Reference

REST API Reference

Everything under /v1. JSON in, JSON out. All timestamps are UTC ISO-8601. Authenticated endpoints take a Bearer API key.

Base URL

base url

https://api.mobileapiconnect.com/v1

Authentication

Every authenticated request carries your secret API key as a Bearer token. Keys look like sk_live_ followed by 40 characters. Your key is shown once when you pair the app and is also emailed to you — store it securely; it can't be retrieved again.

authorization header

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Status	Body	Meaning
401	`{"error":"unauthorized"}`	Missing / malformed Bearer key
401	`{"error":"invalid_api_key"}`	Key not found or revoked
403	`{"error":"tenant_inactive"}`	Account suspended

Errors

Errors return a non-2xx status and a JSON body with an error code. Validation failures include the offending fields.

Status	Error	When
400	`validation_error`	Body failed validation — see `issues[]`
401	`unauthorized` / `invalid_api_key`	Auth problem (see above)
403	`tenant_inactive`	Account not active
404	`not_found`	No such message / resource
404	`no_webhook_config`	No webhook provisioned yet
503	`no_active_device_for_tenant`	No paired phone online to send

Messages

POST/v1/messages🔑 Bearer

Queue an outbound SMS. Returns immediately with 202; the paired phone sends it within ~1–2 seconds.

Field	Type	Notes
to required	string	E.164 number, e.g. `+6581230000`
text required	string	1–1600 characters
ref optional	string	Your reference id (≤64 chars), echoed back & in webhooks
callback optional	string (URL)	Per-message delivery callback URL
channel optional	string	Defaults to `"sms"`

curl

curl -X POST https://api.mobileapiconnect.com/v1/messages \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"+6581230000","text":"Hello from Mobile API Connect","ref":"order-4821"}'

202 Accepted

{
  "id": "msg_8sK2x…",
  "status": "queued",
  "createdAt": "2026-06-12T18:40:00.000Z"
}

GET/v1/messages/:id🔑 Bearer

Fetch the status of one message. Lifecycle: queued → sent → delivered (or failed).

200 OK

{
  "id": "msg_8sK2x…",
  "to": "+6581230000",
  "from": null,
  "text": "Hello from Mobile API Connect",
  "ref": "order-4821",
  "status": "delivered",
  "attempts": 1,
  "createdAt": "2026-06-12T18:40:00Z",
  "sentAt": "2026-06-12T18:40:01Z",
  "deliveredAt": "2026-06-12T18:40:04Z",
  "failedAt": null,
  "error": null
}

Unknown id → 404 {"error":"not_found"}.

GET/v1/messages🔑 Bearer

List recent messages, newest first. Query param limit (default 50, max 200).

200 OK

{
  "data": [
    { "id": "msg_…", "to": "+6581230000", "text": "Hello", "status": "delivered", "createdAt": "…" }
  ]
}

Devices

GET/v1/devices🔑 Bearer

List the phones paired to your account, with live counters.

200 OK

{
  "data": [
    { "id": "dev_…", "nickname": "Front desk Pixel", "model": "Pixel 7",
      "status": "active", "lastSeenAt": "…", "sentCount": 412, "receivedCount": 88 }
  ]
}

Pairing is done in the app, not the API. Installing & pairing the Android app creates your account and issues the API key. See the quickstart.

Rules

Manage the auto-reply / forwarding engine programmatically. Concepts are covered in the rules guide.

GET POST/v1/rules🔑 Bearer

List or create rules. A rule has a trigger (matchType = contains|exact|regex|any, pattern, optional fromFilter) and actions (replyEnabled+replyTemplate, email, webhook), plus priority (lower = checked first).

PUT DELETE/v1/rules/:id🔑 Bearer

Update or delete a rule.

GET PUT/v1/rules/settings🔑 Bearer

Master switch, default fallback reply, and forward-all-inbound (email / webhook) settings.

Webhooks

Configure where inbound messages get pushed. Full payload & signature details in the webhooks guide.

GET/v1/webhooks🔑 Bearer

Your webhook config: url, events, enabled, signingSecretPrefix.

PUT/v1/webhooks🔑 Bearer

Upsert the webhook. Body: { url, events?, enabled? }. Returns { ok:true, id }, or 404 no_webhook_config if none provisioned yet (pair a device first).

curl

curl -X PUT https://api.mobileapiconnect.com/v1/webhooks \
  -H "Authorization: Bearer sk_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://yourapp.com/hooks/sms-inbound","enabled":true}'

Ingress (ERP → SMS)

Let your ERP fire an SMS by POSTing its own webhook to a per-integration ingress URL. We extract the recipient and text via JSONPath presets. Walkthroughs in integrations.

POST/v1/ingress/:tokenpublic · token

Public endpoint your ERP calls. No API key — the secret ig_… token authorizes it; add optional HMAC for safety. Returns 202 {id,status,to,text}.

GET POST/v1/ingress🔑 Bearer

List or create integrations. Body: { name, preset, toPath?, textPath?, refPath?, signingSecret?, … }. Presets: generic, zoho, salesforce, dynamics, odoo, netsuite.

PUT DELETE/v1/ingress/:id POST/v1/ingress/:id/rotate🔑 Bearer

Update, delete, or rotate the ingress token.

GET/v1/ingress/presets🔑 Bearer

The built-in JSONPath maps for each ERP preset.

Conventions

JSON only. Send Content-Type: application/json.
UTC timestamps in ISO-8601.
Idempotency: pass your own ref to correlate sends with your records and with inbound webhooks.
Secrets shown once: the sk_live_ key and whsec_ webhook secret are revealed only at pairing.

Try the 5-minute quickstart → Receiving inbound →