> ## Documentation Index > Fetch the complete documentation index at: https://docs.tawked.com/llms.txt > Use this file to discover all available pages before exploring further. # Get a verification > Reads the current state of a verification — status, channel, destination, and how many attempts and resends remain — without consuming an attempt. ## OpenAPI ````yaml https://tawked.com/openapi.json get /v1/verify/{id} openapi: 3.1.0 info: title: Tawked Verify API version: 2026-09 summary: >- OTP verification for Saudi mobile numbers over SMS or WhatsApp, in two calls. description: >- Tawked is a Saudi OTP verification API: one request sends a code by SMS or WhatsApp to a Saudi mobile number, one request checks it. Built in Jeddah, billed only per delivered code. SAR 0.09 per delivered SMS code, prepaid; failed sends are not charged. Authenticate with a Bearer API key from the dashboard (tk_live_ for production, tk_test_ for the sandbox, tk_partner_ for partners). Both /v1/... and /api/v1/... answer identically. Rate limit: 120 requests per minute per key. termsOfService: https://tawked.com/en/terms license: name: Proprietary (Tawked terms of service) url: https://tawked.com/en/terms contact: name: Tawked support email: support@tawked.com url: https://tawked.com/en/contact servers: - url: https://tawked.com description: Production (the sandbox is a tk_test_ key on the same host) - url: https://tawked.com/api description: The same API under /api/v1/..., kept for older integrations security: - bearerKey: [] - headerKey: [] tags: - name: Verify description: Send and check one-time codes. - name: WhatsApp description: >- Send approved WhatsApp templates through the number connected to an application; any approved application connects its own number from the dashboard. externalDocs: description: Developer docs, with code samples url: https://tawked.com/en/docs paths: /v1/verify/{id}: get: tags: - Verify summary: Get a verification description: >- Reads the current state of a verification — status, channel, destination, and how many attempts and resends remain — without consuming an attempt. operationId: status parameters: - name: id in: path required: true schema: type: string format: uuid - name: application in: query required: false description: >- Partner keys only: passed as a query parameter (`?application=…`) since a GET request has no body. Same meaning as on `start`; the legacy name `service` is accepted identically. schema: type: string responses: '200': description: Current state content: application/json: schema: type: object properties: id: type: string status: type: string channel: type: string to: type: string reference: type: string attempts_remaining: type: integer resends_remaining: type: integer expires_at: type: string format: date-time verified_at: type: - string - 'null' created_at: type: string format: date-time examples: current_state: summary: Current state value: id: b7e5c2b0-9c1a-4e2f-8f2a-3a6b0e9d1c44 status: pending channel: sms to: '+966551234567' reference: order-42 attempts_remaining: 3 resends_remaining: 3 expires_at: '2026-09-01T12:34:56.789Z' verified_at: null created_at: '2026-09-01T12:29:56.789Z' '400': description: >- `service_required`: Partner key used with no `application` (or `service`) in the request body.; `invalid_json`: The request body is not valid JSON.; `invalid_request`: start: `to` (and `phone`) both missing or blank. check: `id` or `code` missing. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - service_required - invalid_json - invalid_request '401': description: >- `unauthorized`: Missing, unknown, revoked, or mode-mismatched key; or an unknown/suspended partner.; `key_expired`: The key's `expires_at` has passed. Checked right after the key is recognised, before the IP allowlist or scope. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - unauthorized - key_expired '403': description: >- `account_not_active`: The application is not approved yet, the account is banned, or a partner disabled this application. All four causes share this one response.; `ip_not_allowed`: The caller's IP does not match the key's `ip_allowlist` (exact IPs and/or CIDR ranges, IPv4 and IPv6). content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - account_not_active - ip_not_allowed '404': description: >- Unknown id / `service_not_found`: Partner key, but `application`/`service` does not match any of that partner's provisioned applications.; `not_found`: Unknown id, or an id that belongs to a different account or application than the calling key's. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - service_not_found - not_found examples: unknown_id: summary: Unknown id value: error: not_found '429': description: >- `too_many_requests`: Per-key rate limit exceeded (default 120 requests/minute, fixed 60s window). Checked before authentication. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - too_many_requests '500': description: >- `internal_error`: An unhandled server error. Quote the X-Request-Id header if you report it. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - internal_error components: schemas: Error: type: object required: - error properties: error: type: string description: A stable machine-readable code; the docs list every one. additionalProperties: true securitySchemes: bearerKey: type: http scheme: bearer description: 'Authorization: Bearer ' headerKey: type: apiKey in: header name: x-api-key description: >- The same API key, as a header, for clients that cannot set Authorization. ````