# Lean - sendOtp

Use this method to send an otp.
if [`otpType = SMS`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposableCertficate) an otp code is sent to phone number of the holder defined in the[`DisposableContacts`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposablecontacts) object.
if [`otpType = EMAIL`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposableCertficate) an otp code is sent to email of the holder defined in the [`DisposableContacts`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposablecontacts) object.
if [`otpType = WHATSAPP`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposableCertficate) an otp code is sent via WhatsApp to the phone number of the holder defined in the [`DisposableContacts`](/products/leandisposable/enterprise-documentation/developer-documentation/api-references/data-objects#disposablecontacts) object.

To use the **templateId/language** pair it is mandatory to define and config these value in the settings before using them.

**For the full technical reference, see the [OpenAPI specification](/products/leandisposable/openapi/certificate/sendotp)**.

REST API
#### Endpoint


```
POST /api/certificate/sendOtp
```

#### Headers

| Name | Required | Description |
|  --- | --- | --- |
| `Content-Type` | Yes | Must be `application/json`. |
| `Authorization` | Yes | Basic Auth credentials. |


#### Body parameters

| Parameter | Type | Required | Description |
|  --- | --- | --- | --- |
| `certIdOtp` | integer | Yes | The identification of the OTP associated to the disposable. |
| `deviceCode` | string | Yes | The device code of the issued certificate. |
| `smsOptions` | object | Depends | Required if `otpType=SMS`. Properties: `textSMS`, `templateId` (template identifier), `language` (ISO 639-1 alpha-2). `templateId` and `language` are required if `textSMS` is omitted or empty. Adding `$OTP$` in `textSMS` inserts the OTP at that position; otherwise it is appended at the end. |
| `emailOptions` | object | Depends | Required if `otpType=EMAIL`. Properties: `templateId` (required), `language` (required, ISO 639-1 alpha-2). |
| `whatsappOptions` | object | Depends | Required if `otpType=WHATSAPP`. Properties: `templateId` (integer, required), `language` (ISO 3166-1 alpha-2, required), `parameters` (array, required — list of template parameters as key-value maps, use `$OTP$` as placeholder for the OTP code). |


#### Request example


```json
{
    "certIdOtp": 2587763,
    "deviceCode": "RHIDP2412063503288",
    "smsOptions": {
        "textSMS": "Your OTP code: $OTP$"
    }
}
```

#### Response examples

**200 — Success**


```
Empty body
```

SOAP API
The SOAP interface is deprecated. Use the REST API instead.

**Method:** sendOtp

| **Parameter** | **Description** | **Mandatory** |
|  --- | --- | --- |
| certIdOtp | the identification of the otp associate to the disposable | YES |
| deviceCode | the device code of the issued certificate | YES |
| smsOptions | It is used only if the `otpType=SMS`  The smsOptions has these properties:  -**`textSMS`:**   -**`templateId`: identifier of the template**  -**`language`** (iso country code alpha2 two-letter code) The `templateId` and `language` parameters are required if the `textSMS` is omitted or empty.  The templateId is a string that identify an authorized text for the sms. It can be customized by LRA. With the addition of tag `$OTP$` inside the field textSMS the otp code is inserted in the desired position, while in the absence of this tag it will be inserted at the end. | YES if `otpType=SMS` |
| emailOptions | It is used only if the `otpType=EMAIL`  The emailOptions has these properties:  -**`templateId`: identifier of the template [required]**  -**`language`  [required]**  (iso country code alpha2 two-letter code) The `templateId` is a string that identify an authorized subject/body for the email. It can be customized by LRA. | YES if `otpType=EMAIL` |


#### Request example

SendOtp - SMS with smsOptions:


```xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.ws.nam/">
  <soapenv:Header/>
  <soapenv:Body>
    <ser:sendOtp>
      <certIdOtp>1828707</certIdOtp>
      <deviceCode>RHIDP2311037123139</deviceCode>
      <smsOptions>    
        <templateId>1</templateId>
        <language>IT</language>
      </smsOptions>
    </ser:sendOtp>
  </soapenv:Body>
</soapenv:Envelope>
```

SendOtp - SMS with textSMS parameter


```xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.ws.nam/">
  <soapenv:Header/>
  <soapenv:Body>
    <ser:sendOtp>
      <certIdOtp>1828707</certIdOtp>
      <deviceCode>RHIDP2311037123139</deviceCode>
      <smsOptions>    
        <textSMS>TEST </textSMS>
      </smsOptions>
    </ser:sendOtp>
  </soapenv:Body>
</soapenv:Envelope>
```

SendOtp - EMAIL


```xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://service.ws.nam/">
  <soapenv:Header/>
  <soapenv:Body>
    <ser:sendOtp>
      <certIdOtp>1828707</certIdOtp>
      <deviceCode>RHIDP2311037123139</deviceCode>
      <emailOptions>    
        <templateId>1</templateId>
        <language>IT</language>
      </emailOptions>
    </ser:sendOtp>
  </soapenv:Body>
</soapenv:Envelope>
```

#### Response example


```xml
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
    <soap:Body>
        <ns2:sendOtpResponse xmlns:ns2="http://service.ws.nam/"/>
    </soap:Body>
</soap:Envelope>
```

‌

#### Error codes

The main errors that can be found within this function are (all return HTTP `500`):

| Error code | Description |
|  --- | --- |
| [2](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-2-empty-field) | Some required fields are missing |
| [6](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-6-generic-exception---internal-exception) | Generic exception — internal exception |
| 62 | The `certIdOtp` is not valid |
| 66 | The device OTP is not active |
| 71 | The device OTP is disabled |
| [85](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-85-device-type-missing-or-not-allowed) | The `deviceCode` is not valid |
| [99](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-99-otp-was-not-sent) | OTP was not sent |
| [100](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-100-the-mobile-phone-number-is-not-valid) | The mobile phone number is not valid |
| [101](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-101-sms-blocked-by-the-watchlist) | SMS blocked by the watchlist |
| [102](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-102-the-email-address-is-not-valid) | The email address is not valid |
| [103](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-103-the-otp-service-has-exceeded-the-timeout) | The OTP service has exceeded the timeout |
| 138 | The device OTP is not an SMS OTP device |
| [231](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-231-otp-is-blocked) | OTP is blocked |
| [241](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors#error-241-lra-not-authorized-to-use-this-type-of-otp) | LRA not authorized to use this OTP type |


For authentication errors, see [Authentication](/products/leandisposable/enterprise-documentation/developer-documentation/authentication).

For details on how to handle errors, see [How to handle errors](/products/leandisposable/enterprise-documentation/developer-documentation/integration-guide/lean-ig-how-to-handle-errors).