---
title: "Send a one-time password to a communication channel."
method: POST
path: "/one-time-password/actions/send"
tags: ["One Time Password"]
---

# Send a one-time password to a communication channel.

`POST /one-time-password/actions/send`

Sends a one-time password to the selected communication channel and returns a request ID used for verification.
The password is valid for 1 hour by default and can only be used once. Use the request ID with
[POST /one-time-password/actions/verify](https://carecloud.readme.io/reference/postverifyotp) to complete verification.

## Headers

- `Accept-Language` string

## Request body

- object
  - `external_application_id` string, required — The unique ID of the external application that requested the one-time password. If you do not have an external application ID, see the [authentication documentation](https://carecloud.readme.io/reference/authentication#external-applications).
  - `communication_channel_id` 1 | 2 | 4 | 5, required — The unique ID of the communication channel. Possible values: 1 - email, 2 - SMS, 4 - push notification (Apple or Google), 5 - internal system notification.
  - `recipient` string, required — Recipient of the message with OTP. The parameter could contain email, phone number or other identifier of the message recipient.
  - `otp_type` 1 | 2 — Sets the OTP type to generate. Possible values: 1 - alphanumeric, 2 - numeric.
  - `message_template_id` string — The unique ID of the message template. If not set, CareCloud uses the default value from the system configuration.

## Response `200`

OK

- object
  - `data` object
    - `request_id` string — The parameter specifies the request that caused the OTP to be created. The request ID is used as a parameter in [POST /one-time-password/actions/verify](https://carecloud.readme.io/reference/postverifyotp).

## Other responses

- `400` — Bad input parameter. The response body's `error.error_data.invalid_params[]` array lists the parameters that caused the failure, each carrying a `reason` code. See the `BadRequestErrorBody` schema for the generic reason taxonomy. Operations with domain-specific business rules document additional reasons at the operation level.
- `401` — The client has invalid credentials or auth token.
- `403` — The client does not exist or the client tried to access an unauthorized property or resource.
- `404` — The resource was not found.
- `405` — The resource does not support the specified HTTP method.
- `429` — Too many requests - more than the resource limit.
- `500` — Server is not working as expected.
- `503` — Temporary state when the service is temporarily unavailable, overloaded or there is a maintenance window.

---

[API](https://skmtc.net/crmcarecloud/apis/rest-api-reference.md) · [All operations](https://skmtc.net/crmcarecloud/apis/rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/crmcarecloud/rest-api-reference/revisions/329c06dbf8d9/schema)