Returns the authenticated account's settings. No query or body. The exact settings object is shown below; values are illustrative. The same settings shape is returned by PUT, both DELETE operations and successful email verification confirmation.

{
  "data": {
    "enabled": false,
    "emailEnabled": false,
    "telegramEnabled": false,
    "locale": "es",
    "telegramLinked": false,
    "emailAvailable": true,
    "emailMasked": "s***@e***",
    "emailVerified": true,
    "emailSource": "account",
    "telegramAvailable": false,
    "globallyEnabled": false,
    "mode": "disabled",
    "thresholds": [500, 200],
    "pollIntervalSeconds": 60
  },
  "meta": { "requestId": "..." }
}

Replaces the four writable preferences. All four fields are required, even when disabling. Booleans must be JSON booleans; locale must be en or es. If enabled is true, at least one valid channel must be selected. Email selection requires a valid usable email; Telegram selection requires a linked private account and an available channel. Unknown fields, recipients, thresholds and partial bodies are rejected. Returns the settings object above.

curl --request PUT "$API_BASE/api/v2/wallet/alerts" \
  --header "Authorization: Bearer $API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"enabled":true,"emailEnabled":true,"telegramEnabled":false,"locale":"en"}'
# Full opt-out:
curl --request PUT "$API_BASE/api/v2/wallet/alerts" \
  --header "Authorization: Bearer $API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"enabled":false,"emailEnabled":false,"telegramEnabled":false,"locale":"en"}'

Returns up to the latest 50 notification records for this account, newest first. No query parameters, pagination or body are accepted. This is notification history, not a financial ledger or a verification-code history. An empty array means no recorded alerts.

curl --request GET "$API_BASE/api/v2/wallet/alerts/history" \
  --header "Authorization: Bearer $API_TOKEN"

{
  "data": [{
    "id": "1",
    "thresholdEuros": 200,
    "channel": "email",
    "status": "unknown",
    "createdAt": "2026-11-02T12:00:00.000Z",
    "sentAt": null,
    "attempts": 1
  }],
  "meta": { "requestId": "..." }
}

channel is email or telegram; thresholdEuros is 500 or 200; attempts is the recorded attempt count. sentAt can be null. No recipient address, chat ID, code or private link is present in history.

Creates a private, opaque Telegram Start link for the token's own account. Send no body or {}. First check telegramAvailable. The link is single-use, expires after 10 minutes and replaces a previously issued unused link. Treat its URL as a credential. Open it in your own Telegram private chat and press Start; groups, manual chatId/chat_id values and arbitrary recipients are not supported. Do not construct or depend on the opaque Start parameter format.

The HTTP 200 data object is exactly {"url":"<private Telegram Start URL>","expiresAt":"<ISO 8601 timestamp>"}. Read settings afterwards and explicitly enable Telegram using PUT only once telegramLinked is true. This wallet-alert API provides no access to administrator order notifications, administrative chats or other accounts' messages, regardless of the bot used.

curl --request POST "$API_BASE/api/v2/wallet/alerts/telegram-link" \
  --header "Authorization: Bearer $API_TOKEN"

Disconnects this account's private Telegram destination, disables its Telegram selection, invalidates outstanding links and cancels pending Telegram alerts. Send no body or {}. Returns the settings object. Email preferences are not an implied opt-out. The private bot's /stop command also disconnects the wallet-alert link.

curl --request DELETE "$API_BASE/api/v2/wallet/alerts/telegram-link" \
  --header "Authorization: Bearer $API_TOKEN"

Requests a verification message for a separate notification email on this account. Body: exactly {"email":"synthetic@example.invalid"}, replaced with your own inbox. It does not change the login/account email or opt you in. A new request invalidates the previous unused code. The six-digit code expires after 10 minutes and permits at most five incorrect attempts. Request limits are three requests per 15 minutes per account with a minimum one-minute gap; HTTP route limits also apply. The current notification recipient stays in effect until confirmation succeeds.

