Detailed references, endpoints, and examples for integrating the WACM Verification Hub into your own applications.
Download as Markdownhttps://app.wacm.in/api/v1/verification
API requests require a Bearer Token or an API Key depending on the endpoint configuration.
Send the token securely in the request header.
If your system cannot send HTTP headers, you can append ?token=YOUR_API_TOKEN to the URL.
Authorization: Bearer YOUR_API_TOKENTo implement verification into your frontend/backend stack:
Create a Verification Profile in the WACM Dashboard to define channels, OTP lengths, and expiry times.
From your frontend, hit /request when a user enters their number. Store the returned request_id.
Send the user's input to /verify. If successful, you'll receive a trust_key.
Your backend passes the trust_key to /status/{request_id} to definitively confirm identity before allowing the action.
/request
Initiates a verification request and dispatches an OTP or Magic Link to the user.
| Parameter | Description |
|---|---|
| profile_id Req | ID of the configured Verification Profile. |
| identifier Req | Phone number or email address. |
| channel Req | whatsapp or email. |
| purpose Req | e.g., login, checkout. |
| ip_address | Used by Fraud Engine. Auto-captured if omitted. |
| user_agent | Used for auditing. Auto-captured if omitted. |
| captcha_token | reCAPTCHA token. Required if profile mandates it. |
| silent | If true, the outbound OTP message will NOT be sent. Useful for 1-Click Auto-Login to save API costs. |
{
"status": "success",
"data": {
"request_id": "req_84jf9akd...",
"expires_at": "2026-06-22T20:00:00Z"
}
}/verify
Validates an OTP submitted by the user.
| Parameter | Description |
|---|---|
| request_id Req | The ID returned from the /request step. |
| code Req | The 4-6 digit OTP. |
{
"status": "success",
"data": {
"trust_key": "trust_abc123xyz...",
"verified_at": "2026-06-22T19:35:00Z"
}
}/resend
Resends a new OTP to the same identifier for an existing verification request. Useful when the user didn't receive the original code.
| Parameter | Description |
|---|---|
| request_id Req | The ID returned from the /request step. |
Instead of asking users to type a 6-digit OTP, you can utilize the Webhook Intercept feature to securely authenticate them without friction.
Call the /request endpoint as normal and store the returned request_id.
Generate a `wa.me` link and render it on your frontend. When the user clicks it, it opens their WhatsApp pre-filled with the secure payload.
https://wa.me/YOUR_PHONE_NUMBER?text=Verify%20Request:%20{request_id}
As soon as the user hits "Send" on their phone, the Verification Webhook intercepts the message and securely changes the request status to verified. If your frontend is polling the /status endpoint, it will instantly proceed, automatically logging the user in.
For email-based verification, you can generate a magic link that the user clicks to verify without typing an OTP. This endpoint is called by your backend after receiving the magic link from the /request response.
/magic/{request_id}/{token}
Verify a magic link. Returns a trust key upon success. Typically called when the user clicks the link from their email.
{
"status": "success",
"data": {
"trust_key": "trust_abc123xyz...",
"verified_at": "2026-06-22T19:35:00Z"
}
}/status/{request_id}
Your backend server should call this to independently verify that the trust_key provided by the frontend is authentic and unexpired.
{
"status": "success",
"data": {
"status": "verified",
"trust_key": "trust_abc123xyz...",
"identifier": "+1234567890",
"channel": "whatsapp"
}
}© 2026 WACM. All rights reserved. API Version 1.0.