length: type: integer minimum: 4 maximum: 8 default: 6 description: >- Number of digits in the generated OTP (defaults to 6). Must equal `custom_code` length when a custom code is supplied. sca_binding: type: object required: - amount - payee properties: amount: type: object required: - value - currency properties: value: type: string minLength: 1 maxLength: 32 description: >- Non-negative decimal with up to 4 fractional digits (e.g. `10.50`). currency: type: string minLength: 3 maxLength: 3 description: ISO 4217 alpha-3 currency code, upper-case. payee: type: string minLength: 1 maxLength: 256 description: >- Opaque payee identifier (IBAN, account id, or merchant reference). transaction_id: type: string minLength: 1 maxLength: 128 description: Optional caller-supplied transaction id for correlation. description: >- Optional PSD2 SCA dynamic-linking binding. Replay the SAME object on `POST /verify/check`; a mismatch rejects with `BINDING_MISMATCH`. Omit for non-PSD2 flows. locale: type: string enum: - en - es - fr - de - it - pt - nl - tr - ar - ja - zh - ko - ru - pl - sv - da - nb - fi - cs - el - he - hi - id - th - vi description: >- Optional 2-letter language code selecting the localized voice TTS and SMS body for the built-in fallback message. Profile-defined templates override it. Region tags (e.g. `es-MX`) are rejected — use `es`. custom_code: type: string pattern: ^\d{4,8}$ description: >- Optional caller-supplied OTP (4–8 digits, digits only) for sandbox / test-mode QA. Rejected on live keys. Its length must equal `code_length`. device_token: type: string minLength: 1 description: >- Device-bound network access token for the `sna` channel (Silent Network Authentication), obtained via the GSMA Open Gateway / CAMARA flow. When present on an `sna` send, verification completes via a network possession-proof and no OTP is minted. responses: '201': description: Verification code sent content: application/json: schema: type: object description: Verification code sent properties: data: type: object additionalProperties: true properties: verification_id: type: string status: type: string enum: - pending channel: type: string expires_at: type: string format: date-time meta: type: object properties: request_id: type: string description: >- Unique request identifier (also returned in X-Request-Id header) timestamp: type: string format: date-time description: ISO 8601 UTC timestamp of the response '422': description: Default Response content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: >- Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation '429': description: Default Response content: application/json: schema: type: object properties: error: type: object required: - code - message - status properties: code: type: string description: >- Machine-readable error code (e.g. INVALID_PHONE_NUMBER) message: type: string description: Human-readable error description status: type: integer description: HTTP status code details: type: object additionalProperties: true description: Additional context about the error meta: type: object properties: request_id: type: string timestamp: type: string format: date-time docs_url: type: string format: uri description: Link to relevant error documentation components: securitySchemes: Bearer: type: http scheme: bearer bearerFormat: JWT description: Dashboard JWT token from Clerk ApiKey: type: apiKey name: X-API-Key in: header description: Server-to-server API key (dv_live_sk_*) ````