The HTTP 200 data object is exactly {"expiresAt":"<ISO 8601 timestamp>","mode":"live"}, with mode live or simulation. The code is sent asynchronously to the requested inbox and is never returned by any API response. In simulation mode no real email is sent.

curl --request POST "$API_BASE/api/v2/wallet/alerts/email-verification" \
  --header "Authorization: Bearer $API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"email":"synthetic@example.invalid"}'

Confirms the current unused code for this account. Body: exactly {"code":"123456"}; use the actual six-digit code from your inbox as a string, preserving leading zeroes. Success installs the verified notification email and returns settings with a masked email and emailSource: "notification". It does not automatically opt in or enable a channel. Expired, exhausted or invalidated codes require a fresh verification request; invalid attempts count toward the five-attempt limit.

curl --request POST "$API_BASE/api/v2/wallet/alerts/email-verification/confirm" \
  --header "Authorization: Bearer $API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"code":"123456"}'

Clears the separate notification-email override, invalidates pending verification requests, cancels pending notifications for the previous destination and restores the valid account-email fallback, where available. It does not modify the account email. If no valid fallback exists, email selection is disabled. Send no body or {}. Returns settings with emailSource: "account" and only a masked destination or null.

curl --request DELETE "$API_BASE/api/v2/wallet/alerts/email" \
  --header "Authorization: Bearer $API_TOKEN"

Returns the list of permissions assigned to the authenticated user.

Response:

{
  "data": {
	    "permissions": ["acceso_msmvl"]
  },
  "meta": { "requestId": "..." }
}

Returns wallet information (balance, currency) for the authenticated user.

Response:

{
  "data": {
    "balance": 50000,
    "currency": "EUR"
  },
  "meta": { "requestId": "..." }
}

Possible errors:

Returns the wallet balance change history for the authenticated user.

Query params:

Response:

{
  "data": [
    {
      "name": "John Doe",
      "amount": 1500,
      "type": "debit",
      "description": "eSIM activation",
      "createdAt": "2026-03-11T10:00:00.000Z"
    }
  ],
  "meta": { "requestId": "..." }
}

Possible errors:

Returns active Movistar eSIM products with an effective client price and availability flag.

{
	  "data": [{
	    "id": 123,
	    "name": "Movistar eSIM Solo España · Unlimited data · 28 days · No KYC",
	    "description": "...",
    "priceCents": 1990,
    "available": true
  }],
  "meta": { "requestId": "..." }
}

Delivers one eSIM for the requested catalog product, sends the installation PDF and LPA to deliveryEmail, and charges the authenticated account wallet once at its effective commercial price. A unique Idempotency-Key header is required; retrying the same request returns the original delivery without a second charge or duplicate email.

Headers: Idempotency-Key: <16–100 character unique key>

// Request
	{ "productId": 123, "deliveryEmail": "customer@example.com" }

// Response
{
  "data": {
    "orderId": 456,
    "productId": 123,
    "productName": "Movistar eSIM Solo España · 28 días",
	    "lpa": "1$...",
	    "qrDataUrl": "data:image/png;base64,...",
	    "replayed": false,
	    "emailDelivery": { "status": "sent", "retryAvailable": true }
  },
  "meta": { "requestId": "..." }
}

Possible errors: MOVISTAR_ESIM_STOCK_UNAVAILABLE (409), MOVISTAR_ESIM_INSUFFICIENT_BALANCE (402), MOVISTAR_ESIM_PRODUCT_SETUP_REQUIRED (409), MOVISTAR_ESIM_IDEMPOTENCY_CONFLICT (409).

Resends the delivery PDF and LPA for an existing Movistar eSIM order. It never creates another delivery or charge.

{ "deliveryEmail": "customer@example.com" }

Downloads the protected PDF for a Movistar eSIM delivery belonging to the authenticated account. The response is application/pdf.