Authentication Template API

1. Overview

Authentication templates deliver OTP codes via WhatsApp using the AUTHENTICATION template category. Three button variants are supported, each with its own creation and send-time constraints:

Copy Code: recipient taps a button to copy the OTP into the clipboard.
One-Tap Autofill: OTP autofills into the requesting Android app via package name and app signature hash.
Zero-Tap: OTP is submitted automatically without recipient interaction, subject to explicit terms acceptance at template creation.

Two APIs are covered: template creation (POST /wba/template/create) and message send (POST /wba-testing/v1/messages).

2. Template Creation API

Endpoint: POST https://apis.rmlconnect.net/wba/template/create

2.1 Copy Code — Payload

POST https://apis.rmlconnect.net/wba/template/create

{
  "template_category": "AUTHENTICATION",
  "template_name": "auth_copy_code_v120894",
  "language": ["en"],
  "message_send_ttl_seconds": 60,
  "components": {
    "body": { "add_security_recommendation": true },
    "footer": { "code_expiration_minutes": 5 },
    "buttons": {
      "type": "OTP",
      "otp_type": "COPY_CODE",
      "text": "Copy Code"
    }
  }
}

footer and message_send_ttl_seconds are optional for Copy Code; add_security_recommendation can be true or false.

2.2 One-Tap Autofill — Payload

POST https://apis.rmlconnect.net/wba/template/create

{
  "template_category": "AUTHENTICATION",
  "template_name": "auth_one_tap_v1",
  "language": ["en"],
  "message_send_ttl_seconds": 60,
  "components": {
    "body": { "add_security_recommendation": true },
    "footer": { "code_expiration_minutes": 10 },
    "buttons": {
      "type": "OTP",
      "otp_type": "ONE_TAP",
      "text": "Copy Code",
      "autofill_text": "Autofill",
      "package_name": "com.example.myapp",
      "signature_hash": "K8a/AINcGX7"
    }
  }
}

signature_hash must be exactly 11 characters. autofill_text, package_name, and signature_hash are all mandatory in the button object.

2.3 Zero-Tap — Payload

POST https://apis.rmlconnect.net/wba/template/create

{
  "template_category": "AUTHENTICATION",
  "template_name": "auth_zero_tap_v1",
  "language": ["en"],
  "message_send_ttl_seconds": 60,
  "components": {
    "body": { "add_security_recommendation": true },
    "footer": { "code_expiration_minutes": 10 },
    "buttons": {
      "type": "OTP",
      "otp_type": "ZERO_TAP",
      "text": "Copy Code",
      "autofill_text": "Autofill",
      "package_name": "com.example.myapp",
      "signature_hash": "K8a/AINcGX7",
      "zero_tap_terms_accepted": true
    }
  }
}

Same button-object requirements as One-Tap, plus zero_tap_terms_accepted, which must be present and true.

2.4 Field Reference

Field	Type	Required	Constraints
template_category	string	Yes	Must be AUTHENTICATION
template_name	string	Yes	Unique template identifier
language	array	Yes	e.g. ["en"]
message_send_ttl_seconds	integer	No	Range 30–900 for authentication templates (C-N2)
components.body.add_security_recommendation	boolean	Yes	true or false
components.footer.code_expiration_minutes	integer	No	Optional footer note
components.buttons	object	Yes	Required at all; missing fails creation (C-N3)
components.buttons.type	string	Yes	Must be OTP
components.buttons.otp_type	string	Yes	One of COPY_CODE, ONE_TAP, ZERO_TAP (C-N1)
components.buttons.text	string	Yes	Button label, e.g. "Copy Code"
components.buttons.autofill_text	string	ONE_TAP / ZERO_TAP only	Required (5.3)
components.buttons.package_name	string	ONE_TAP / ZERO_TAP only	Required (5.4, 6.5)
components.buttons.signature_hash	string	ONE_TAP / ZERO_TAP only	Required, exactly 11 chars (5.2, 5.5, 6.4)
components.buttons.zero_tap_terms_accepted	boolean	ZERO_TAP only	Required, must be true (6.2, 6.3)

2.5 Test Cases — Template Creation

Copy Code (Feature 4)

ID	Scenario	Expected
4.1	Happy path: full payload with footer and ttl	200 OK — template created, Template ID returned
4.2	add_security_recommendation false, no footer, no ttl	200 OK — footer and ttl confirmed optional

One-Tap Autofill (Feature 5)

ID	Scenario	Expected
5.1	Happy path: full payload, 11-char signature_hash	200 OK — template created
5.2	signature_hash too short ("abc123")	422 — signature_hash must be exactly 11 characters long
5.3	Missing autofill_text	422 — please provide autofill_text element in button
5.4	Missing package_name	422 — please provide package_name element in button
5.5	Missing signature_hash	422 — please provide signature_hash element in button

Zero-Tap (Feature 6)

ID	Scenario	Expected
6.1	Happy path: full payload, terms accepted	200 OK — template created
6.2	Missing zero_tap_terms_accepted	422 — please provide zero_tap_terms_accepted element in button
6.3	zero_tap_terms_accepted: false	422 — zero_tap_terms_accepted must be true for ZERO_TAP authentication templates
6.4	signature_hash too short ("short")	422 — signature_hash must be exactly 11 characters long
6.5	Missing package_name	422 — please provide package_name element in button

