Verification & messages
Check a code
Checks the code your user typed. Every check counts as an attempt.
POST
https://watsy.me/v1/verify/{id}/checkcurl -X POST https://watsy.me/v1/verify/5d3c1f0e-7a1b-4c55-9a7e-2f1d6b0c9e11/check \
-H "Authorization: Bearer $WATSY_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: check-8841-1" \
-d '{
"code": "482913"
}'{
"id": "5d3c1f0e-7a1b-4c55-9a7e-2f1d6b0c9e11",
"object": "verification_check",
"valid": true,
"status": "verified",
"attempts": 1,
"attempts_remaining": 4,
"verified_at": "2026-10-28T10:01:12.000Z"
}Authorization
Authorizationstring (header)requiredBearerfollowed by your project key:wsy_live_…orwsy_test_….
Headers
Idempotency-Keystring1 to 255 characters. Makes retries safe for 24 hours. See Idempotency.
X-Request-IdstringOptional, 8 to 64 characters. Echoed back; generated when missing.
Path parameters
idstring (uuid)requiredThe verification id returned by
POST /v1/verify.
Body
application/jsoncodestringrequiredThe code as typed: 4 to 8 digits. Surrounding spaces are trimmed.
Response (200)
application/jsonidstringrequiredVerification id.
objectstringrequiredAlways
verification_check.validbooleanrequiredThe only field to decide on.
statusstringrequiredVerification state after this check.
Values:
pendingsentverifiedfailedexpiredcanceledattemptsintegerrequiredChecks so far.
attempts_remainingintegerrequiredChecks left.
verified_atstring | nullrequiredWhen it was verified.
Check rules
- Decide on
validonly. A wrong code returns200withvalid: false, not an HTTP error. - At
max_attemptsthe verification is locked asfailed, and even the right code is refused after that. - After expiry:
valid: falsewithstatus: "expired". Canceled or failed verifications returnvalid: falsewithout counting an attempt. - A code is consumed once: checking a verified verification again returns
valid: falsewithstatus: "verified".
Send an Idempotency-Key with every check. If the response is lost, retry with the same key to get the original answer.