Skip to main content
POST
Start a verification

Authorizations

Authorization
string
header
required

Authorization: Bearer

Headers

Idempotency-Key
string

A 1–128 printable-ASCII-character key you generate, scoped to your API key (and, for a partner key, to the named application too). Replaying the same key returns the original 201 response unchanged, with the response header Idempotent-Replayed: true — nothing is sent or charged again. A send that fails releases the key so a retry can go through.

Body

application/json
to
string
required

The destination. Any of the accepted Saudi mobile formats below.

phone
string
deprecated

Deprecated alias for to, kept for pre-multichannel integrations. Only used when to is absent or blank; to always wins when both are present. New integrations should use to.

channel
string

Delivery channel. Defaults to "sms" when absent or blank — "sms" is the only channel live over this API today.

lang
string

Message language. Only the literal value "en" selects English; anything else (including missing) defaults to Arabic.

application
string

Partner keys only: which of your provisioned applications is sending. The legacy field name service is accepted identically.

reference
string

Your own reference (order id, request id, …), up to 64 printable characters. Echoed back on start and on GET /v1/verify/{id}, and searchable in the dashboard's verifications list.

client_ip
string

The end user's IP address. Enables the per-IP protection guard for this application when one is configured — never inferred from the request, always explicit.

autofill
string

web, android or none — which autofill line(s) to include on this send. web sends only the @domain #code line, android only the app-hash line, none sends neither. Omit it to send every line the application has configured.

Response

Started

id
string
status
string
expires_at
string<date-time>