SMS

Features

• check**Twilio integration** — `POST /orgs/:orgId/sms/send`, per-org webhook URL `POST /sms/webhooks/twilio/:orgId` with x-twilio-signature verification. **Honest:** MessageBird + Sinch adapters are not built today.
• check**CTIA-compliant STOP keyword handling** — inbound `STOP / STOPALL / UNSUBSCRIBE / CANCEL / END / QUIT` writes to `sms_suppressions`; `START / UNSTOP / YES` re-subscribes. **Honest:** suppression is sms-only + per-org; does NOT propagate to email/push for the same recipient.
• check**Recipient-dedup at dispatch** — same `(orgId, recipient, body)` within 60s → `status='suppressed' suppressed_reason='recent_duplicate'`. Same belt-and-braces as Email.
• check**Pre-send suppression check** — recipient on the org's `sms_suppressions` list → `status='failed' metadata.suppressed=true`. Customer API cannot bypass.
• check**`sms.*` events** — `sms.sent` + `sms.delivered` + `sms.failed` fire on the platform bus. **Honest:** no `sms.replied` event today — inbound non-keyword messages aren't surfaced as first-class events.
• check**Per-org rate limit + quota meter** — `reserveQuota` decrements before send; `QuotaExceededError` on hit.
• check**Audit log on every send** — actor + resource + payload size recorded.
• check**Honest non-features:** no audience-targeted single-call send (fan-out via Automation workflow); no Deep Links auto-wrap on outbound bodies; no per-region cost controls (international spend caps not built); no MessageBird / Sinch adapters; no Verify-API integration for OTP (use Auth Service's email OTP instead).

Common use cases

• eastBYOP Twilio SMS in a stack where the same tenant also handles Auth + Customers + Audit — useful when you need the dedup window + STOP keyword compliance without a separate platform.
• eastCross-channel lifecycle via Automation workflows where SMS is a step (Push → wait → Email → SMS) — fan-out happens per-step.
• eastTransactional SMS (order confirmations, alerts) where you already pay Twilio + just need the platform-level send + audit + suppression layer on top.

SMS

curl -X POST https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/send \
  -H "x-api-key: pk_prod_…" \
  -d '{ "to": "+15551234567", "body": "Your code is 482910", "category": "transactional" }'

# Inbound webhook URL to set in Twilio console (org id baked in path):
# https://api.sendoracloud.com/api/v1/sms/webhooks/twilio/<ORG_UUID>
# Twilio signs with auth token — Sendora verifies signature before processing.

# List
curl 'https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/sends?status=failed' \
  -H "x-api-key: pk_prod_…"

# Aggregate
curl https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/stats \
  -H "x-api-key: pk_prod_…"

# Add
curl -X POST https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/suppressions \
  -H "x-api-key: pk_prod_…" \
  -d '{ "phoneNumber": "+15551234567", "reason": "user_request" }'

# List
curl https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/suppressions \
  -H "x-api-key: pk_prod_…"

# Remove (URL-encode the phone — '+' becomes '%2B')
curl -X DELETE https://api.sendoracloud.com/api/v1/orgs/<ORG_UUID>/sms/suppressions/<PHONE_E164_URLENCODED> \
  -H "x-api-key: pk_prod_…"

# Dashboard-only — visual editor for Twilio creds + From-number selection.

Related