Prove you control a phone number: Word Is Bond calls it and speaks a one-time code

Normalizes number to E.164, then places ONE short outbound call to it. The call speaks a 6-digit code twice and hangs up. Confirm the code within 10 minutes with POST /api/numbers/verify/confirm.

Only a salted SHA-256 digest of the code is stored; the code is single-use, expires in 10 minutes, and locks after 5 incorrect confirmations.

This is the only endpoint that dials a number you have not yet proven you control, so it is tightly bounded: 5 starts per account per 10 minutes, 3 calls per number per 24 hours, 5 distinct numbers per account per 24 hours, and the call is charged against the account monthly spend ceiling. Calling an already-verified number returns 200 and places no call.