Cross-Type Validation

ID	Scenario	Expected
C-N1	otp_type: "INVALID_TYPE"	422 — otp_type must be one of ONE_TAP, COPY_CODE, ZERO_TAP
C-N2	message_send_ttl_seconds: 1000 (> 900)	422 — message_send_ttl_seconds should have value in range from 30 to 900 for authentication templates
C-N3	components.buttons omitted entirely	422 — please provide button element in components

3. Message Send API

Endpoint: POST https://apis.rmlconnect.net/wba-testing/v1/messages

3.1 Copy Code — Payload

POST https://apis.rmlconnect.net/wba-testing/v1/messages

{
  "phone": "9922892143",
  "media": {
    "type": "media_template",
    "template_name": "auth_copy_code_v120894",
    "lang_code": "en",
    "body": [{ "text": "123456" }],
    "button": [
      {
        "button_no": "0",
        "button_type": "authentication",
        "text": "123456"
      }
    ]
  }
}

3.2 One-Tap Autofill — Payload

POST https://apis.rmlconnect.net/wba-testing/v1/messages

{
  "phone": "919876543210",
  "media": {
    "type": "media_template",
    "template_name": "auth_one_tap_v1",
    "lang_code": "en",
    "body": [{ "text": "12345" }],
    "button": [
      {
        "button_no": "0",
        "button_type": "one_tap",
        "text": "12345",
        "autofill_text": "Autofill",
        "package_name": "com.example.myapp",
        "signature_hash": "K8a/AINcGX7"
      }
    ]
  }
}

3.3 Zero-Tap — Payload

POST https://apis.rmlconnect.net/wba-testing/v1/messages

{
  "phone": "919876543210",
  "media": {
    "type": "media_template",
    "template_name": "auth_zero_tap_v1",
    "lang_code": "en",
    "body": [{ "text": "12345" }],
    "button": [
      {
        "button_no": "0",
        "button_type": "zero_tap",
        "text": "12345"
      }
    ]
  }
}

3.4 Field Reference

Field	Type	Required	Constraints
phone	string	Yes	Recipient mobile number
media.type	string	Yes	Must be media_template
media.template_name	string	Yes	Must match an approved authentication template
media.lang_code	string	Yes	e.g. "en"
media.body	array	Yes	Exactly one object; OTP text. Max 50 chars for authentication/copy_code (4.5); max 15 chars for one_tap/zero_tap (5.7, 6.7); only one parameter allowed (4.8)
media.button[].button_no	string	Yes	Must be "0" for all three types (4.7, S-N4, S-N5)
media.button[].button_type	string	Yes	authentication, one_tap, or zero_tap (6.9)
media.button[].text	string	Yes	Must equal media.body text exactly (4.4, 5.10, 6.8); mandatory field (4.6, S-N1, S-N2)
media.button[].autofill_text	string	one_tap only	Required (5.8)
media.button[].package_name	string	one_tap only	Required (5.9)
media.button[].signature_hash	string	one_tap only	Required (S-N3)

3.5 Test Cases — Message Send

Copy Code (Feature 4)

ID	Scenario	Expected
4.3	Happy path: body and button text match	200 OK — message queued, Copy Code button displayed
4.4	Body text ≠ button text (123456 vs 999999)	422 — body object text parameter and button object text parameter must be same if the template category is authentication
4.5	OTP text exceeds 50 characters	422 — length of body object text parameter must be less than 50 characters
4.6	Button object missing text field	422 — text key is mandatory in button object if the template category is authentication
4.7	button_no: "1" (must be 0)	422 — button_no value must be 0 if the template category is authentication
4.8	media.body has two parameter objects	422 — body object must contain only one parameter if the template category is authentication
S-N6	OTP exactly 50 characters (boundary)	200 OK — 50 characters is the accepted maximum

One-Tap Autofill (Feature 5)

ID	Scenario	Expected
5.6	Happy path: full button object	200 OK — message queued, autofill OTP delivered
5.7	OTP text exceeds 15 characters	422 — length of OTP code must be 15 characters or less for one_tap authentication template
5.8	Missing autofill_text	422 — autofill_text key is mandatory in button object if the button_type is one_tap
5.9	Missing package_name	422 — package_name key is mandatory in button object if the button_type is one_tap
5.10	Body text ≠ button text (12345 vs 99999)	422 — body object text parameter and button object text parameter must be same if the template category is authentication (one_tap)
S-N2	Missing button text	422 — text key (OTP code) is mandatory in button object if the button_type is one_tap
S-N3	Missing signature_hash	422 — signature_hash key is mandatory in button object if the button_type is one_tap
S-N4	button_no: "1" (must be 0)	422 — button_no value must be 0 if the template category is authentication (one_tap)
S-N7	OTP exactly 15 characters (boundary)	200 OK — 15 characters is the accepted maximum

Zero-Tap (Feature 6)

ID	Scenario	Expected
6.6	Happy path: full button object	200 OK — message queued, zero-tap delivered
6.7	OTP text exceeds 15 characters	422 — length of OTP code must be 15 characters or less for zero_tap authentication template
6.8	Body text ≠ button text (12345 vs 99999)	422 — body object text parameter and button object text parameter must be same if the template category is authentication (zero_tap)
6.9	button_type: "invalid_type"	422 — button_type must be authentication, one_tap, or zero_tap
S-N1	Missing button text	422 — text key (OTP code) is mandatory in button object if the button_type is zero_tap
S-N5	button_no: "1" (must be 0)	422 — button_no value must be 0 if the template category is authentication (zero_tap)