Fixed text (Rule)

A rule is a fixed text prefix. When any user sends an SMS to 150073 that starts with your prefix, you get a rule.matched webhook with the sender's number and the full text.

Use rules when a session doesn't fit: printed posters, QR codes, support scripts, or "text HIHI to 150073 to activate". The user doesn't need to open your app first.

Create a rule

curl -X POST https://api.2fa.mn/v1/rules \
  -H "Authorization: Bearer sk_test_..." \
  -H "Content-Type: application/json" \
  -d '{ "prefix": "HIHI", "name": "Activate account" }'

All clients share 150073, so a live prefix can't overlap another client's: neither may be a prefix of the other. If it does, you get 409 prefix_taken; choose a more specific prefix. Test rules never touch operators.

A client can have at most 5 live rules. Beyond that you get 409 rule_limit; email hello@2fa.mn if you need more, and the limit can be raised for your account. The words 2FA, LOGIN, STOP, HELP, TEST and INFO are reserved and can't be used as a prefix.

Response 201 Created:

{
  "id": "rul_3m9q2w",
  "mode": "test",
  "prefix": "HIHI",
  "name": "Activate account",
  "created_at": "2026-12-01T10:00:00Z"
}

Matching

• HIHI, hihi and HiHi all match the prefix HIHI.
• A rule matches on the whole first word: the text must equal the prefix or start with the prefix followed by a space. HIHI matches HIHI and HIHI 123, but not HIHI123.
• Text after the prefix is passed through in text, so HIHI 12345 lets you carry an extra value such as a store or invoice number.
• A message that looks like a session code is matched against sessions, not rules.

The webhook

{
  "id": "evt_5t7y1u",
  "type": "rule.matched",
  "mode": "live",
  "created_at": "2026-12-01T10:00:02Z",
  "data": {
    "rule_id": "rul_3m9q2w",
    "prefix": "HIHI",
    "phone": "99112233",
    "text": "HIHI 12345",
    "operator": "unitel",
    "received_at": "2026-12-01T10:00:01Z"
  }
}

phone is proven: the message physically came from that SIM.

List and delete

curl https://api.2fa.mn/v1/rules -H "Authorization: Bearer sk_test_..."

{
  "data": [
    { "id": "rul_3m9q2w", "mode": "test", "prefix": "HIHI", "name": "Activate account", "created_at": "2026-12-01T10:00:00Z" }
  ]
}

curl -X DELETE https://api.2fa.mn/v1/rules/rul_3m9q2w -H "Authorization: Bearer sk_test_..."

Delete returns 204 No Content.