SMS Pavilion

SMS API Integration Guide: Authentication, Delivery Reports and Replies

Plan SMS API authentication, sending, delivery reports, inbound replies and rich messaging with practical testing and launch checklists.

This is a preparation and acceptance guide. Available features, endpoints, fields and billing depend on the confirmed project documentation.

The platform showed a directory preview when checked. Preview is not a number allocation or an open purchase offer; check the platform for its current state. Checked: 2026-10-22

SMS Pavilion · Updated:

Integration workflow: SMS API Integration Guide: Authentication, Delivery Reports and Replies

Prepare authentication and account access

Start with the message purpose, destination countries and recipient permission. Verification codes, operational notifications and marketing messages have different content, timing and consent requirements. Identify these requirements before choosing a sending workflow.

Use the current project documentation to confirm signature construction, field ordering, timestamps and credential expiry. Keep credentials on trusted servers. Do not put production secrets in browser code, mobile packages, ordinary logs or public examples. Separate test and production configuration.

A balance query supports budgeting, but a positive balance does not establish that every destination or message is supported. Confirm permissions, billing units, long-message segmentation, test allowance and rate limits before sending.

Checks

  • Assign credential ownership and a rotation procedure.
  • Test authentication failure, clock skew, missing permission and insufficient balance.
  • Keep an internal transaction identifier for operational and billing reconciliation.

Design single, batch and personalised sending

Generate a business message identifier before submission and associate it with the recipient, template version and purpose. Validate numbers in the format supported by the agreed service. Deduplicate requests in your application; a timeout alone is not a reason to send the same message again.

For batch sending with different content, retain the relationship between each recipient and each rendered message. Test missing variables, character encoding and length boundaries. Avoid writing sensitive variables to general logs. Marketing workflows also need opt-out handling and appropriate contact times.

Request acceptance, provider processing and handset receipt are separate events. Retry according to error class: correct invalid input first, use bounded backoff for transient failures and query uncertain submissions before retrying. Confirm partial-success behaviour for batches.

Checks

  • Test single messages, mixed batches and encoding boundaries.
  • Confirm rate limits, duplicate handling and partial failures.
  • Run a small approved recipient test before wider release.

Query results and process delivery callbacks

Use the returned message identifier to query sending results and retain its link to the internal business record. Time-range queries are useful for reconciliation, but require explicit timezone, pagination and retention rules to avoid missed or duplicate records.

A delivery-report receiver should validate the documented signature or source controls, durably record the event and return the required acknowledgement. Events can be delayed, duplicated or out of order. Apply idempotent updates and prevent an older event from replacing a confirmed later state.

Channel-specific terms such as PB status reports are not a universal status model. If the project uses them, obtain field definitions, transitions, retry rules and redacted samples before mapping them to application states. Do not interpret an unspecified success field as proof of handset delivery.

Checks

  • Validate sample signatures, fields and acknowledgements.
  • Test duplicates, reordering, receiver outages and query-based recovery.
  • Measure acceptance, confirmed delivery and business completion separately.

Handle inbound message queries and push events

An inbound SMS is a reply received by a service number. Confirm whether the selected country, number type and channel support replies. Define how a reply is associated with the correct conversation and business record instead of assuming the phone number alone proves user identity.

Inbound queries and inbound push events should share one deduplication model. Confirm sender, destination, encoding, timestamp and unique identifiers. A reply may arrive before a delivery report, and processing can cross date and timezone boundaries.

Create an actionable process for opt-outs and requests to stop contact. Restrict message access and define retention periods. Troubleshooting should use limited, redacted examples rather than complete recipient lists or live verification codes.

Checks

  • Confirm reply support and number ownership.
  • Process overlap between push delivery and recovery queries once.
  • Provide a review route for sensitive or unassigned messages.
Acceptance checklist: SMS API Integration Guide: Authentication, Delivery Reports and Replies

Assess attachments, MMS, RCS and click events

Attachment upload, MMS and RCS require separate support checks. An SMS account does not establish that these features are available. Confirm destinations, networks, devices, sender approval and content review, together with a documented fallback policy.

Check file type, dimensions, size, retention and access permissions before uploading an attachment. Test rich content, buttons and links on real supported devices. Agree whether a failed rich message can fall back to SMS and how a fallback is billed.

A click-event callback records an interaction, not verified identity or a completed purchase. Define event provenance, deduplication, measurement windows and privacy notices. Keep click reporting separate from delivery and application-side conversion records.

Checks

  • Verify upload restrictions and expired attachment links.
  • Test unsupported devices, rejected content and fallback.
  • Report clicks, replies, delivery and conversion as separate measures.

Test the complete workflow before launch

Start with controlled test numbers, then cover invalid credentials, invalid destinations, throttling, insufficient balance, timeouts and unreachable callbacks. Each case should include an expected result, responsible owner and reproducible evidence.

Set budget and frequency caps, alerts and a pause control before production. Keep versioned configuration and rollback steps. Revalidate key flows when changing templates, authentication or callback addresses. For support, share a time range, internal message reference and redacted error rather than secrets.

Checks

  • Verify message purpose, submission, status reconciliation and opt-outs.
  • Assign incident ownership and a billing reconciliation schedule.
  • Increase traffic only after observing a small production rollout.

Related reading

Choosing between an email and an SMS for one customer task

Email and SMS can support the same customer task in different ways. The decision should start with the information the person needs and the action they are expected to take, rather than an assumption that using more channels is always better. SMS Pavilion discusses this as a planning question, not

Planning holiday notices across time zones

Holiday planning becomes more complex when recipients follow different calendars and time zones. A date that is convenient for the sender may be a normal working day, a holiday or already the next day for someone else. SMS Pavilion recommends recording those differences explicitly instead of

Holiday messaging requires a schedule of its own

Holiday messages need their own schedule. A greeting, a business deadline and an account event may occur near the same holiday, but they do not have the same timing requirements. SMS Pavilion recommends separating their purposes before combining them into a seasonal