SMS Alert
MESSAGING · MESSAGING
SMS and one-time passwords sent to contacts and groups from that account.
Connecting SMS Alert in practice
SMS Alert passes the API key as a query parameter on GET URLs, so the credential lands in proxy logs, browser history and anything that records a URL. Every send also has to name a `sender` ID and, for OTP flows, a registered `template`, and a missing one comes back as "no senderid available for your account" or "no template available for your account" rather than a validation error.
Scopes that draw scrutiny
apikey query parameterOne account-wide key, passed in the URL as `?apikey=…`. The same key reaches /user.json (profile), /users/add.json (register a new account) and /changepwd.json (change a password), so it is not a send-only credential.
Worth knowing
- Usage exhaustion is a 402, not a 429: "Payment Required – Action unavailable on your plan or usage limits exceeded". A 429 exists separately for "calling our APIs more frequently than we allow", with no published figure.
- Endpoints carry a .json suffix (push.json, grouppush.json, mverify.json, templatelist.json), and several documented examples still use http:// rather than https://.
- Bulk sends go through a different endpoint and take a `route` (for example transactional) rather than being inferred from the message.
- OTP behaviour is expressed inside the template string itself, as in `[otp length="6" retry="2"]`, so retry policy is content rather than a parameter.
Checked against SMS Alert developers API (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put SMS Alert behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.